Hierarchical Cybersecurity Governance Framework (HCGF)

The ComplianceForge Reference Model is commonly referred to as the Hierarchical Cybersecurity Governance Framework™ (HCGF). This reference model is designed to encourage clear communication by clearly defining cybersecurity and privacy documentation components and how those are linked. This comprehensive view identifies the primary documentation components that are necessary to demonstrate evidence of due diligence and due care. The HCGF addresses the inter-connectivity of policies, control objectives, standards, guidelines, controls, risks, procedures & metrics.

The Secure Controls Framework (SCF) fits into this model by providing the necessary cybersecurity and privacy controls an organization needs to implement to stay both secure and compliant. ComplianceForge has simplified the concept of the hierarchical nature of cybersecurity and privacy documentation in the following diagram to demonstrate the unique nature of these components, as well as the dependencies that exist:

Key Takeaways - Hierarchical Cybersecurity Governance Framework

The HCGF is a top-down governance model where everything traces from external/internal influencers → policies → control objectives → standards → controls → procedures → metrics.
Cybersecurity documentation has 6 core components: policies, control objectives, standards, controls, procedures/control activities, and guidelines.
Every component maps to controls - controls are the central nexus linking standards, procedures, risks, threats, and metrics together.
Documentation provides evidence of due diligence (policies & standards) and due care (procedures & metrics) to withstand external scrutiny.
The Secure Controls Framework (SCF) fits into this model by providing the cybersecurity and privacy controls an organization needs to stay secure, compliant, and resilient.

Top-Down Process Flow

Hierarchical Cybersecurity Documentation Structure

The ComplianceForge Reference Model is entirely based on industry-recognized "best practices" for structuring cybersecurity and data protection documentation according to terminology definitions from NIST, ISO, ISACA and AICPA. This approach is designed to encourage clear communication by clearly defining cybersecurity and privacy documentation components and how those are linked. This comprehensive view identifies the primary documentation components that are necessary to demonstrate evidence of due diligence and due care. It addresses the inter-connectivity of policies, control objectives, standards, guidelines, controls, risks, procedures & metrics. ComplianceForge simplified the concept of the hierarchical nature of cybersecurity and privacy documentation that visualizes the unique nature of these components, as well as the dependencies that exist.

Our Hierarchical Cybersecurity Governance Framework (HCGF)) demonstrates the linkages from policies all the way through metrics, based on definitions from NIST, ISO, ISACA and AICPA (see page 6 of the HCGF for details):

Hierarchical Cybersecurity Governance Framework example

Influencers (Laws, Regulations, Contracts, etc.)

The External & Internal influencers that establish what is considered necessary based on Minimum Compliance Requirements (MCR) and Discretionary Security Requirements (DSR).

Policies

High-level statements of management intent from an organization's executive leadership that are designed to influence decisions and guide the organization to achieve the desired outcomes.

Control Objectives

Targets or desired conditions to be met. These are statements describing what is to be achieved as a result of the organization implementing a Control.

Standards

Mandatory requirements in regard to processes, actions, and configurations that are designed to satisfy Controls & Control Objectives.

Guidelines

Recommended practices that are based on industry-recognized secure practices. Guidelines help augment Standards when discretion is permissible.

Controls

Technical, administrative or physical safeguards. Controls are the nexus used to manage risks through preventing, detecting or lessening the ability of a particular threat from negatively impacting business processes.

Procedures

Documented set of steps necessary to perform a specific task or process in conformance with an applicable standard.

Risks

A situation where someone or something valued is exposed to danger, harm or loss (noun) or to expose someone or something valued to danger, harm or loss (verb).

Threats

A person or thing likely to cause damage or danger (noun) or to indicate impending damage or danger (verb).

Metrics

A "point in time" view of specific, discrete measurements, unlike trending and analytics that are derived by comparing a baseline of two or more measurements taken over a period of time. Analytics are generated from the analysis of metrics.

The Chain Of Traceability

This top-down chain creates an unbroken line of traceability: every procedure traces to a control, every control traces to a standard, every standard traces to a control objective, and every control objective traces to a policy, which itself traces back to an external or internal influencer.

Pyramid ComplianceForge Cybersecurity Data Privacy NIST CSF ISO 27001 NIST 800-53

Quick Reference

Policy vs Standard vs Procedure

This comparison helps clarify the critical differences between the three most commonly confused documentation types:

Consideration

Policy

Standard

Procedure

Definition

High-level statement of management intent designed to influence decisions and guide desired outcomes

Mandatory requirements regarding processes, actions, and configurations that provide granular criteria

Documented set of steps to perform a specific task in conformance with an applicable standard

Intent

Mitigate risks including statutory, regulatory, and contractual obligations

Ensure systems, applications, and processes include appropriate protections

Defined as part of processes to operationalize standards

Issued By

Executive Leadership (CEO or Board of Directors)

Cybersecurity Department (CISO or GRC Director)

Team or Department Subject Matter Experts (SMEs)

Scope

Organization-Wide

Organization-Wide (unless specified)

Technology and/or Process-Specific

Stability

Static (rarely changes)

Static (changes due to new laws, regulations, or practices)

Dynamic (changes due to new technologies, processes, and/or personnel)

Review Cycle

Annually (or as needed)

Annually (or as new requirements emerge)

When technologies, processes, and/or personnel change

Common Questions

Frequently-Asked Questions

Here are answers to common questions about the HCGF:

What is the Hierarchical Cybersecurity Governance Framework (HCGF)?

The Hierarchical Cybersecurity Governance Framework (HCGF) is the ComplianceForge model for how cybersecurity and privacy documentation components fit together. We designed it as a top-down governance model in which requirements flow from external and internal influencers to policies, control objectives, standards, controls, procedures, and metrics. The HCGF is based on terminology and practices from NIST, ISO, ISACA, and AICPA, and it identifies the documentation you need to demonstrate due diligence and due care.

What are the components of a cybersecurity governance framework?

In the HCGF, a cybersecurity governance framework has ten components: influencers, policies, control objectives, standards, guidelines, controls, procedures, risks, threats, and metrics. Influencers are the laws, regulations, contracts, and internal drivers that create requirements. Policies, control objectives, standards, and guidelines define expectations, while controls and procedures put those expectations into practice. Risks, threats, and metrics then show where controls are weak and how well they are performing.

How does traceability work in a cybersecurity documentation hierarchy?

Traceability means every document in the hierarchy links back to the requirement that justifies it. In the HCGF, every procedure traces to a control, every control traces to a standard, every standard traces to a control objective, and every control objective traces to a policy. Each policy traces back to an external or internal influencer, such as a law, regulation, or contract. This unbroken chain lets you show an auditor why a task is performed and which obligation it satisfies.

Why are controls at the center of the HCGF?

Controls are at the center of the HCGF because they are the point where most other documentation components connect. Standards define how controls must be implemented, procedures describe how controls are performed, and metrics measure how well they operate. Risks exist when a control is missing or deficient, and threats affect a control's ability to exist or operate properly. Organizing documentation around controls makes it easier to assess compliance, risk, and performance together.

How does the HCGF relate to the Secure Controls Framework?

The HCGF describes how documentation is structured, and the Secure Controls Framework (SCF) supplies the cybersecurity and privacy controls that sit at the center of that structure. The SCF is a free metaframework with more than 1,500 controls mapped to over 200 laws, regulations, and frameworks. At ComplianceForge, we build many of our products to align with the SCF, so their policies, standards, and procedures follow the same hierarchy the HCGF describes.