Govern · Foundational tier · Office of the CISO

GV-01Information security program is Board-approved

A Board-approved security program exists, is reviewed at least once a year, and names a CISO independent of IT.

Status

Evidence indicates

All 3 items support it and are fresh.

Exposure

High

3 evidence items from 1 sources

CCSA · Govern

Established

Not blocking this domain's next tier.

Evidence chain

Every item is read-only, dated, hashed and re-runnable. This is what an examiner can test.

ev-gv01-1

Board Risk Oversight Committee approved the FY2026 security program

Uploaded Document · document · collected 17 days ago (Sep 28, 2026 · 13:02 UTC) · limit 365 days

Supports

ev-gv01-2

CISO reports to the Board Risk Oversight Committee, not to IT

Uploaded Document · document · collected 3 months ago (Jul 28, 2026 · 11:02 UTC) · limit 365 days

Supports

ev-gv01-3

Board-approved Information Security Policy v4.2, parsed into 10 testable statements

Uploaded Document · document · collected 3 months ago (Jul 15, 2026 · 23:02 UTC) · limit 365 days

Supports