GRCLibrary.ai

Document type

Standards

78 documents. Normative control requirements that policies delegate to and audits test against.

Documents, 78

Every document of this type

Each with its area and its purpose; a document that states no purpose gets a line naming its type and area. A title in a corpus area opens the document's page, which holds the record and, where the document has them, its outline, frameworks, and related documents; a title in the Library area is a library specification with no page and opens its source on GitHub. The full text of every document is read on GitHub.

  • AI Access and Agent Permissions StandardAIThis standard defines the access governance for AI systems and agents: who can use which AI capability, what an AI agent is permitted to do on the user's behalf, how identity propagates through agentic actions, and how access is reviewed. It extends the identity and access management policy to the AI-specific surface where the actor is not a person but a model invoking tools.
  • AI and Agentic Development Security StandardAIThis standard sets the technical security requirements for systems that incorporate LLMs, RAG pipelines, autonomous or semi-autonomous agents, MCP integrations, and AI-assisted development tooling. It is the technical and agentic-runtime implementation layer for AI security in the library: the governance-level minimum requirements are set by the AI Security and Risk Standard, and both apply cumulatively to a system in scope of both.
  • AI Data Quality and Readiness Validation StandardAIThis standard sets the measurable data-quality requirements and the readiness sign-off gate that a dataset must satisfy before it is used to train, fine-tune, evaluate, or operate an AI system at scale. It owns the data-quality model, the measures and targets, and the data-use approval that the training-data governance procedure, the dataset datasheet, and the AI System Register reference.
  • AI Human-Oversight StandardAIThis standard consolidates the organization's human-oversight requirements for AI systems into one citable statement. Oversight obligations are otherwise scattered across the AI policy, several AI standards, the system-card template, the audit-and-certification framework, and the ethical-use guideline; a reader cannot see the whole obligation in one place, and the scattered forms risk drift. This standard states the consolidated requirement, defines a six-mode human-AI interaction taxonomy so an oversight design can be named precisely, and fixes the rules for override, automation-bias prevention, negative consent, and disclosure.
  • AI Inference Cost Governance StandardAIThis standard defines how the organization governs the cost of AI inference and training: budgeting, allocation, ceiling enforcement, model-choice criteria, monitoring, anomaly response, and reporting. AI costs are volatile and easily exceed forecasts; this standard ensures that AI use is economically rational and that runaway spend cannot occur silently.
  • AI Model Risk StandardAIThis standard defines minimum requirements for assessing and managing AI model risk. It operationalizes the AI Model Risk Framework through enforceable expectations for data provenance, interpretability, representation, robustness, alignment, monitoring, documentation, approval, and retirement.
  • AI Model Succession and Identity Continuity StandardAIWhen an AI model or an action-capable agent is succeeded by a new version, the predecessor's standing does not transfer to the successor by default. Standing here means the approvals the predecessor held (its production or use approval), the delegations and access granted to it, and any forum or decision standing it exercised. A successor is a new subject for authority purposes, and it establishes its own standing through a fresh grant rather than inheriting the predecessor's by continuity of name or platform.
  • AI Security and Risk StandardAIThis standard defines minimum security and risk requirements for AI systems. It is original repository content informed by common AI, cloud, privacy, and security assurance practices and does not reproduce restricted third-party control or questionnaire text.
  • AI Testing, Validation and Documentation StandardAIThis standard defines the mandatory requirements for testing, validating, and documenting artificial intelligence systems throughout their lifecycle. It ensures that AI models deployed by the organization are technically sound, ethically validated, explainable, and compliant with applicable standards and regulations before and after deployment.
  • AI Total Cost of Ownership Governance StandardAIThis standard governs the full-lifecycle cost of an AI capability as governance evidence. A business case, or a continue-or-retire decision, judged on metered runtime spend alone systematically understates cost, because the costs that make an AI capability's lifecycle total diverge from its provider invoice are the non-metered ones: people, integration, oversight, governance overhead, model succession, and decommission. Recording, owning, and re-forecasting the total lets the cost side of an AI decision be weighed on lifecycle terms.
  • API Design StandardArchitectureThis standard governs the design of application programming interfaces (APIs) produced by the organization. It complements the API security standard (which governs the security controls on APIs) by addressing the design choices that determine usability, longevity, and correctness.
  • Architecture Decision Records StandardArchitectureThis standard defines how significant architecture decisions are recorded. Architecture decision records (ADRs) capture the context, the decision, the alternatives considered, the trade-offs accepted, and the consequences expected. They are the durable, searchable record of architecture practice.
  • Data Architecture StandardArchitectureThis standard governs the data architecture practice: how data is modelled, owned, integrated, served, and retired across the organization. It complements the data classification and handling standard (which governs the controls applied to data) and the privacy and data governance policy (which governs the organization's privacy posture) by addressing the architectural choices that determine how data flows and is consumed.
  • Integration Architecture StandardArchitectureThis standard governs the architecture of system-to-system integration: the patterns used, the transports selected, the contracts established, and the operational characteristics required. It complements the API design standard (which governs synchronous request-response contracts) and the data architecture standard (which governs data flow) by addressing the architectural choices that determine how systems communicate over time.
  • Reference Architecture StandardArchitectureThis standard governs how reference architectures are commissioned, authored, reviewed, published, consumed, and kept current. A reference architecture is a documented, recommended pattern for solving a recurring class of problem; consuming teams adopt it directly or justify a deviation.
  • Technology Radar StandardArchitectureThis standard governs how the organization curates its technology choices over time. The technology radar is a structured way to evaluate, classify, and communicate the organization's stance on specific technologies, techniques, platforms, languages, and tools.
  • Internal Audit StandardComplianceThis standard establishes the requirements, principles, and operational framework governing the internal audit function within the GRC programme. It defines how internal audits are planned, conducted, reported, and followed up to provide objective assurance that controls are designed appropriately and are operating effectively.
  • Sanctions and Export-Control Screening StandardComplianceThis standard defines the minimum control structure for screening the organization's counterparties, transactions, products, and ownership relationships against economic-sanctions and export-control regimes, and for verifying beneficial ownership to the extent sanctions screening requires it. It exists because sanctions and export-control exposure is currently addressed only incidentally across the corpus (as a trigger in supplier and merger procedures), with no dedicated screening method.
  • Crypto-Asset MiCA Regulatory Submission and Templated-Filing StandardCryptoThis standard states the organization-neutral controls that govern how a crypto-asset market participant prepares, attests, submits, and maintains the regulatory filings the Markets in Crypto-Assets Regulation (Regulation (EU) 2023/1114, MiCA) and its implementing and regulatory technical standards require: the asset-referenced-token issuer authorization application, the crypto-asset-service-provider authorization application, the notification by an already-authorized financial entity intending to provide crypto-asset services, and the ongoing obligations and event-driven notifications that follow authorization. It is the submitter-side control layer: what an applicant must assemble, how it attests to completeness and accuracy, which delegated-regulation form or template carries each submission, and how it keeps a submitted file current.
  • Crypto-Asset Reserve and Prudential Requirements StandardCryptoThis standard sets the requirements for the reserve of assets backing a stable-value crypto-asset, the holder's right of redemption against that reserve, the issuer's own funds, the service provider's prudential safeguards, the liquidity management of the reserve, and the recovery and redemption plans that govern the token's stressed and end-of-life states. It is a requirements document under the Crypto-Asset Governance Framework (crypto/framework-crypto-asset-governance.md) and supplies the reusable core that the MiCA implementation annex (compliance/financial-services/annex-mica-implementation.md) maps to; the annex holds the regime navigation and this standard holds the requirements.
  • Crypto-Asset Service Provider Vetting StandardCryptoThis standard sets the crypto-specific acceptance requirements for selecting and onboarding an external provider through which the organization trades, exchanges, transfers, safeguards, or obtains access to crypto-assets. It is a requirements overlay under the Crypto-Asset Governance Framework, implemented through the organization's existing supplier lifecycle (intake, tiering, due diligence, contracting, monitoring, and exit), and it is not a substitute for the authorization, procurement, legal, security, privacy, or financial-crime review that applicable law and internal policy require.
  • Crypto-Asset White-Paper Content and Disclosure StandardCryptoThis standard states the organization-neutral controls that produce a compliant crypto-asset white paper and govern its content, mandatory statements, notification or approval, publication, modification, and the disclosure-linked rights and liabilities that attach to it. It is the disclosure-governance control layer for the Markets in Crypto-Assets Regulation (Regulation (EU) 2023/1114, MiCA) white-paper regime, covering the three asset classes MiCA distinguishes: crypto-assets other than asset-referenced tokens or e-money tokens (Title II), asset-referenced tokens (ARTs, Title III), and e-money tokens (EMTs, Title IV).
  • Digital Asset Custody StandardCryptoThis standard sets the requirements for safekeeping and custody of crypto-assets and the means of access to them (private keys and equivalent credentials). It is a requirements document under the Crypto-Asset Governance Framework (crypto/framework-crypto-asset-governance.md), which names custody as a risk domain and a governance requirement and defers the detail here. It relates to, and does not duplicate, the organization's cryptographic key controls in the security domain; key-lifecycle mechanics live there and this standard adds only the custody-specific requirements.
  • Smart-Contract and Oracle Risk StandardCryptoThis standard sets the crypto-domain governance requirements for deploying, upgrading, relying on, and integrating smart contracts and the oracles and external data feeds they depend on. It is a requirements overlay under the Crypto-Asset Governance Framework. It governs the domain-specific decisions that surround a smart contract, the decision to deploy or rely on one, how its upgrade and change are authorized, and how its oracle and network dependencies are managed, and it does not restate code-level secure development, which the Secure Development and Engineering Policy and its companion developer-security documents own, nor the threat-modelling method, which the Threat Modelling Standard owns.
  • API Security StandardDev securityThis standard defines the minimum security controls for every API the organization produces, exposes, or consumes. It covers REST, GraphQL, gRPC, WebSocket, and event-driven APIs. It applies whether the API is internal, partner-facing, or public.
  • AWS Cloud Hardening Baseline StandardDev securityThis standard defines the hardening baseline for Amazon Web Services environments operated by or on behalf of the organization. It expresses outcomes and control intent in vendor-neutral language and references AWS service classes by their generic role rather than reproducing vendor configuration guidance verbatim.
  • Azure Cloud Hardening Baseline StandardDev securityThis standard defines the hardening baseline for Microsoft Azure environments operated by or on behalf of the organization. It expresses outcomes and control intent in vendor-neutral language and references Azure service classes by their generic role rather than reproducing vendor configuration guidance verbatim.
  • Container and Image Security StandardDev securityThis standard defines the security controls applied to container images, container runtimes, image registries, and the supply chain that produces and distributes images. It covers Linux containers (Docker, OCI), Windows containers, Kubernetes and equivalent orchestrators, serverless container platforms, and the secure-build pipelines that produce images.
  • Developer Security RequirementsDev securityThese requirements are design constraints that apply from the first line of code. Failure to meet them must block production promotion. For a quick-reference version, see the Security Quick Reference standard. For AI-specific security requirements, see the AI and Agentic Development Security Standard.
  • DevOps Security RequirementsDev securityThis standard defines security requirements for DevOps engineering: CI/CD pipelines, infrastructure as code, environment management, container security, and automation platform operational security. For production and infrastructure operations controls, see the operations domain. For developer security requirements, see the Developer Security Requirements Standard.
  • Google Cloud Platform Hardening Baseline StandardDev securityThis standard defines the hardening baseline for Google Cloud Platform environments operated by or on behalf of the organization. It expresses outcomes and control intent in vendor-neutral language and references GCP service classes by their generic role rather than reproducing vendor configuration guidance verbatim.
  • Jakarta EE Application Security StandardDev securityThis standard defines the security controls for server-side Java applications that the organization builds on the Jakarta EE platform, or on its predecessor Java EE where still in service. It covers the platform's own security features (authentication mechanisms, identity stores, declarative and programmatic authorization, the authentication and authorization service-provider interfaces) and the servlet-layer concerns that sit around them: sessions, cookies, transport, container configuration, injection, error handling, logging, and patching.
  • Mobile Application Security StandardDev securityThis standard defines the security controls applied to mobile applications the organization develops, publishes, or significantly customizes. It covers iOS and Android applications; mobile-web is governed by the API security standard plus the web-application standards in the dev-security domain.
  • Quality Assurance and Testing StandardDev securityThis standard defines the Quality Assurance (QA) and testing framework for software, infrastructure, and system changes to ensure that consistent reliability, performance, and compliance are achieved across all organizational technology environments. It establishes testing lifecycle stages, quality gates, acceptance criteria, and validation requirements for projects and releases.
  • Security Baseline and Standards ReferenceDev securityThis document establishes the security framework, governing principles, data classification model, identity architecture, and network security model applicable to all computing environments, development programmes, and activities within an organization's security boundary. It applies to all cloud environments, all internal and outsourced development, and all personnel, contractors, and service providers with access to organizational systems, data, or code repositories.
  • Security Quick ReferenceDev securityThis quick reference condenses the most common development security questions into one page: the prohibitions and their exception requirements, the authentication, data-handling, secrets, environment, pipeline, and encryption rules, and the pre-production checklists, each pointing back to the governing standard or procedure. It is the first stop for developers, DevOps practitioners, and platform engineers; when the answer is not here, the relevant standard and then the security team are the next stops.
  • Software Composition Analysis StandardDev securityThis standard defines the requirements for Software Composition Analysis (SCA) across all software development, evaluation, and procurement activities. SCA identifies, tracks, and manages the security and licensing risks introduced by open-source components, third-party libraries, and their transitive dependencies.
  • Software Evaluation, Acceptance and Lifecycle Management StandardDev securityThis standard defines the governance, evaluation, and control requirements for acquiring, testing, approving, deploying, maintaining, and retiring software across the organization. It ensures that all software introduced into the environment is secure, licensed, compliant, and operationally validated before enterprise use, in accordance with the organization's risk, compliance, and change management framework.
  • Delegation-of-Authority StandardGovernanceThis standard defines the delegation instrument: the recorded artefact by which a role holding an authority grants some part of it to another subject. The corpus provides typical, adjustable role authorities (governance/register-role-authority.md, whose column is "Typical Approval Authority") and refers to delegation only incidentally ("or delegate", "CIO or delegate"), with no standard for how a delegation is constituted, bounded, evidenced, sub-delegated, or revoked. This standard supplies that instrument, so a delegated authority is as governed as the authority it derives from.
  • Emergency Authority StandardGovernanceAn emergency lets a person, a system, or an AI agent exercise authority it would not ordinarily hold, to prevent or limit harm when the normal approval path is too slow. The corpus already carries domain-specific emergency paths (break-glass access, emergency change, emergency patch, crisis activation, incident containment, precautionary suspension), each with its own approver and its own after-the-fact review. What it does not carry is the general construct those paths share: what makes an emergency grant valid, how it is bounded, when it expires, what triggers an independent review of its continuation, and how its use is judged for proportionality after the fact.
  • Maturity Assessment Methodology StandardGovernanceThis standard defines the methodology for assessing governance programme maturity across the library's domains.
  • Records Retention and Destruction StandardGovernanceThis standard establishes controls, retention schedules, destruction methods, and documentation requirements for managing information and records throughout their lifecycle. It ensures that records, both physical and digital, are retained, secured, and disposed of in compliance with legal, regulatory, contractual, and operational requirements, including those governing privacy, AI governance, supply-chain trade compliance (BASC), and data protection.
  • Semantic Continuity in Migration and Retirement StandardGovernanceWhen one thing replaces another, the organization tends to verify that the move was complete: the records transferred, the checksums match, the new system is readable and populated. Completeness answers whether the bits arrived; it does not answer whether the successor decides, classifies, or behaves as the predecessor did. A migration can be complete and lossless at the level of data and still change the meaning of the outputs: a re-mapped code list, a re-trained model, a replacement control that admits a different population. When the predecessor is then retired, that semantic change becomes invisible and irreversible.
  • Capacity and Performance Management StandardOperationsThis standard governs how capacity and performance are planned, measured, tested, and adjusted for services operated by the organization. It aligns capacity to demand at acceptable cost and performance, while preserving the headroom required for failure scenarios and growth.
  • Certificate Authority Management StandardOperationsDefines requirements for establishing, operating, and maintaining the internal Certificate Authority (CA) infrastructure. Governs certificate issuance policy, CA hierarchy design, use-case scope, and the boundary between the internal CA and externally trusted commercial CAs. Supplements the Cryptographic Key Operations Procedure, which addresses day-to-day certificate lifecycle operations.
  • Cloud Security Configuration BaselineOperationsThis standard defines the secure configuration baseline for cloud and cloud productivity environments. It establishes minimum security configuration requirements for the cloud platform, enterprise identity provider, cloud productivity platform, and associated services to reduce attack surface and ensure that a consistent security posture is maintained across all tenants and subscriptions.
  • IT Financial Management StandardOperationsThis standard defines how IT expenditure is planned, allocated, monitored, attributed, and optimized. It expresses outcomes and governance expectations, not a specific accounting policy. The standard supports the capacity and performance management standard, the AI inference cost governance standard, and the supplier and third-party risk management policy by providing the financial discipline within which those operate.
  • Network Security and Segmentation StandardOperationsThis standard defines requirements for network security architecture, segmentation, and perimeter controls across on-premises and cloud environments. It establishes technical and procedural controls for securing organizational networks, including requirements for network segmentation, firewall configuration, intrusion detection and prevention, and secure connectivity.
  • Observability and Telemetry StandardOperationsThis standard defines minimum observability and telemetry requirements for services operated by the organization. It complements the security logging and monitoring standard (which focuses on security-relevant events) and the AI evaluation procedure (which focuses on model behaviour) by covering operational health, performance, reliability, and customer-experience signals.
  • OT/ICS Security StandardOperationsThis standard establishes mandatory security requirements for Operational Technology (OT) environments operated by the organization, including Industrial Control Systems (ICS), Supervisory Control and Data Acquisition (SCADA), Distributed Control Systems (DCS), Programmable Logic Controllers (PLCs), Human-Machine Interfaces (HMIs), Building Management Systems (BMS), and Safety Instrumented Systems (SIS).
  • Physical Security of IT Infrastructure StandardOperationsDefines minimum physical security requirements for IT infrastructure areas under direct control of the CIO. Ensures that hardware, cabling, and IT equipment are protected from unauthorized physical access, tampering, environmental hazards, and theft. Supports the Information Security Policy and the Standard: Cloud Security Configuration Baseline (which governs logical controls). Aligns to ISO/IEC 27001:2022 Annex A.7 (Physical Controls) within IT scope.
  • Production Security RequirementsOperationsThis standard defines security requirements for production infrastructure and operations. It covers the controls that govern how production systems are secured, monitored, changed, and recovered. For deployment pipeline and DevOps controls, see the DevOps Security Requirements Standard.
  • Service Level Management StandardOperationsThis standard defines the requirements for establishing, monitoring, reviewing, and managing Service Level Agreements (SLAs) and Operational Level Agreements (OLAs) across all IT services. It establishes how service targets are set, how breaches are detected and escalated, how SLA performance is reported, and how SLAs are maintained over the service lifecycle. It supports ISO/IEC 20000-1:2018 §8.3.3, ITIL 4 Service Level Management practice, and COBIT 2019 DSS02.
  • Site Reliability Engineering StandardOperationsThis standard defines the site reliability engineering (SRE) practice for services operated by the organization. It expresses outcomes and operating principles for reliability, not vendor-specific tooling. The standard complements the service-level management standard (which formalizes the contract with the customer) and the observability and telemetry standard (which provides the measurement substrate).
  • Network Telemetry and DPI Controls StandardPrivacyThis standard defines the technical controls applied to network telemetry used in workforce network monitoring: flow telemetry (connection and traffic metadata) and deep-packet-inspection (DPI) telemetry (telemetry derived from inspecting packet content). It sets requirements for how such telemetry is scoped, minimized, and configured so that the collection stays confined to metadata wherever the aim allows, by default excludes special-category-revealing data and personal-device traffic before that data enters the pipeline (subject only to the narrow, documented, approval-gated exception this standard defines for special-category data), and, where telemetry is aggregated, resists re-identification.
  • Presence Inference Limitations StandardPrivacyThis standard sets normative limits on what may be inferred from network and system presence signals about a person's work. It operationalizes the prohibition in the Workforce Network Monitoring Policy (Section 7, "Presence is not proof of work") by defining, in enforceable terms, how presence-derived signals may and may not be used, the caveats any presence-derived metric must carry, how the error modes of presence data are handled, and who governs presence metrics.
  • Pseudonymization and Anonymization StandardPrivacyThis standard defines pseudonymization and anonymization techniques permitted in the organization, the requirements for each technique, and the re-identification risk assessment that determines whether a data set has crossed from pseudonymous (still personal data) to anonymous (no longer personal data). It supports lawful data minimization, secure analytics, AI training data preparation, research, and cross-border transfer scenarios.
  • Business Continuity and Disaster Recovery StandardResilienceThis standard defines minimum requirements for business continuity, disaster recovery, backup, restoration, dependency mapping, testing, validation, and evidence capture.
  • Enterprise Risk Management StandardRiskThis standard defines the enterprise-wide risk management framework, taxonomy, and scoring methodology that guide the identification, evaluation, treatment, and monitoring of risks across all business units and functions. It ensures that risk management practices are consistent, measurable, and traceable, aligned with ISO 31000:2018, COBIT 2019 APO12, and CSA CCM v4.1 GRC-02.
  • Third-Party and Supply Chain Risk StandardRiskThis standard defines the framework, methodology, and control requirements for identifying, assessing, treating, and monitoring risks arising from third-party relationships and supply chain dependencies. It is the master third-party and supply-chain risk standard for the library: the enterprise risk-management lens, the lifecycle expectations, and the contracting controls are all defined here. Operational procedures in the supply-chain domain implement the lifecycle steps; this standard governs them.
  • Authentication and Password Management StandardSecurityTo establish consistent, risk-proportionate authentication controls that reduce the risk of credential theft, brute force, and account takeover.
  • Data Classification and Handling StandardSecurityTo ensure that information is handled consistently according to its sensitivity, regulatory obligations, and business impact, while supporting confidentiality, integrity, and availability. Aligns with ISO/IEC 27002:2022 §§5.12 to 5.15, COBIT 2019 DSS05, CSA CCM v4.1 DSP-04, GDPR Article 32, ISO/IEC 27701:2025 (data retention and deletion; section numbering changed in 2025 standalone revision), and the applicable BASC International Security Standard (6.0.2 or 6.0.3).
  • Data Loss Prevention StandardSecurityThis standard defines the governance, architecture, and technical controls for the Data Loss Prevention (DLP) programme. It establishes how the organization detects, monitors, and prevents unauthorized disclosure, transfer, or loss of data across all platforms. It ensures that consistent protection of sensitive data in use, at rest, and in motion is maintained in accordance with the Data Classification Model.
  • Email Security StandardSecurityThis standard defines the minimum email security controls operated by the organization. It covers email authentication (SPF, DKIM, DMARC, BIMI), inbound anti-phishing and anti-malware controls, outbound controls, business email compromise (BEC) mitigations, user reporting, secure email gateway requirements, and the supplementary controls applicable to high-risk roles.
  • Endpoint Hardening StandardSecurityThis standard defines the hardening baseline for endpoints used in the organization's environment. It covers managed workstations and laptops on all major operating systems, mobile devices, and the BYOD posture for unmanaged personal devices that access organizational resources. The standard is the technical companion to the endpoint management procedure (which governs operations) and the BYOD policy (which governs scope).
  • Logging and Monitoring StandardSecurityTo ensure that consistent, auditable, and secure handling of log data is maintained, aligned with ISO/IEC 27002:2022 §8.15, NIST SP 800-92, COBIT 2019 DSS05, CSA CCM v4.1 LOG-01 and LOG-03, and the EU NIS 2 Directive.
  • Monitoring Integrity and Coverage StandardSecurityMonitoring tells an organization what is happening in its systems, and every downstream security and operational decision rests on the assumption that the monitoring is working. That assumption is rarely governed as a whole. Individual controls in this library detect adverse events in monitored systems, and a few already watch specific monitoring sources for silence: a critical log source that stops feeding the security-information and event-management platform, a telemetry platform required to observe its own loss. What the library has lacked is a single standard that governs the integrity and coverage of monitoring across every domain and failure mode, so that those scoped operational checks sit under one accountable, risk-governed frame and the gaps between them are closed.
  • Penetration Testing and Red Team StandardSecurityThis standard defines the requirements for the organization's penetration testing and red team programme. It establishes the minimum scope, frequency, methodology, and reporting requirements for both internal vulnerability assessment and externally conducted penetration testing.
  • Personnel Security Screening StandardSecurityThis standard defines the organization's minimum requirements for personnel security screening. It governs pre-employment background verification for all employees and contractors, with heightened requirements for roles with access to sensitive systems, data, or privileged accounts.
  • Privileged Access Management StandardSecurityTo ensure that privileged accounts are managed, monitored, and revoked according to a documented, auditable process that reduces the attack surface available to insider threats and external adversaries.
  • Remote Working Security StandardSecurityThis standard defines the minimum security requirements for personnel working remotely: that is, working from any location outside a corporate office, including home, hotels, client sites, co-working spaces, and public locations. It establishes enforceable requirements for device security, network usage, physical workspace protection, and data handling when work is conducted outside the controlled office environment.
  • SaaS Security Posture Management StandardSecurityThis standard defines the security posture management of the organization's SaaS portfolio: inventory, configuration baselines, continuous posture monitoring, SaaS-to-SaaS integration risk, third-party application access, shadow-SaaS detection, and offboarding. It complements the supplier programme (which addresses contractual and assurance posture) with the technical and configuration posture of SaaS in use.
  • Security Awareness and Training StandardSecurityTo ensure that all personnel understand their security obligations, can recognize common attack vectors, and know how to respond. Supports the Information Security Policy and applicable human capital governance.
  • Security Operations Centre Operating Model StandardSecurityThis standard defines the operating model for the security operations centre (SOC). It covers capability tiers, staffing model, tool stack, coverage hours, detection engineering, threat hunting, intelligence integration, on-call governance, shift handover, MTTD and MTTR targets, and the supplier-managed-SOC model where one is used.
  • Threat Modelling StandardSecurityThis standard defines how the organization conducts threat modelling: the structured analysis that identifies what an attacker could do to a system, where, and how, before that system is built or substantially changed. Threat modelling complements the Penetration Testing Standard (which validates controls in practice) and the Vulnerability Management Procedure (which addresses present, known weaknesses) by surfacing the design-level attack surface that those activities cannot reach.
  • Cloud Exit and Data Portability StandardSupply chainThis standard defines the requirements for planning, managing, and executing the exit from any cloud service provider or SaaS platform, and for ensuring portability of organizational data and workloads between platforms. It ensures that the organization is not locked into any single cloud provider without a documented exit path, and that all cloud contracts include minimum data portability and deletion rights.
  • Supplier Resilience Monitoring StandardSupply chainThis standard defines the resilience signals monitored for critical suppliers, the thresholds that trigger action, the cadence of monitoring, and the escalation path. It complements ongoing supplier monitoring (which focuses on contractual and security compliance) with a specific lens on whether the supplier remains capable of delivering its service.
  • Supplier Security and Privacy Assurance StandardSupply chainThis standard defines the minimum information security and privacy assurance requirements that suppliers, processors, and other third-party service providers must meet as a condition of doing business with the organization. It establishes the evidence and contractual obligations the organization requires, and the assessment methods used to verify compliance.

With script, All Documents, filtered to Standards, lists these 78 documents, and the area chips holding any of them, and its text filter, narrow them further.