Author: lobath7

The G360 Policies, Standards & Governance Instruments (PSGI) Methodology

Introduction

The term PSGI stands for Policies, Standards & Governance Instruments. It is the name of G360’s structured methodology for organizing, governing, and maintaining an enterprise’s information security requirements and supporting documentation.

Information security governance requires more than a collection of Policies, Standards, and technical instructions. Effective governance materials must express enterprise expectations, define mandatory controls, make related guidance accessible, and clarify who is accountable for implementation. The G360 Policies, Standards & Governance Instruments (PSGI) Methodology connects these elements in a coherent hierarchy, supported by a visual reference Matrix, controlled document relationships, and a recurring governance process.

The methodology is original work developed through years of CISO and vCISO leadership. Its developer reports having implemented the approach at four companies, where it remains in use. Its contribution is not the invention of Policies or Standards, but the practical integration of their structure, relationships, accessibility, administration, and oversight.

The Five-Level Governance Hierarchy

The Information Security Governance Triangle represents five related levels: (1) Governance Model; (2) Policy; (3) Standard; (4) Governance Instruments; and (5) Procedure. As the hierarchy moves toward execution, documentation generally becomes more specific and operational. Each level has a different purpose, audience, and approval or ownership expectation.

Governance Model

The Governance Model establishes the enterprise’s information security leadership, decision-making authority, organizational responsibilities, accountability, and oversight arrangements. As the first level of the five-level PSGI governance hierarchy, it provides the management direction and authority under which the remaining governance documents are developed, approved, implemented, and maintained.

The Overarching Information Security Management System (ISMS)

The Information Security Management System (ISMS) is the overarching framework through which an enterprise directs, coordinates, monitors, and continually improves its information security activities. It encompasses governance, risk management, accountability, security requirements, operational controls, performance measurement, and management oversight across the enterprise and its constituent business Entities.

Within this broader management system, the PSGI Methodology provides the structured governance documentation framework through which enterprise security direction is translated into mandatory Policies and Standards, supporting Governance Instruments, and operational Procedures. PSGI establishes relationships among these materials, clarifies their applicability, and supports their controlled maintenance.

The ISMS extends beyond the PSGI documentation hierarchy. It encompasses the organizational responsibilities, resources, risk assessments, operational activities, monitoring, reporting, and continual improvement necessary to manage information security effectively. PSGI supports these activities but does not replace them.

The relationship is represented in the PSGI Matrix, where the continuous ISMS column extends across the Policy domains and their associated governance materials. This design emphasizes that individual security requirements and their supporting documents operate within a coordinated enterprise-wide information security management system rather than as independent collections of instructions.

Policy

Policies establish mandatory enterprise security direction and high-level expectations. They state what the organization requires without becoming detailed operational instructions. Each Policy is mandatory within its defined scope.

Standard

Standards translate applicable Policies into specific, mandatory requirements, control expectations, or measurable conditions. Every Standard is mandatory within its defined scope and derives its direction from one or more applicable Policies.

Governance Instruments

Governance Instruments are the family of supporting materials used to communicate, interpret, operationalize, document, or demonstrate security requirements. They may include official security statements; guidelines and good practices; methods and overviews; processes and centralized functions; high-level or supporting architectures; minimum contractual security wording; registers and report formats; and metrics or measurement definitions.

Some Governance Instruments establish binding requirements, while others provide guidance or reference information. An individual Instrument becomes mandatory only when formally designated as such under PSGI governance, within its defined scope of applicability.

Governance Instrument Classification and Entity Applicability

The PSGI methodology distinguishes three classifications of Governance Instruments: Mandatory, Customized, and Entity-Specific. These classifications describe the intended governance approach, while a separate, clearly visible MANDATORY indicator identifies whether an individual Instrument has been formally designated as required within its applicable scope.

Customized Instruments accommodate authorized adaptations to differing operational circumstances. Entity-Specific Instruments address additional or distinct requirements of particular business Entities, sectors, jurisdictions, or specialized operations. Examples include gaming and casinos, law enforcement, aviation, and maritime operations, including SOLAS-related obligations. Such requirements may supplement enterprise Standards; they do not automatically displace them.

An Entity-Specific or Customized Instrument is not necessarily optional. Each Instrument requires an explicit determination of applicability and, where relevant, mandatory status. Specific designations and approval criteria are established through PSGI governance rather than assumed from classification alone.

Procedure

Procedures describe the activities and work instructions used to implement applicable security requirements. They are numerous and may be specific to a department, business unit, or Entity. The responsible business or technology function ordinarily owns and maintains its Procedures; Information Security does not automatically become responsible for every operational Procedure. A Procedure may draw directly on applicable Policies or Standards, as well as Governance Instruments.

Hierarchical Requirements Traceability

Hierarchical Requirements Traceability is a central principle of PSGI: lower-level governance materials translate, elaborate upon, and support the requirements established above them. A Standard may implement several Policy expectations; a Governance Instrument may support multiple Standards; and a Procedure may rely on requirements from more than one level. There is no requirement for a separate document at every intervening level, and lower-level materials cannot silently contradict higher-level direction.

Every controlled PSGI document receives a unique, permanent document identifier, with version information managed separately. Except for the top-level Governance Model, each controlled document contains a standardized section identifying its applicable higher-level governing documents by their official reference numbers. Related supporting documents may be identified separately. These relationships are maintained in the PSGI Document Register, enabling reference in both directions through the hierarchy.

Operational Procedures may retain existing departmental reference conventions when they can be cross-referenced to the PSGI framework. Document-level traceability is required; more granular section- or requirement-level links can be added where regulatory, contractual, audit, or risk considerations justify them.

For example, a Technology Security Policy may establish enterprise direction, a Vulnerability Management Standard may define mandatory control expectations, a supporting Vulnerability Management Process may explain implementation, and IT Patching Procedures may direct operational execution. This is an illustration of the document relationships, not an assertion that specific approved document mappings already exist.

The PSGI Matrix: A Working Representation of the Triangle

The PSGI Matrix is the rectangular, practical counterpart to the conceptual Governance Triangle. Its leftmost ISMS column represents the overarching enterprise information security program across every Policy domain. The remaining columns organize Policies, Standards, Governance Instruments, and operational Procedures within that common management context. Originally envisioned as a desk “placemat” for engineers, the Matrix helps security practitioners locate applicable governance materials; the Triangle explains the hierarchy and increasing specificity of their requirements.

The Matrix remains intentionally visual and concise. It is supported by two distinct administrative records: the PSGI Document Register, which maintains controlled document identities, versions, owners, approvals, applicability, and hierarchical references; and the PSGI Exception Register, which records authorized deviations, risks, deadlines, reviews, and escalation history.

The current illustrative Matrix is an organizing and lookup aid; it should not be represented as already implementing every planned hyperlink, mandatory-status flag, document-control field, or requirement-by-requirement mapping. The supporting registers provide the appropriate place for this more detailed information.

Download PSGI Matrix (PNG)

Governance Across Business Entities

An enterprise-wide baseline of mandatory Policies and Standards provides common security direction, while PSGI accommodates the different obligations and operating conditions of particular business Entities. Entity-Specific Governance Instruments can address distinct regulatory or sector requirements; Customized Instruments allow governed adaptation where appropriate. A specialized Entity does not gain an automatic exemption from applicable enterprise requirements. The companion G360 Entity Management work addresses broader questions of parent–Entity accountability and governance across organizational boundaries.

Controlled Exceptions and Risk Committee Oversight

When an Entity needs to deviate from an applicable Governance Instrument, PSGI provides for a documented, time-limited exception. Entity management must endorse the request, and the Enterprise CISO or another designated central enterprise authority approves, rejects, or formally renews it after appropriate consideration of risk, applicability, obligations, and compensating controls. An internal exception cannot waive applicable legal or regulatory requirements, and an expired exception is not automatically renewed.

Enforcement is an explicit part of the process: any exception that misses its designated solution or remediation date, or its formal re-approval date, must be escalated to the Enterprise Risk Committee, regardless of risk rating or business Entity. Committee review and subsequent corrective actions are recorded in the Exception Register. Risk Committee escalation provides oversight and accountability; it does not replace central approval authority.

The PSGI Governance and Maintenance Process

A recurring five-stage Governance and Maintenance Process keeps the documentation current, approved, accessible, and accountable: preparation; scheduling and communication; presentation and approval or rejection; updating the central library; and status and progress reporting to leadership. The process encompasses document identification, hierarchical references, Entity applicability, designated owners, approval records, version control, and coordination of supporting registers.

Controlled documents have assigned owners and review dates. Material changes in business activities, regulatory obligations, technology, organizational structure, or risk conditions can trigger reviews outside the normal schedule. Document ownership is distinguished from approval authority, and the operational functions that perform the work remain responsible for their Procedures. Detailed review frequencies and individual document approval assignments are defined through implementation, not inferred from the Triangle alone.

Practical Value

The Governance Triangle provides a conceptual structure; the PSGI Matrix offers a usable reference; the Document Register establishes controlled traceability; the Exception Register supports managed deviations and enforcement; and the Governance and Maintenance Process sustains the framework over time. Together, these components help CISOs and governance leaders translate enterprise expectations into accessible security requirements while preserving accountability across diverse operating Entities.

The distinctive value of PSGI is the coordinated application of familiar governance elements as a single, practical method—not a rigid one-to-one document chain or a claim that Policies and Standards themselves are novel.

The G360 Policies, Standards & Governance Instruments (PSGI) Methodology

Introduction

Information security governance is more effective when an organization can translate enterprise security direction into clear requirements, practical supporting materials, and accountable operational activities. The G360 PSGI Implementation Guide explains how organizations can organize and maintain that connected set of governance materials.

The guide is designed for enterprises with multiple business Entities, including parent companies and subsidiaries with different business operations, jurisdictions, and obligations. It describes a repeatable method, not a claim that any illustrative corporate documents or approvals have already been adopted by a particular organization.

What the Guide Covers

The guide addresses the five-level PSGI hierarchy—Governance Model, Policy, Standard, Governance Instruments, and Procedure—and explains how the overarching Information Security Management System (ISMS) provides a common enterprise-wide context. Policies and Standards are mandatory within their defined scope, while individual Governance Instruments require a formal mandatory designation when they establish binding requirements.

It then explains how controlled PSGI documents receive permanent identifiers and reference their applicable higher-level governing documents. Those relationships are maintained in the PSGI Document Register, with document-level traceability as the baseline and more detailed mappings where justified.

The guide also covers Governance Instrument classifications (Mandatory, Customized, and Entity-Specific), applicability across business Entities, and the distinct roles of the visual PSGI Matrix, the Document Register, and the Exception Register.

Exceptions, Oversight, and Maintenance

A dedicated section explains documented, time-limited PSGI exceptions: Entity management endorsement, central enterprise decision authority, periodic review, and mandatory escalation of missed remediation or formal re-approval dates to the Enterprise Risk Committee. An internal exception cannot waive legal or regulatory obligations.

The guide also sets out the five-stage PSGI Governance and Maintenance Process: preparation; scheduling and communication; presentation and approval or rejection; updating the central library; and status and progress reporting. Document ownership and approval authority remain distinct, and operational functions retain ownership of their own Procedures.

What Adopting Organizations Must Decide

The guide intentionally leaves a number of enterprise-specific decisions open, including numbering conventions, detailed approval delegations, mandatory designations and Entity applicability, review intervals, templates, exception thresholds, escalation procedures, and actual document inventories and mappings.

Section 9 identifies these matters; they should not be mistaken for already approved universal rules.

Appendix A provides an illustrative standardized PSGI document-reference section that can be adapted after an organization defines its own controls and approval arrangements.

Download the Full Implementation Guide

The complete G360 PSGI Implementation Guide is available in two complementary formats:

• PDF Edition — For reading, sharing, printing, and preserving the document’s original formatting.
• Editable Microsoft Word Edition — For organizations that wish to adapt the methodology to their own governance structures, operational requirements, and business Entities.

Both editions contain the detailed implementation framework, governance responsibilities, document-control principles, exception-management procedures, and supporting reference materials.

Organizations are encouraged to adapt the guide to their specific circumstances while preserving the relationships, accountability, and governance principles underlying the PSGI Methodology.

Putting the Bricks and Mortar Together

G360 makes its methodology and supporting materials available so organizations can assemble much of their own governance foundation.

The further challenge is applying judgment to determine which requirements fit, how responsibilities connect, what to prioritize, and what must happen next.

These are the decisions that make the elements of an effective information security program work together.

We provide the bricks. We work with you on the mortar.

How Governance Documents Connect, Support, and Remain Accountable to Enterprise Security Requirements

Introduction

An effective information security governance program requires more than a collection of Policies, Standards, Governance Instruments, and Procedures. These materials must be connected so that organizational requirements can be understood, implemented, maintained, and traced to their governing authority.

The G360 Policies, Standards & Governance Instruments (PSGI) Methodology addresses this challenge through Hierarchical Requirements Traceability: a structured approach for identifying and maintaining relationships among controlled governance documents.

Within PSGI, lower-level governance materials translate, elaborate upon, and support requirements established at higher levels. A Standard may support multiple Policies, a Governance Instrument may implement several Standards, and an operational Procedure may reference requirements from multiple governing documents.

These relationships are not necessarily one-to-one, nor must every document pass through each intermediate level of the governance hierarchy.

The purpose of traceability is to establish clear connections between enterprise security direction and operational implementation while supporting document ownership, change management, oversight, and accountability.

The Five-Level Governance Hierarchy and Traceability

The G360 Policies, Standards & Governance Instruments (PSGI) Methodology organizes information security governance into five related levels:

1. Governance Model — Establishes enterprise information security authority, accountability, decision-making responsibilities, and oversight.
2. Policy — Establishes mandatory enterprise security direction and high-level requirements.
3. Standard — Defines specific mandatory security requirements and control expectations derived from applicable Policies.
4. Governance Instruments — Provide supporting materials, methods, guidance, processes, and other instruments necessary to communicate, interpret, or operationalize security requirements. Individual Instruments become mandatory only when formally designated as such within their defined scope.
5. Procedure — Provides operational instructions through which responsible business and technology functions implement applicable requirements.

These five levels operate within the overarching Information Security Management System (ISMS), which coordinates the enterprise’s information security program. The ISMS is not a sixth governance-document level.

Hierarchical Requirements Traceability establishes the relationships among these levels by identifying the higher-level governing documents from which each controlled document derives its requirements and authority.

A Standard may support requirements from several Policies. A Governance Instrument may relate to multiple Standards, and a Procedure may reference applicable Policies, Standards, and Governance Instruments.

Consequently, traceability does not require a separate document at every intervening level. Instead, each controlled document must identify its applicable governing references, enabling relationships to be followed upward through the hierarchy and supporting implementation and oversight.

Document Identification and Governing References

Each controlled PSGI governance document is assigned a unique, permanent document identifier. This identifier remains associated with the document throughout its lifecycle, while version information is maintained separately.

Permanent identifiers enable reliable referencing between governance documents, even as individual documents are reviewed, revised, and reapproved.

Except for the top-level Governance Model, each controlled PSGI document contains a standardized section identifying its applicable higher-level governing documents by their official reference numbers.

For example, a Vulnerability Management Standard may identify a Technology Security Policy as one of its governing documents. A supporting Vulnerability Management Process may subsequently reference that Standard, along with other applicable governing requirements.

These references establish the document’s position within the governance framework and allow reviewers to determine which higher-level requirements it supports.

Related supporting documents may be identified separately from governing documents, preserving the distinction between authoritative requirements and supplemental information.

Document-Level and Requirement-Level Traceability

The PSGI Methodology establishes document-level traceability as the baseline requirement. More detailed section-level or individual requirement-level relationships may be added when regulatory, contractual, audit, or risk considerations justify the additional granularity.

Operational Procedures may retain existing departmental identification conventions, provided they can be reliably cross-referenced to the PSGI governance framework.

The PSGI Document Register maintains document identities, versions, ownership, approvals, applicability, and hierarchical relationships, providing a central mechanism for maintaining and reviewing these connections.

An Illustrative Traceability Chain

The following example demonstrates how requirements can be traced from enterprise security direction through increasingly specific governance and operational documents.

Governance Level	Illustrative Document	Reference
Policy	Technology Security Policy	POL-004
Standard	Vulnerability Management Standard	STD-013
Governance Instrument	Vulnerability Management Process	GI-028
Procedure	IT Patching Procedure	IT-PRC-009

Important: These document titles and identifiers are illustrative examples. They do not represent actual approved corporate document assignments.

In this example, the Technology Security Policy establishes enterprise expectations for protecting technology resources.

The Vulnerability Management Standard translates relevant Policy requirements into specific, mandatory control expectations.

The Vulnerability Management Process supports implementation by describing how vulnerabilities are identified, evaluated, prioritized, and managed.

The IT Patching Procedure provides operational instructions for applying patches in accordance with applicable requirements.

The resulting relationships make it possible to trace an operational activity to its governing security requirements.

This example illustrates one possible chain. Actual PSGI relationships may be many-to-many, and an intervening document is not required at every level. A Procedure may reference multiple Standards, Policies, or Governance Instruments where applicable.

Many-to-Many Relationships and Change Impact Analysis

The PSGI Methodology recognizes that information security governance relationships are not necessarily linear or one-to-one.

A single Policy may establish requirements implemented through several Standards. Conversely, a Standard may address requirements established by multiple Policies.

Governance Instruments may support several Standards, while operational Procedures may implement requirements from multiple governing documents. These relationships create an interconnected structure in which documents can have several governing references and support multiple operational activities.

Change Impact Analysis

These relationships are especially important when a governance document is revised, replaced, or withdrawn.

For example, a change to a Technology Security Policy may require examination of several related Standards, Governance Instruments, and operational Procedures to determine whether their requirements or implementation instructions remain appropriate.

The PSGI Document Register provides the documented relationships needed to identify potentially affected materials and their responsible owners.

A structured change impact review may include:

• Identifying the governing document being changed.
• Locating documents that reference or depend upon it.
• Determining whether existing requirements remain consistent with the revised direction.
• Consulting affected document owners and business Entities.
• Identifying necessary revisions, approvals, and implementation activities.
• Updating document versions, governing references, and associated records.

This approach allows changes in enterprise security direction to be examined for downstream implications rather than treated as isolated document revisions.

Traceability does not require every governance document to reference every related document. Its purpose is to maintain reliable governing relationships that support accountability, consistency, change management, and oversight.

The PSGI Document Register and Traceability Maintenance

The PSGI Document Register serves as the central administrative record for controlled governance documents and their relationships within the information security governance hierarchy.

While the PSGI Matrix provides a visual reference for locating and understanding governance materials, the Document Register maintains the detailed information necessary to control those materials throughout their lifecycle.

For each controlled document, the Register maintains relevant information concerning:

• Document identification: Permanent document identifier, official title, and current version.
• Ownership: Designated document owner and responsible organizational function.
• Approval: Designated approval authority, approval status, and associated records.
• Entity applicability: The business Entities, functions, or operations to which the document applies.
• Governing references: Applicable higher-level governance documents identified by their permanent reference numbers.
• Mandatory status: Where applicable, the formal designation indicating whether an individual Governance Instrument establishes binding requirements.
• Maintenance: Review dates, revision status, and other document-control information.

The Register supports traceability by recording relationships between controlled documents. These relationships enable governance administrators and document owners to identify applicable governing requirements and determine which documents may be affected by changes elsewhere in the hierarchy.

Ongoing Traceability Maintenance

Traceability must be maintained as part of the recurring PSGI Governance and Maintenance Process.

When documents are introduced, revised, replaced, or withdrawn, their governing references and corresponding Register entries must be reviewed and updated as appropriate.

Document owners remain responsible for maintaining their assigned materials, while designated governance authorities oversee approvals and consistency with enterprise requirements.

The PSGI Document Register therefore supports more than document inventory. It provides an administrative foundation for maintaining the integrity, accountability, and continuing relevance of the enterprise’s information security governance documentation.

The Register is distinct from the PSGI Exception Register, which records authorized deviations, risk considerations, remediation deadlines, formal reviews, and required escalation activities.

Practical Value and Conclusion

Hierarchical Requirements Traceability provides a means of connecting enterprise information security direction with the governance documents and operational activities through which that direction is implemented.

By maintaining identifiable relationships among Policies, Standards, Governance Instruments, and Procedures, organizations can better understand how requirements are derived, where they apply, who is responsible for maintaining them, and which materials may require review when governing requirements change.

The approach provides value to several organizational audiences:

• Executive leadership and governance authorities gain greater visibility into how enterprise security expectations are translated into documented requirements and operational responsibilities.
• Information Security leadership can identify governance relationships, coordinate document maintenance, and evaluate the implications of proposed changes.
• Document owners and operational managers can identify applicable governing requirements and maintain consistency between their assigned documents and enterprise direction.
• Risk, compliance, and audit functions can use documented relationships to support reviews of governance coverage, accountability, and implementation.

Within the broader G360 Policies, Standards & Governance Instruments (PSGI) Methodology, hierarchical traceability complements the Governance Triangle, PSGI Matrix, Document Register, Exception Register, and recurring Governance and Maintenance Process.

Together, these components provide a coordinated approach to organizing, connecting, maintaining, and overseeing information security governance materials.

The objective is not to create an unnecessarily complex documentation system. It is to establish clear, reliable relationships that help organizations translate enterprise security expectations into accountable operational practice.

Lessons from the Field: Governance, Accountability, and the Balance Between Control and Autonomy

COMING SOON — A Practitioner’s Perspective on Effective Entity Management

This preview introduces a forthcoming paper exploring how corporate parents and their subsidiaries can work together more effectively. Drawing on firsthand experience managing information security across multinational organizations with parent-subsidiary relationships, the full paper will examine practical approaches, implementation challenges, lessons learned, and best practices for building an effective entity management environment.

---

Introduction: Why the Parent–Subsidiary Relationship Matters

A corporate organization can own many businesses and still struggle to manage them as a coherent enterprise. Acquisitions bring new technologies, established business practices, management cultures, regulatory obligations, and operating priorities. Although these businesses may share a common parent, they do not automatically share a common approach to governance, risk management, or accountability.

The challenge is not simply to establish policies and require subsidiaries to follow them. It is to develop an operating relationship in which the parent company can exercise appropriate oversight while allowing each subsidiary the flexibility needed to operate its business successfully.

Too much decentralization can leave the parent without adequate visibility into enterprise-wide risks, inconsistent practices, duplicated investments, and gaps in accountability. Excessive centralization can create a different set of problems: unnecessary bureaucracy, resistance from subsidiary management, and requirements that fail to account for legitimate local business or regulatory needs.

Effective entity management requires a deliberate balance between enterprise-wide control and subsidiary-level autonomy.

That balance must be supported by clear responsibilities, documented decision-making authority, consistent standards, structured communication, and meaningful performance measures.

My experience managing information security within a multinational organization provides a practical perspective on these challenges. The organization consisted of 19 subsidiaries operating in 13 countries, acquired over a seven-year period. Each subsidiary brought its own technology environment, processes, management practices, risk profile, and business priorities.

The work required more than establishing technical security controls. It required developing a framework through which the parent and its subsidiaries could establish common expectations, coordinate decisions, evaluate capabilities, and manage differences constructively.

These experiences form the foundation for the broader discussion presented in this forthcoming paper.

1. Define the Relationship Before Trying to Manage It

One of the fundamental requirements for effective entity management is clarity about the respective roles of the parent company and its subsidiaries.

The parent generally establishes enterprise strategy, defines group-wide priorities, oversees significant risks, establishes minimum requirements, and determines how performance and compliance will be evaluated.

Subsidiaries remain responsible for operating their businesses, serving customers, managing day-to-day activities, delivering financial results, and meeting applicable local obligations.

Some responsibilities necessarily cross organizational boundaries. Enterprise risk management, information security, regulatory reporting, shared services, and major investment decisions may require coordinated action by both levels of the organization.

The important question is not whether the parent or subsidiary should always make a particular decision. It is who has the authority to decide, who is responsible for implementation, who must be consulted, and who is accountable for the result.

Without these distinctions, corporate oversight can become inconsistent. Different subsidiaries may interpret the same requirement differently, while the parent may assume that a responsibility has been addressed when no entity has clearly accepted ownership.

A well-designed relationship makes decision rights explicit. It documents which matters are controlled centrally, which remain local, and which require joint decisions or formal escalation.

This clarity is particularly important following acquisitions, when existing practices and expectations may differ substantially from those of the acquiring organization.

2. Establish Common Governance Without Assuming Every Entity Is Identical

A multinational group needs a consistent governance framework, but consistency does not necessarily mean uniformity.

During my experience managing information security across the organization, one important initiative involved consolidating policies and standards over a two-year period. The objective was to establish a more coherent framework across entities with different operating environments and requirements.

A useful approach is to distinguish four categories of policies and standards:

1. Mandatory group-wide requirements. These establish common expectations that every applicable subsidiary must satisfy.
2. Group-wide requirements permitting local adaptation. These establish a common objective or minimum standard while allowing approved differences in implementation.
3. Parent-specific requirements. These apply to the parent company’s own operations and responsibilities rather than automatically applying to every subsidiary.
4. Subsidiary-specific requirements. These address particular business processes, technologies, operating conditions, or regulatory obligations that do not apply uniformly across the group.

This distinction provides a practical foundation for governance. It helps prevent two common mistakes: allowing subsidiaries to disregard legitimate enterprise-wide requirements and imposing unnecessary uniformity where differences are justified.

Exceptions must be handled through a documented process. Each exception should identify the requirement involved, the reason for the deviation, the associated risk, the person or authority accepting that risk, any compensating measures, and the date for review.

A policy is not effective simply because it has been published. Management must also determine whether the policy is understood, implemented, monitored, and producing the intended result.

The broader lesson extends beyond information security. Finance, legal, compliance, human resources, technology, and operations can all benefit from distinguishing enterprise-wide requirements from legitimate local variations.

3. Build Communication Into the Governance Structure

Formal policies establish expectations, but productive relationships require communication.

A parent company cannot manage a diverse group effectively if its only interaction with subsidiaries consists of issuing directives, collecting compliance reports, and escalating failures.

Subsidiary managers need opportunities to explain operational realities, identify implementation problems, propose alternatives, and share practices that may benefit other entities. The parent, in turn, needs a reliable way to communicate priorities, explain the reasoning behind requirements, and understand emerging risks.

One practical mechanism is an enterprise council or working group that includes representatives from the parent and its subsidiaries.

In my information security work, establishing an Information Security Council was one of the initial initiatives for improving coordination. Such a council can provide a recurring forum for discussing priorities, aligning expectations, sharing knowledge, and coordinating decisions that affect multiple entities.

For this type of structure to work, its purpose and authority must be clear. Participants should understand which matters the council can decide, which require executive approval, and which are advisory.

Regular group-wide meetings should be supplemented by individual discussions with subsidiaries where business circumstances or risks warrant more detailed attention.

Communication should also work in both directions. Subsidiaries must have a defined way to raise concerns and request decisions without relying exclusively on informal relationships or personal influence.

The goal is to develop shared responsibility rather than mere compliance with instructions. A subsidiary that understands the purpose of a requirement and has participated appropriately in its implementation is better positioned to support the broader enterprise objective.

4. Coordinate Resources, Technology, and Shared Capabilities

Acquisitions frequently create overlapping capabilities. Different subsidiaries may purchase similar products, maintain separate service arrangements, or operate tools that provide inconsistent levels of protection or oversight.

Without an enterprise-wide view, the parent may not know what resources exist, whether they are being used effectively, or where significant gaps remain.

An inventory of tools, services, personnel, and capabilities is an important starting point.

In the information security environment, evaluating existing tools and services can reveal duplicated investments, unused products, incomplete implementations, inconsistent capabilities, and opportunities to improve visibility across the group.

However, centralization should not be an automatic objective.

Some capabilities may be more effective when delivered centrally or through shared services. Others may need to remain local because of business requirements, regulatory obligations, operational dependencies, or the need for immediate local decision-making.

The appropriate question is whether a particular arrangement improves business performance, risk management, consistency, or cost effectiveness.

A sound evaluation considers the total cost of ownership, operational effectiveness, implementation requirements, service dependencies, and the consequences of reducing local capabilities.

Shared services should have defined responsibilities, service expectations, reporting mechanisms, and accountability. Otherwise, centralization can merely transfer an existing problem to a different organizational unit.

The objective is not to centralize everything. It is to make informed decisions about which capabilities should be shared, which should be controlled centrally, and which should remain within individual subsidiaries.

5. Make Accountability Measurable

Governance requires evidence that responsibilities are being fulfilled.

A parent company should be able to determine whether subsidiaries are meeting applicable requirements, whether identified risks are being addressed, and whether investments are producing their intended benefits.

This requires defined responsibilities, measurable objectives, consistent reporting, and an appropriate review cycle.

Useful measures may include policy implementation, unresolved findings, remediation progress, outstanding exceptions, significant risk exposures, and the effectiveness of shared services.

The measures should be relevant to the decisions management needs to make. Collecting large volumes of information is not a substitute for meaningful oversight.

It is also important to distinguish between documented compliance and actual effectiveness. A subsidiary may have adopted a policy without implementing the necessary procedures or controls. A report may indicate that an activity is complete without establishing that the underlying risk has been reduced.

The parent needs sufficient information to evaluate both implementation and results.

Accountability must exist at both levels. The parent is responsible for establishing a workable framework, providing appropriate direction, resolving enterprise-level issues, and making decisions within its authority. Subsidiary management is responsible for executing its obligations, reporting accurately, addressing deficiencies, and escalating matters that require broader attention.

When accountability is clear and supported by evidence, governance becomes a management tool rather than an administrative exercise.

6. Recognize the Challenges of Integration

Even a well-designed framework takes time to implement.

Subsidiaries differ in maturity, staffing, technology, management practices, and available resources. A requirement that is relatively easy for one entity may be difficult for another. Local managers may also perceive group-wide standards as unnecessary interference with established operations.

Acquisition history creates additional complexity. Each newly acquired business may introduce another set of systems, policies, service providers, and assumptions about who has authority to make decisions.

These differences cannot be resolved simply by publishing a common policy.

Management must assess the starting position of each entity, identify material gaps, establish priorities, and determine an appropriate implementation path. Where immediate uniformity is impractical, a documented plan can establish interim safeguards, responsibilities, milestones, and a target state.

The parent must also distinguish between legitimate differences and avoidable noncompliance. Flexibility should not become an excuse for leaving significant risks unmanaged, and central authority should not become an excuse for ignoring local realities.

This is where communication, documented exceptions, risk assessment, and measurable accountability become especially important.

Experience also matters. What works in theory may require adjustment when applied across multiple countries, business models, and organizational cultures. Effective entity management is therefore an ongoing discipline, not a one-time integration project.

7. A Practical Model for Parent–Subsidiary Relationship Development

The principles described above can be organized into seven stages. Together, they provide a starting point for organizations seeking to improve their entity management environment.

Stage 1 — Assess the organization. Understand each subsidiary’s business objectives, governance structure, operational maturity, risk exposure, regulatory obligations, and existing capabilities.

Stage 2 — Define governance and decision rights. Establish what the parent controls, what subsidiaries control, which decisions are shared, and how disagreements or unresolved issues are escalated.

Stage 3 — Establish common requirements. Define group-wide policies, minimum standards, reporting expectations, and the circumstances in which local adaptation is permitted.

Stage 4 — Build communication and collaboration. Establish councils, recurring meetings, escalation channels, and opportunities for subsidiaries to influence decisions that affect their operations.

Stage 5 — Coordinate capabilities and investment. Evaluate which tools, services, resources, and expertise should be centralized, shared, or retained locally.

Stage 6 — Measure implementation and accountability. Monitor compliance, risk exposure, remediation, exceptions, performance, and the effectiveness of investments.

Stage 7 — Review and improve the relationship. Use results, experience, and feedback to refine governance, address gaps, and adapt to changes in the organization.

These stages are intended to be iterative rather than strictly sequential. Changes in business strategy, acquisitions, regulatory obligations, and risk exposure may require the organization to revisit earlier decisions.

The model also provides a practical basis for assessing progress. Rather than asking only whether policies exist, management can evaluate whether decision rights are understood, communication is functioning, responsibilities are being met, and the relationship is delivering measurable value.

Conclusion: Governance Is a Relationship, Not Just a Set of Rules

Effective parent–subsidiary management requires more than ownership, organizational charts, policies, and periodic reports. It requires a clearly defined working relationship that connects enterprise objectives with the responsibilities and operating realities of individual entities.

The parent must establish appropriate direction, minimum requirements, risk oversight, and accountability. Subsidiaries must retain the ability to manage their businesses while fulfilling their obligations to the broader organization. Both levels must communicate, resolve differences, and work toward common objectives.

My experience managing information security across 19 subsidiaries in 13 countries reinforced the practical importance of this challenge. Establishing a council, consolidating policies and standards, and evaluating shared capabilities provided concrete ways to address the complexities of a diverse corporate environment.

These initiatives also illustrate a broader principle: the methods used to manage information security can inform the design of parent–subsidiary relationships across many other corporate functions.

The central management challenge is to achieve consistency without unnecessary uniformity, oversight without needless interference, and autonomy without sacrificing accountability.

That balance does not happen automatically. It must be designed, communicated, documented, measured, and continually improved.

---

Coming Soon: A More Detailed Practitioner’s Paper

This preview introduces the principles behind an effective parent–subsidiary management environment. The forthcoming paper will expand on the practical experience, governance mechanisms, implementation considerations, and lessons learned from working within a multinational organization of independently operating subsidiaries.

Future material will explore how to define decision rights, establish enterprise-wide standards, manage exceptions, coordinate shared capabilities, measure accountability, and develop a productive working relationship between corporate leadership and subsidiary management.

The objective is to move beyond general governance concepts and examine the practical questions that corporate leaders, entity managers, risk professionals, and operating executives must address when managing complex corporate groups.

More to come: Additional analysis, practical examples, and recommendations for developing an effective, sustainable parent–subsidiary operating model.

This is an introductory preview of a work in progress. The detailed paper will distinguish firsthand experience and observations from broader recommendations and supporting research.