Common Information Assurance Oversight
CIAO Standard v1.0 · Maintained by the CIAO Standard Secretariat
A Standard for implementing Standards.
Governance does not fail for lack of standards. It fails because standards do not speak to each other.
CIAO exists to make them speak. It is the Standard that sits above ISO/IEC 27001, SOC 2, NIST CSF, GDPR, POPIA, and the wider information assurance landscape — mapping their overlapping obligations into a single coherent control language, and translating compliance effort into audit-ready evidence across them simultaneously.
PURPOSE
CIAO is a framework-agnostic meta-standard for information assurance. It consolidates the control obligations of international frameworks into a unified taxonomy, enabling organisations to achieve multi-framework assurance without duplicated cost, duplicated effort, or dependency on in-house framework expertise.
Where each underlying framework defines what to comply with, CIAO defines how to comply across them — coherently, once, in a form an auditor can verify.
SCOPE
CIAO covers the full information assurance compliance surface across nine governance domains: Governance, Risk, Privacy, Cybersecurity, AI Governance, Business Continuity, Supply Chain Assurance, Digital Law, and Information Ethics.
CIAO is a structural and procedural standard. It does not replace the frameworks it normalises; it sits above them and reconciles them.
CIAO is not a certification body, a regulatory authority, or a substitute for legal counsel. It is the coordination layer that makes existing compliance obligations executable at scale.
ARCHITECTURE
CIAO organises its content across its nine governance domains and a six-tier inheritance model. Each tier inherits the content of every tier beneath it. Each domain is independently maintained and cross-referenced against the frameworks it maps.
Organisations begin at the tier that matches their present maturity and progress through the inheritance ladder as their governance posture develops.
TIERS
A CIAO tier exists for every organisation, from the smallest entity beginning its governance journey to the largest conglomerate operating across jurisdictions.
COMMONS — Open access to the CIAO meta-standard and foundational resources. No cost.
CORE — Three enterprise-grade policies, immediately deployable.
ESSENTIAL — Ten policies and a structured Information Management System.
PROFESSIONAL — Thirty policies, operational frameworks, multi-user access.
ENTERPRISE — The complete CIAO governance suite, unlimited users, dedicated secure environment.
CONGLOMERATE — Fully integrated compliance architecture, built around the organisation’s specific structure.
Every tier includes everything beneath it.
GOVERNANCE
CIAO is maintained by the CIAO Standard Secretariat under the terms of its published Governance Charter.
The Standard is overseen by the CIAO Oversight Board, which governs all normative content, and advised by an international Panel of Advisors drawn from practitioners, academics, and sector representatives.
All CIAO content is governed by the Charter and the Code of Practice, with multitier licensing terms publicly available.
ADOPTION
CIAO is delivered through a certified partner network. Each partner is accredited to implement CIAO within a defined geographic or sectoral territory, ensuring every deployment receives local expertise and ongoing service.
Organisations adopt CIAO by engaging a certified partner, selecting a tier, and progressively deploying that tier’s content within a dedicated environment supported by the partner.
REVIEW
The CIAO Standard is examined, peer-reviewed, and advanced through three structural arms that together form its intellectual framework.
The CIAO Conference is the annual convening of practitioners, scholars, regulators, and partners for structured peer exchange on the Standard’s methodology, mappings, and application. The inaugural edition is targeted for 2028.
The forthcoming CIAO Governance Journal will anchor the intellectual foundations of the Standard as an open-access peer-reviewed publication.
The Panel of Advisors provides standing specialist and sectoral consultation to the Oversight Board on emergent governance questions.
Together, these arms ensure the Standard remains rigorous, responsive, and accountable to the communities it serves.