The G360 Policies, Standards & Governance Instruments (PSGI) Methodology
Introduction
The term PSGI stands for Policies, Standards & Governance Instruments. It is the name of G360’s structured methodology for organizing, governing, and maintaining an enterprise’s information security requirements and supporting documentation.
Information security governance requires more than a collection of Policies, Standards, and technical instructions. Effective governance materials must express enterprise expectations, define mandatory controls, make related guidance accessible, and clarify who is accountable for implementation. The G360 Policies, Standards & Governance Instruments (PSGI) Methodology connects these elements in a coherent hierarchy, supported by a visual reference Matrix, controlled document relationships, and a recurring governance process.
The methodology is original work developed through years of CISO and vCISO leadership. Its developer reports having implemented the approach at four companies, where it remains in use. Its contribution is not the invention of Policies or Standards, but the practical integration of their structure, relationships, accessibility, administration, and oversight.
The Five-Level Governance Hierarchy
The Information Security Governance Triangle represents five related levels: (1) Governance Model; (2) Policy; (3) Standard; (4) Governance Instruments; and (5) Procedure. As the hierarchy moves toward execution, documentation generally becomes more specific and operational. Each level has a different purpose, audience, and approval or ownership expectation.
Governance Model
The Governance Model establishes the enterprise’s information security leadership, decision-making authority, organizational responsibilities, accountability, and oversight arrangements. As the first level of the five-level PSGI governance hierarchy, it provides the management direction and authority under which the remaining governance documents are developed, approved, implemented, and maintained.
The Overarching Information Security Management System (ISMS)
The Information Security Management System (ISMS) is the overarching framework through which an enterprise directs, coordinates, monitors, and continually improves its information security activities. It encompasses governance, risk management, accountability, security requirements, operational controls, performance measurement, and management oversight across the enterprise and its constituent business Entities.
Within this broader management system, the PSGI Methodology provides the structured governance documentation framework through which enterprise security direction is translated into mandatory Policies and Standards, supporting Governance Instruments, and operational Procedures. PSGI establishes relationships among these materials, clarifies their applicability, and supports their controlled maintenance.
The ISMS extends beyond the PSGI documentation hierarchy. It encompasses the organizational responsibilities, resources, risk assessments, operational activities, monitoring, reporting, and continual improvement necessary to manage information security effectively. PSGI supports these activities but does not replace them.
The relationship is represented in the PSGI Matrix, where the continuous ISMS column extends across the Policy domains and their associated governance materials. This design emphasizes that individual security requirements and their supporting documents operate within a coordinated enterprise-wide information security management system rather than as independent collections of instructions.
Policy
Policies establish mandatory enterprise security direction and high-level expectations. They state what the organization requires without becoming detailed operational instructions. Each Policy is mandatory within its defined scope.
Standard
Standards translate applicable Policies into specific, mandatory requirements, control expectations, or measurable conditions. Every Standard is mandatory within its defined scope and derives its direction from one or more applicable Policies.
Governance Instruments
Governance Instruments are the family of supporting materials used to communicate, interpret, operationalize, document, or demonstrate security requirements. They may include official security statements; guidelines and good practices; methods and overviews; processes and centralized functions; high-level or supporting architectures; minimum contractual security wording; registers and report formats; and metrics or measurement definitions.
Some Governance Instruments establish binding requirements, while others provide guidance or reference information. An individual Instrument becomes mandatory only when formally designated as such under PSGI governance, within its defined scope of applicability.
Governance Instrument Classification and Entity Applicability
The PSGI methodology distinguishes three classifications of Governance Instruments: Mandatory, Customized, and Entity-Specific. These classifications describe the intended governance approach, while a separate, clearly visible MANDATORY indicator identifies whether an individual Instrument has been formally designated as required within its applicable scope.
Customized Instruments accommodate authorized adaptations to differing operational circumstances. Entity-Specific Instruments address additional or distinct requirements of particular business Entities, sectors, jurisdictions, or specialized operations. Examples include gaming and casinos, law enforcement, aviation, and maritime operations, including SOLAS-related obligations. Such requirements may supplement enterprise Standards; they do not automatically displace them.
An Entity-Specific or Customized Instrument is not necessarily optional. Each Instrument requires an explicit determination of applicability and, where relevant, mandatory status. Specific designations and approval criteria are established through PSGI governance rather than assumed from classification alone.
Procedure
Procedures describe the activities and work instructions used to implement applicable security requirements. They are numerous and may be specific to a department, business unit, or Entity. The responsible business or technology function ordinarily owns and maintains its Procedures; Information Security does not automatically become responsible for every operational Procedure. A Procedure may draw directly on applicable Policies or Standards, as well as Governance Instruments.
Hierarchical Requirements Traceability
Hierarchical Requirements Traceability is a central principle of PSGI: lower-level governance materials translate, elaborate upon, and support the requirements established above them. A Standard may implement several Policy expectations; a Governance Instrument may support multiple Standards; and a Procedure may rely on requirements from more than one level. There is no requirement for a separate document at every intervening level, and lower-level materials cannot silently contradict higher-level direction.
Every controlled PSGI document receives a unique, permanent document identifier, with version information managed separately. Except for the top-level Governance Model, each controlled document contains a standardized section identifying its applicable higher-level governing documents by their official reference numbers. Related supporting documents may be identified separately. These relationships are maintained in the PSGI Document Register, enabling reference in both directions through the hierarchy.
Operational Procedures may retain existing departmental reference conventions when they can be cross-referenced to the PSGI framework. Document-level traceability is required; more granular section- or requirement-level links can be added where regulatory, contractual, audit, or risk considerations justify them.
For example, a Technology Security Policy may establish enterprise direction, a Vulnerability Management Standard may define mandatory control expectations, a supporting Vulnerability Management Process may explain implementation, and IT Patching Procedures may direct operational execution. This is an illustration of the document relationships, not an assertion that specific approved document mappings already exist.
The PSGI Matrix: A Working Representation of the Triangle
The PSGI Matrix is the rectangular, practical counterpart to the conceptual Governance Triangle. Its leftmost ISMS column represents the overarching enterprise information security program across every Policy domain. The remaining columns organize Policies, Standards, Governance Instruments, and operational Procedures within that common management context. Originally envisioned as a desk “placemat” for engineers, the Matrix helps security practitioners locate applicable governance materials; the Triangle explains the hierarchy and increasing specificity of their requirements.
The Matrix remains intentionally visual and concise. It is supported by two distinct administrative records: the PSGI Document Register, which maintains controlled document identities, versions, owners, approvals, applicability, and hierarchical references; and the PSGI Exception Register, which records authorized deviations, risks, deadlines, reviews, and escalation history.
The current illustrative Matrix is an organizing and lookup aid; it should not be represented as already implementing every planned hyperlink, mandatory-status flag, document-control field, or requirement-by-requirement mapping. The supporting registers provide the appropriate place for this more detailed information.
Governance Across Business Entities
An enterprise-wide baseline of mandatory Policies and Standards provides common security direction, while PSGI accommodates the different obligations and operating conditions of particular business Entities. Entity-Specific Governance Instruments can address distinct regulatory or sector requirements; Customized Instruments allow governed adaptation where appropriate. A specialized Entity does not gain an automatic exemption from applicable enterprise requirements. The companion G360 Entity Management work addresses broader questions of parent–Entity accountability and governance across organizational boundaries.
Controlled Exceptions and Risk Committee Oversight
When an Entity needs to deviate from an applicable Governance Instrument, PSGI provides for a documented, time-limited exception. Entity management must endorse the request, and the Enterprise CISO or another designated central enterprise authority approves, rejects, or formally renews it after appropriate consideration of risk, applicability, obligations, and compensating controls. An internal exception cannot waive applicable legal or regulatory requirements, and an expired exception is not automatically renewed.
Enforcement is an explicit part of the process: any exception that misses its designated solution or remediation date, or its formal re-approval date, must be escalated to the Enterprise Risk Committee, regardless of risk rating or business Entity. Committee review and subsequent corrective actions are recorded in the Exception Register. Risk Committee escalation provides oversight and accountability; it does not replace central approval authority.
The PSGI Governance and Maintenance Process
A recurring five-stage Governance and Maintenance Process keeps the documentation current, approved, accessible, and accountable: preparation; scheduling and communication; presentation and approval or rejection; updating the central library; and status and progress reporting to leadership. The process encompasses document identification, hierarchical references, Entity applicability, designated owners, approval records, version control, and coordination of supporting registers.
Controlled documents have assigned owners and review dates. Material changes in business activities, regulatory obligations, technology, organizational structure, or risk conditions can trigger reviews outside the normal schedule. Document ownership is distinguished from approval authority, and the operational functions that perform the work remain responsible for their Procedures. Detailed review frequencies and individual document approval assignments are defined through implementation, not inferred from the Triangle alone.
Practical Value
The Governance Triangle provides a conceptual structure; the PSGI Matrix offers a usable reference; the Document Register establishes controlled traceability; the Exception Register supports managed deviations and enforcement; and the Governance and Maintenance Process sustains the framework over time. Together, these components help CISOs and governance leaders translate enterprise expectations into accessible security requirements while preserving accountability across diverse operating Entities.
The distinctive value of PSGI is the coordinated application of familiar governance elements as a single, practical method—not a rigid one-to-one document chain or a claim that Policies and Standards themselves are novel.