The G360 Policies, Standards & Governance Instruments (PSGI) Methodology
Introduction
Information security governance is more effective when an organization can translate enterprise security direction into clear requirements, practical supporting materials, and accountable operational activities. The G360 PSGI Implementation Guide explains how organizations can organize and maintain that connected set of governance materials.
The guide is designed for enterprises with multiple business Entities, including parent companies and subsidiaries with different business operations, jurisdictions, and obligations. It describes a repeatable method, not a claim that any illustrative corporate documents or approvals have already been adopted by a particular organization.
What the Guide Covers
The guide addresses the five-level PSGI hierarchy—Governance Model, Policy, Standard, Governance Instruments, and Procedure—and explains how the overarching Information Security Management System (ISMS) provides a common enterprise-wide context. Policies and Standards are mandatory within their defined scope, while individual Governance Instruments require a formal mandatory designation when they establish binding requirements.
It then explains how controlled PSGI documents receive permanent identifiers and reference their applicable higher-level governing documents. Those relationships are maintained in the PSGI Document Register, with document-level traceability as the baseline and more detailed mappings where justified.
The guide also covers Governance Instrument classifications (Mandatory, Customized, and Entity-Specific), applicability across business Entities, and the distinct roles of the visual PSGI Matrix, the Document Register, and the Exception Register.
Exceptions, Oversight, and Maintenance
A dedicated section explains documented, time-limited PSGI exceptions: Entity management endorsement, central enterprise decision authority, periodic review, and mandatory escalation of missed remediation or formal re-approval dates to the Enterprise Risk Committee. An internal exception cannot waive legal or regulatory obligations.
The guide also sets out the five-stage PSGI Governance and Maintenance Process: preparation; scheduling and communication; presentation and approval or rejection; updating the central library; and status and progress reporting. Document ownership and approval authority remain distinct, and operational functions retain ownership of their own Procedures.
What Adopting Organizations Must Decide
The guide intentionally leaves a number of enterprise-specific decisions open, including numbering conventions, detailed approval delegations, mandatory designations and Entity applicability, review intervals, templates, exception thresholds, escalation procedures, and actual document inventories and mappings.
Section 9 identifies these matters; they should not be mistaken for already approved universal rules.
Appendix A provides an illustrative standardized PSGI document-reference section that can be adapted after an organization defines its own controls and approval arrangements.
Download the Full Implementation Guide
The complete G360 PSGI Implementation Guide is available in two complementary formats:
- PDF Edition — For reading, sharing, printing, and preserving the document’s original formatting.
- Editable Microsoft Word Edition — For organizations that wish to adapt the methodology to their own governance structures, operational requirements, and business Entities.
Both editions contain the detailed implementation framework, governance responsibilities, document-control principles, exception-management procedures, and supporting reference materials.
Organizations are encouraged to adapt the guide to their specific circumstances while preserving the relationships, accountability, and governance principles underlying the PSGI Methodology.
Putting the Bricks and Mortar Together
G360 makes its methodology and supporting materials available so organizations can assemble much of their own governance foundation.
The further challenge is applying judgment to determine which requirements fit, how responsibilities connect, what to prioritize, and what must happen next.
These are the decisions that make the elements of an effective information security program work together.
We provide the bricks. We work with you on the mortar.