Govern a programme

Which situation looks like yours?

43 governance and 38 compliance documents; 1 roadmap, 5 charters, 6 plans.

Nobody adopts a governance library front to back. Pick the situation that looks like yours; each one stages a few next actions, grounded in documents you can adapt, and lands on pages of this library.

Note

Situation

Starting from nothing

No documented programme yet: perhaps a first security hire, a first board question, or a first customer questionnaire. Enter smallest-first, not everything at once.

1. Name the seats first. The minimum viable governance structure guideline defines three tiers of governance structure; pick yours before adopting a single control document.
2. Adopt the minimum viable set. The quickstart template defines the smallest coherent document set a new programme stands up first.
3. Plan the build-out. The startup roadmap template stages a core baseline plus modules keyed to what you actually do.
4. Choose an adoption mode. The adopter guide covers forking the repository, adopting the corpus only, or adopting the governance pack only.
5. Then stand up the core. Open the governance domain, 43 documents on one page, and adopt from there.

Situation

Running, but undocumented

Controls exist in practice: backups run, access gets reviewed, incidents get handled. Little is written down, so little of it is evidenced for an assessor yet. The work is baselining, not building.

1. Scope what applies. Work through the applicability decision tree and the adopter guide to bound what your organization actually needs.
2. Map practice to the reference set. Use the adopter portal to find the documents most relevant to your role, and All Documents to see every corpus document on one page; comparing them with what you run informally shows your gaps.
3. Score where you stand. The maturity self-assessment template turns the baseline into a current-state picture you can put in front of leadership.
4. Close gaps in obligation order. The compliance alignment matrix shows, for each framework it maps, which documents support its requirements; for a framework outside its columns, the reverse framework-control crosswalk names, for each framework in its scope, which documents address the control areas it covers.

Situation

Governing a group of entities

Subsidiaries, shared services, mixed jurisdictions, and the standing temptation to fork the programme per entity. The aim is one coherent model, tailored at entity level.

1. Choose a topology first. The multi-entity adopter guide sets out three adoption topologies for groups, with the trade-offs of each.
2. Map roles per entity. The minimum viable governance structure guideline supplies the seat names to map onto each entity's real structure.
3. Layer jurisdictions instead of forking. Keep the core documents shared, and per entity layer on what applies from the annex overlays, 66 in the corpus, including those for specific jurisdictions.

Situation

Answering to a specific obligation

An audit, a regulator, or a certification target with a date on it. Work backwards from the obligation, not forwards from whatever is easiest to adopt.

1. Follow the compliance path. Meet an obligation walks from your framework or law, through the mappings, to the supporting documents and the evidence an audit will ask for.
2. Cite current editions. The canonical citations register records the published version of each standard and regulation the library cites.

Lands

Where the path lands

The work rests on 3 document types: a roadmap stages it, a charter establishes the authority to do it, and a plan coordinates the events it must survive. The rows below are the areas and document types that run a programme, and the concern page that asks where the programme stands; the count beside an area or a type is its corpus documents, and every count is generated from the library at build time.