CIAO Standard v1.0

A Standard for Implementing Standards — A Governance Meta-Standard for Multi-Framework Assurance

1. Architectural Position Statement

CIAO — Common Information Assurance Oversight — is a governance meta-standard that sits architecturally above conventional security and compliance frameworks. It does not replace ISO 27001, NIST CSF, SOC 2, GDPR, POPIA, or any other established standard. It governs them collectively, providing the coordination layer that has been absent from the compliance ecosystem.

The compliance landscape is fragmented by design. Every framework defines its own control catalogue, documentation requirements, audit process, and terminology. Organisations operating under multiple simultaneous obligations — which is now the rule, not the exception — are forced to maintain parallel compliance systems: duplicated policies, duplicated evidence, duplicated audit preparation. The cost is not only financial. It is governance capacity, leadership attention, and institutional resilience.

CIAO addresses the architectural gap that no existing framework has formally occupied: multi-framework assurance orchestration. Through a formal control equivalence taxonomy, a unified governance model, and a structured implementation architecture, CIAO enables organisations to achieve audit-readiness across multiple frameworks simultaneously, from a single governance posture.

Formal Definition: CIAO is a framework-agnostic governance meta-standard that maps, coordinates and operationalises the overlapping requirements of established international compliance frameworks — enabling organisations to achieve multi-framework assurance through a single, structured governance posture.

2. The CIAO 5-Layer Governance Architecture

CIAO operates at the apex of a five-layer governance architecture. Layers 1 through 3 are occupied by existing frameworks and control systems. CIAO formally governs Layers 4 and 5 — the coordination and oversight layers that have historically been left unoccupied.

This architecture resolves the structural problem that existing frameworks have not addressed: each operates within its own layer, defining controls, risk processes, or governance principles for a single regime. None provides the coordination mechanism required when multiple regimes must be satisfied simultaneously. CIAO occupies the apex — Layer 5 — as the assurance oversight model that governs the entire stack.

What CIAO Is Not

CIAO is not a control framework — it does not define technical security controls or replace ISO 27001 Annex A, NIST CSF control families, or SOC 2 Trust Services Criteria. CIAO is not a risk framework — it does not define risk assessment methodology or risk treatment processes. CIAO is not a compliance checklist — compliance checklists are point-in-time artefacts; CIAO provides the governance infrastructure for continuous, multi-framework assurance.

What CIAO Is

CIAO is a governance meta-standard. It defines: the architectural relationship between compliance frameworks; a unified control equivalence taxonomy (the CIAO GOV series); the assurance lifecycle for multi-framework audit readiness; and the governance infrastructure through which organisations operationalise compliance across regimes without duplication.

3. CIAO Control Equivalence Taxonomy — GOV Seed Table

The Control Equivalence Taxonomy is the architectural heart of CIAO. Each CIAO GOV control represents a unified governance obligation that spans multiple frameworks simultaneously. This public seed table (GOV-001 to GOV-015) is licensed under CC BY-SA 4.0 as part of the CIAO Commons tier. The full GOV taxonomy (GOV-001 to GOV-050+), sector-specific overlays, and cross-framework evidence mapping workbooks are available in CIAO Essentials and above.

All references are to current published versions: ISO/IEC 27001:2022, NIST CSF 2.0, South African POPIA (Act 4 of 2013), AICPA SOC 2 Trust Services Criteria (2022), and EU GDPR 2016/679.

4. CIAO Positioned Against Existing Governance Approaches

CIAO occupies a structural category that existing governance approaches do not fill. The table below clarifies CIAO’s unique niche within the broader governance landscape.

5. Open Principles

CIAO’s foundation is built on disruptive Open Principles that challenge spiralling bureaucracy and compliance costs:

• Private Data: Collect only what is essential; segregate to reduce risk.
• Open Standards: Use open, interoperable standards wherever possible.
• Shared Accountability: Compliance is a shared organisational responsibility, not solely an IT function.
• Proportionality: Governance effort should be proportionate to organisational scale and risk profile.
• Continuous Assurance: Compliance is a continuous posture, not a point-in-time event.
• Framework Neutrality: No single framework is privileged; CIAO coordinates all equally.

6. The CIAO Assurance Lifecycle

The CIAO assurance lifecycle defines the process through which organisations move from framework fragmentation to unified multi-framework audit readiness:

7. Membership Tier Content Architecture

For the canonical detailed treatment of tier content depth and the artefact ladder (Manual → Operating Policy Framework → Enterprise Control Framework → Sub-Policies → Processes → Procedures → Implementation artefacts), see Standard Architecture & Tier Content Depth.

The CIAO membership model is designed as a governance maturity ladder. Each tier provides everything included in all tiers below it. The Commons tier is permanently free and publicly accessible — it constitutes the open standard layer of CIAO.

Licensed under Creative Commons CC BY-SA 4.0. CIAO Standard v1.0 — March 2026 — www.c-ao.com

Enterprise and Conglomerate implementation content will be added here — procedures, templates, and work instructions aligned to this document.