Converged Security Framework - Governance and Leadership Framework

Governance and Leadership Framework. Board-approved standard, v2.0. Not a peer-reviewed Journal article. The purpose is to establish accountable cross-domain governance: oversight, delegated executive authority, coordination, risk decisions, competence, evidence, change control and continuity. Benefits shall be assessed against a documented baseline, using evidence-based evaluation rather than promising outcomes no governance structure can guarantee. The adopter shall document entities, business units, services, assets, data, personnel and external interfaces within scope, and the justification for exclusions. Cybersecurity, physical security and OT security shall be addressed where present or materially connected to the organisation's risk. An organisation without OT need not invent an OT estate; the scope record shall explain that absence and relevant external dependencies. Subsidiaries and controlled entities shall be addressed according to actual authority. Joint ventures, partners and suppliers shall be governed through applicable law, agreements and the adopter's lawful access rights. Access to systems or data does not confer unlimited management powers over another entity. Detailed operational procedures remain in companion standards; their governance and escalation remain within this standard. The adopter shall identify applicable statutory, regulatory, contractual and scheme duties by jurisdiction, entity type, sector and activity. A voluntary standard cannot displace binding law or create powers for a regulator. Conflicts shall be referred for qualified advice and documented resolution. UK GDPR and EU GDPR require distinct scope analyses. NIS2 duties depend on applicable national implementation and entity/activity scope. DORA applies within its defined financial-sector and ICT arrangements. PCI DSS is not an EU statute. A reference to a legal instrument does not incorporate all its provisions as universal duties. This standard is not an executed agreement, appointment contract, liability allocation, arbitration agreement or universal governing-law instrument. Genuine contracts require identified parties, authority, consent and appropriate legal review. Issued by Global Converged Security Board. The adopting organisation is responsible for implementation; publication does not itself confer accreditation or a credential.