Workforce, conduct and the operating model
Do the people running the controls have the mandate to run them?
Controls are run by people: screened, trained, empowered people, or not. The exposure is an operating model where responsibility is assigned to roles that lack the authority, the headcount, or the reporting line to act on it.
Note
Adopting a page here decides nothing for you. The leadership pages linked here are explanatory and advisory; they establish no requirement and prove nothing about your organization. Every claim in them resolves to the governing reference documents in the corpus, and it is those documents that govern.
Leadership
The leadership pages
Pages from the executive layer mapped to this concern, generated from the narrative registry. They explain and advise; the documents below govern.
Documents
The governing documents
The evidence shelf: the corpus documents the pages above resolve to, joined to the library's registries at build time. These are the documents that govern, and the evidence to ask for starts here.
- Acceptable Use Policypolicy, Security
- Human Capital and Ethical Conduct Frameworkframework, Governance
- Insider Risk Programme Frameworkframework, Security
- Personnel Security Screening Standardstandard, Security
- Security Awareness and Training Standardstandard, Security
- IT Onboarding and Offboarding Procedureprocedure, Security
- Security Disciplinary Process Procedureprocedure, Security
- Whistleblower and Incident Reporting Procedureprocedure, Governance
- Ethical AI Use Guidelineguideline, AI
- Minimum Viable Governance Structure Guidelineguideline, Governance
- Role Authority Registerregister, Governance
Frameworks
Frameworks touched
The external frameworks the shelf above maps, from the corpus registry. The documents' framework spellings are normalized against the crosswalk's committed alias maps: every spelling that names a crosswalk instrument, whole or by a clause, appears once as the instrument's short label and links its instrument page; a cited text that names no instrument is shown as plain text.
- BASC
- CAN/DGSI 101:2025
- Canada CCCS Baseline Cyber Security Controls for Small and Medium Organizations V1.2
- CERT Insider Threat Center
- CIS Controls v8.1
- COBIT
- Commission Delegated Regulation (EU) 2025/301 (23 October 2024)
- Council of Europe Recommendation CM/Rec(2015)5 (adopted 1 April 2015)
- Council of Europe Recommendation CM/Rec(2015)5 (processing of personal data in the context of employment)
- CSA AICM
- CSA CCM
- CTPAT
- Data (Use and Access) Act 2025 (as enacted)
- DORA
- EU AI Act
- EU Whistleblowing Directive (2019/1937)
- GDPR
- IIA Three Lines Model 2020
- ILO Code of Practice on the Protection of Workers' Personal Data (1997)
- ISO 37000:2021
- ISO 37001:2025
- ISO 37301:2021
- ISO/IEC 27001
- ISO/IEC 27002
- ISO/IEC 27035-1:2023
- ISO/IEC 27701
- ISO/IEC 42001
- ISO/IEC TR 24027:2021
- NIST AI RMF
- NIST SP 1270
- NIST SP 800-53
- NITTF
- OECD AI Principles
- OECD G20 Principles of Corporate Governance
- PIP
- Quebec Law 25
- Regulation (EU) 2026/1744 (8 July 2026)
- S.I. 2026/1015 (made 10 September 2026)
- UK NCSC Cyber Essentials v3.3
- UNESCO Recommendation on the Ethics of AI (2021)
- US DoD CMMC Assessment Guide Level 2 v2.13
- VDA ISA 6.0.3 (TISAX, automotive sector)
Go deeper