The CIAO Core Policies

CIAO Core · Level 1

Grants the nine Domain Manuals and a first set of policies for each domain.

Domain Manuals

Domain Manuals — forthcoming.

Featured Sub-Policies

A taster of the Essential layer — the two most standards-dense sub-policies in each domain:

CAO-100 Governance

• CAO-140 Corporate Governance Policy
• CAO-190 Security Governance Policy

CAO-200 Audit and Risk

• CAO-210 Risk Management Policy
• CAO-220 Audit and Assurance Policy

CAO-300 Privacy

• CAO-360 Records Management Policy
• CAO-370 Data Protection and Privacy Policy

CAO-400 Cybersecurity

• CAO-430 Cryptography and Data Encryption Policy
• CAO-490 People and Physical Security Policy

CAO-500 Emerging Technology Governance

• CAO-510 AI Policy
• CAO-520 AI Risk Management Policy

CAO-600 Technology Platform Operations

• CAO-620 Business Continuity and Disaster Recovery Policy
• CAO-630 Configuration, Change and Asset Management Policy

CAO-700 Supply Chain

• CAO-710 Vendor and Third-Party Risk Management Policy

CAO-800 Regulatory Compliance

• CAO-810 Legal and Regulatory Compliance Policy

CAO-900 Sustainability

• CAO-910 Code of Ethics and Conduct