Converged Security Framework - Converged Security Risk Management and Assessment Standard

Converged Security Risk Management and Assessment Standard. Board-approved standard, v2.0. Not a peer-reviewed Journal article. The purpose is to establish accountable and evidenced risk decisions across cybersecurity, physical security and operational technology security, including hybrid, systemic and cascading exposures, through scoped objectives and demonstrable evidence. The adopter shall document entities, services, facilities, systems, data, personnel, third parties and security domains within scope, material interfaces and the justification for exclusions. An absent OT estate shall be explained rather than invented. Dependencies outside direct control shall still be assessed, with controls limited by applicable law, actual authority and agreements. Joint ventures and suppliers shall not be deemed wholly controlled merely because they interface with organisational systems. Risk sharing, assessment rights, information exchange and incident cooperation shall be documented through lawful arrangements. No unlimited right to audit another organisation is created by this standard. The adopter shall identify binding legal, regulatory, contractual and scheme duties by entity, jurisdiction, sector and activity. UK GDPR and EU GDPR, NIS2 national implementation, DORA, phased CRA/AI Act provisions, eIDAS, PCI DSS and voluntary ISO/NIST references shall be distinguished. An aggregate compliance score does not authorise non-compliance with binding law. A voluntary standard cannot waive law, give an unidentified regulator powers or constitute an executed contract. Issued by Global Converged Security Board. The adopting organisation is responsible for implementation; publication does not itself confer accreditation or a credential.