GCSB seal
GCSB
Global Converged Security Board

GCSB Organisational Trustmark

Self-Assessment

Benchmark your organisation against the GCSB CSF Version 2.0 standards: 42 questions in ten domains. Your answers stay in this browser until you apply.

Progress: 0 of 42 answered. This is an indicative benchmark only; the tier is decided by the GCSB Assessment Board from your evidence.

Domain 1: Governance and Leadership

Source: GCSB-ST-CSF-GLA-001 · Weight 15%

  1. 1. Has the organisation appointed a Chief Converged Security Officer (CCSO) or equivalent accountable leader with authority across cyber, physical and operational technology security?

  2. 2. Does the governing body receive regular integrated security reports covering cyber, physical and operational technology risks?

  3. 3. Are cross-domain performance indicators defined, owned and tracked?

  4. 4. Is there a documented converged security governance framework with policies, roles and responsibilities?

  5. 5. Is there executive sponsorship for the converged security programme with resources proportionate to risk?

Domain 2: Risk Management and Assessment

Source: GCSB-ST-CSF-RMA-001 · Weight 15%

  1. 1. Is an integrated risk register maintained covering cyber, physical and operational technology risks?

  2. 2. Are hybrid risks (threats exploiting physical and digital vulnerabilities together) systematically identified and assessed?

  3. 3. Are systemic and cascading risk scenarios analysed in the risk assessment process?

  4. 4. Is the risk methodology aligned with a recognised framework such as ISO 31000?

  5. 5. Are risk assessments performed at defined intervals, at least annually, with documented treatment plans?

Domain 3: Technology Integration and Architecture

Source: GCSB-ST-CSF-TIA-001 · Weight 15%

  1. 1. Are security monitoring capabilities integrated across cyber and physical domains to a level proportionate to the organisation's risk?

  2. 2. Are access decisions across IT and OT environments based on continuous verification and least privilege, appropriate to risk?

  3. 3. Where analytics or automation are used for threat detection, are they governed, documented and subject to human oversight?

  4. 4. Are cyber and physical security information sources brought together for a combined operational view?

  5. 5. Does the architecture support cross-domain incident escalation and coordinated response?

  6. 6. Are cloud and hybrid environments included in security monitoring arrangements?

Domain 4: Identity and Access Management

Source: GCSB-ST-CSF-IAM-001 · Weight 10%

  1. 1. Are identity and access arrangements coordinated across physical, IT and OT access?

  2. 2. Is multi-factor authentication enforced for privileged and remote access?

  3. 3. Is role-based access control implemented and periodically reviewed across domains?

  4. 4. Are joiner, mover and leaver processes integrated across physical and logical access?

Domain 5: Incident Response and Business Continuity

Source: GCSB-ST-CSF-IRBC-001 · Weight 15%

  1. 1. Is there an integrated incident response plan covering cyber, physical and OT disruptions?

  2. 2. Are recovery time and recovery point objectives defined and tested for critical services?

  3. 3. Are cross-domain response roles, escalation paths and communication protocols defined?

  4. 4. Is the business continuity plan aligned with a recognised framework such as ISO 22301 and tested in the last 12 months?

  5. 5. Are multi-domain exercises conducted at least annually?

Domain 6: Training and Awareness

Source: GCSB-ST-CSF-TRA-001 · Weight 10%

  1. 1. Do personnel receive cross-functional security awareness training, including hybrid threat scenarios, with completion targets set and monitored?

  2. 2. Is role-specific training provided for staff operating converged security technologies and processes?

  3. 3. Are exercises used to validate cross-domain response competence?

  4. 4. Is training content reviewed promptly after material changes in technology or threat landscape?

Domain 7: Data Protection and Privacy

Source: GCSB-ST-CSF-DPP-001 · Weight 10%

  1. 1. Are data protection impact assessments carried out for new security systems and processing activities?

  2. 2. Are data protection controls aligned with applicable law (such as UK GDPR or EU GDPR) and integrated into security governance?

  3. 3. Are controls in place to prevent and detect unauthorised disclosure of data, proportionate to risk?

  4. 4. Are data subject rights procedures documented and operational?

Domain 8: Compliance and Regulatory Alignment

Source: GCSB-ST-CSF-001 · Weight 5%

  1. 1. Are applicable legal, regulatory and sector obligations mapped into a single compliance view?

  2. 2. Are compliance status and gaps reported to the governing body at defined intervals?

  3. 3. Is compliance with the GCSB standards reviewed at least annually?

Domain 9: CCSO Policy and Organisational Leadership

Source: GCSB-POL-CSF-CCSO-001 · Weight 5%

  1. 1. Are the CCSO's (or equivalent's) mandate, reporting line and independence documented?

  2. 2. Are exception approvals documented with defined authority, duration and review?

  3. 3. Is converged security leadership represented in strategic and investment decisions?

Domain 10: Continuous Improvement and Monitoring

Source: GCSB-ST-CSF-001 · Qualifying check (all must be Yes)

  1. 1. Are performance indicator reports produced at defined intervals and tracked against thresholds?

  2. 2. Is an annual self-assessment documented with evidence of improvement actions?

  3. 3. Are material changes to the integrated security architecture notified to the relevant governance bodies within 30 days?

Finished your assessment? The next step is your application.

Your answers are saved in this browser. Submit your application in the Trustmark Portal so the Assessment Board can review it.

Now submit your application