Converged Security Publications and CSF Standards

Converged Security Framework - Strategic Standards for Unified Risk Management and Organisational Resilience

This framework establishes strategic standards for unified risk management and organisational resilience. It integrates cybersecurity and physical security measures into a cohesive operational strategy, enabling organisations to address hybrid, systemic, and cascading risks through standardised processes, coordinated responses, governance, risk management, compliance, data dependency management, implementation strategies, incident response planning, stakeholder engagement, and training and awareness programmes.

ST-CSF.001 - Converged Security Framework

The foundational CSI standard defining best practices for implementing unified risk management through converged security frameworks. Covers 12 requirements domains including governance, risk management, technology integration, identity and access management, incident response, training, data protection, and compliance reporting. Aligned with ISO 31000:2018, ISO 27001:2022, ISO 22301:2019, NIS2, DORA, and GDPR. Includes six associated implementation documents (AD-CSF.001 to AD-CSF.006).

ST-CSF.TRA.001 - Training and Awareness

A comprehensive framework for developing unified security competencies across cyber-physical domains. Defines requirements for Cross-functional Security Training Programs, Security Awareness Programs (95% coverage), specialised technology competency for ST-CSF.TIA.001 platforms, and tabletop exercises validating cross-domain incident response. Covers 9 requirements sections including governance, technology integration mastery, and a phased 18-month implementation roadmap. Aligned with NIS2, DORA, GDPR, Cyber Resilience Act, and AI Act. Includes five associated implementation documents (AD-CSF.TRA.001 to AD-CSF.TRA.005).

ST-CSF.GLA.001 - Governance and Leadership Framework

This standard defines the mandatory requirements for establishing comprehensive governance and leadership structures that integrate Cybersecurity, physical security, and operational technology security domains under unified management frameworks. It aligns with the ST-CSF.001 Converged Security Framework, ST-CSF.TIA.001 Technology Integration and Architecture Standard, ST-CSF.IRBC.001 Incident Response and Business Continuity Framework, and the CSI Product-Oriented Endorsement & Readiness Framework. The standard applies to all organisational entities, subsidiaries, and business units under direct managerial control implementing the ST-CSF.001 Converged Security Framework.

ST-CSF.TIA.001 - Technology Integration and Architecture

This standard provides BEST practices for implementing unified Technology Integration and Architecture across cyber-physical security domains. It defines requirements for integrated SIEM and PSIM platforms, Cross-domain Integration, Zero Trust Architecture across IT and OT environments, artificial intelligence and machine learning capabilities for predictive threat analysis, documentation, governance, certification, assessment, monitoring, non-compliance enforcement, data protection, and governing law. The standard includes associated documents AD-CSF.TIA.001 Technology Integration Architecture Standards, AD-CSF.TIA.002 Implementation and Assessment Guide, and AD-CSF.TIA.003 Cross-Domain Incident Response Procedures.

ST-CSF.IRBC.001 - Incident Response and Business Continuity Framework

This standard provides BEST practices for implementing unified Incident Response and Business Continuity capabilities across cyber-physical security domains. It defines the requirements for establishing coordinated response teams, automatic escalation procedures, and integrated business continuity planning that supports the ST-CSF.001 Converged Security Framework approach to unified risk management. It addresses Hybrid Risks, Systemic Risks, and Cascading Risks, with associated guidance for incident response integration standards, technology integration, unified incident response procedures, training and certification requirements, implementation checklists, role-specific response matrices, regulatory compliance mapping, business case analysis, and performance monitoring dashboards.

ST-CSF.IAM.001 - Identity and Access Management Standard

This standard provides requirements for unified Identity and Access Management across cybersecurity, physical security, and operational technology domains. It covers unified identity governance, identity lifecycle management, authentication standards and requirements, authorization and access control, Privileged Access Management, identity federation and integration, monitoring and audit requirements, risk management and threat response, technology standards and architecture, data protection and privacy requirements, implementation timeline and milestones, and review and update procedures. It includes Technical Implementation Standards and Supporting Technical Documentation for identity platform architecture, advanced identity analytics, identity lifecycle management, identity risk assessment methodology, cross-domain identity integration, performance metrics, business continuity, and vendor management.

ST-CSF.DPP.001 - Data Protection and Privacy Standard for Converged Security Framework

This standard provides BEST practices for implementing unified Data Protection and Privacy across cyber-physical security domains. It defines requirements for deploying integrated Privacy Impact Assessment and Data Governance platforms supporting ST-CSF.001 unified privacy risk management, Cross-domain Privacy Integration capabilities, data protection governance controls, Privacy by Design Architecture, Data Loss Prevention Systems, data subject rights, incident response and breach notification, audit and compliance monitoring, third-party data processing, and technical and organisational measures.

ST-CSF.RMA.001 - Converged Security Risk Management and Assessment Standard

This standard establishes mandatory industry-leading converged security risk management protocols, strategic assessment methodologies, and unified governance frameworks that organizations must implement to achieve measurable operational superiority and competitive advantage across all security domains. It provides specific requirements for implementing unified risk assessment, comprehensive threat analysis, integrated compliance management, risk-to-response coordination, identity-related risk management, CCSO authority structures, board-level oversight, and automated response integration within the ST-CSF.001 Converged Security Framework mandatory governance structures.

Chief Converged Security Officer (CCSO) Policy

Organisational and Leadership Standard

Establishes unified governance framework for the CCSO role with executive authority across cyber, physical, and operational technology domains. Covers governance structure, risk management, IAM, incident response, compliance, and 21 policy sections across 4 parts.