{ "vercy": "1.0-draft", "publication": { "status": "research-draft", "adjudicationStatus": "unreviewed", "publishableCanonical": false, "generatedAt": "2026-09-12T08:36:45Z", "providers": [ "Codex" ], "breadth": "recalled by Codex without web access - no source was read", "missingProviders": [], "pass": 2, "cost": { "grok": { "seconds": 24.2, "error": "Reading additional input from stdin...\nOpenAI Codex v0.153.4\n--------\nworkdir: R:\\02_PROJECTS\\02_Meta_Models_Platforms\\Ver.cy\\current\\thing-registry-backlog\nmodel: gpt-6-astra\nprovider: openai\napproval: never\nsandbox: read-only\nreasoning effort: none\nreasoning summaries: none\nsession id: 01a094c1-efec-7d53-9a87-4a7cf0ef8504\n--------\nuser\nDescribe what is already known about one registered thing. Answer as JSON only, no prose around it.\n\nThing: chief information security officer\nSense to describe: (none recorded)\nDomain code: SOC.PER\nAlso known as: (none)\n\n\nContext for this batch of 1001 things", "usd": 0.0, "recall": true }, "codex": { "seconds": 72.7, "error": "Reading additional input from stdin...\nOpenAI Codex v0.153.4\n--------\nworkdir: R:\\02_PROJECTS\\02_Meta_Models_Platforms\\Ver.cy\\current\\thing-registry-backlog\nmodel: gpt-6-astra\nprovider: openai\napproval: never\nsandbox: read-only\nreasoning effort: none\nreasoning summaries: none\nsession id: 01a094c1-efe0-7743-8cce-2f7762d08680\n--------\nuser\nYou are drafting a Vercy meta-model for one registered thing. Answer as JSON only, no prose around it.\n\nThing: chief information security officer\nRegistry id: vr.tr.chief-information-security-officer\nPlane / domain: SOC / SOC.PER\nRegistry definition: (none rec" } }, "enrichment": { "pass": 3, "engine": "claude", "producedAt": "2026-10-06T12:00:00Z", "ingestedAt": "2026-10-06T08:40:00+00:00", "fields": [ "agent_conduct", "ethics", "failure_modes_and_hazards", "owners", "standards_and_regulation" ] }, "gate": { "passed": true, "version": "1.0", "at": "2026-10-07T10:10:25+00:00", "evidence": [ "completeness 1.00", "sense: Wikidata description", "2 live sources", "review by codex: pass" ] } }, "metaModel": { "id": "THING-Q1072318", "registryId": "vr.tr.chief-information-security-officer", "name": "chief information security officer", "version": "0.1.0-research.1", "entryKind": "thing", "family": "Thing Registry", "domain": [ "SOC.PER" ], "status": "research-draft" }, "canonicalUrl": "https://ver.cy/models/thing/q1072318/", "model": { "registry_id": "vr.tr.chief-information-security-officer", "name": "chief information security officer", "purpose": "Enable an AI agent to recognise a chief information security officer role, assess its mandate and capacity, and determine which security decisions it may make or escalate.", "definition": "A chief information security officer (CISO) is a senior organizational role responsible for leading the information security program and advising leadership on risks to information and supporting systems, with authority and accountability determined by the organization's governance arrangements.", "scope_statement": "This model owns the organisational role of chief information security officer, including its information security remit, delegated authority, accountabilities, competence requirements and appointment conditions, while linking separately to the role holder and organisation.", "in_scope": [ "Information security leadership mandate and organisational coverage", "Reporting relationships, independence and access to governing bodies", "Security decision rights, delegated authority and escalation duties", "Role-specific competence, qualification and appointment requirements", "Accountability for security strategy, programme oversight and assurance", "Employment or service arrangement, continuity and role coverage" ], "out_of_scope": [ "The identity, biography and personal credentials of an individual role holder", "The organisation's complete governance and operating model", "Detailed security controls, technical configurations and asset inventories", "Individual incident records and operational response procedures", "Privacy officer, chief information officer and physical security roles except at their interfaces", "Job advertisements, recruitment campaigns and employment contracts as documents" ], "distinguishing_features": [ "An organisational mandate assigns leadership accountability for information security across an explicitly bounded enterprise, business unit or equivalent remit; the title alone is insufficient.", "The role directs or oversees a security programme rather than being defined solely by administering tools, investigating incidents or testing systems.", "Information security accountability is distinguishable from responsibility for delivering and operating information technology, even where one person holds both roles.", "Security advice, executive reporting and escalation responsibilities can be identified separately from authority to accept business risk.", "The role remains identifiable through vacancies, outsourcing or changes of incumbent because its mandate belongs to the organisation." ], "characteristics": [ { "name": "Mandated security remit", "kind": "category", "unit_or_values": "Information security domains and expressly included or excluded responsibilities", "why_it_matters": "Determines whether cyber, information handling, product security, operational technology or other concerns fall within the role." }, { "name": "Organisational coverage", "kind": "relation", "unit_or_values": "Covered legal entities, business units, locations and shared services", "why_it_matters": "Prevents authority over one part of a group from being assumed to extend to all of it." }, { "name": "Reporting and escalation relationships", "kind": "relation", "unit_or_values": "Administrative manager, functional oversight body and direct escalation recipients", "why_it_matters": "Shows how security concerns reach accountable decision-makers." }, { "name": "Delegated decision rights", "kind": "category", "unit_or_values": "Advise, propose, approve, require remediation, restrict operations or escalate, qualified by decision type and conditions", "why_it_matters": "Supports action within the actual mandate rather than authority inferred from seniority." }, { "name": "Appointment arrangement", "kind": "category", "unit_or_values": "Employee, interim, contracted, fractional or other documented arrangement", "why_it_matters": "Clarifies availability, organisational integration and service boundaries." }, { "name": "Role coverage state", "kind": "state", "unit_or_values": "Filled, acting, vacant, shared or coverage unverified", "why_it_matters": "Identifies gaps in security leadership and the need for delegated cover." }, { "name": "Competence and eligibility requirements", "kind": "relation", "unit_or_values": "Required capabilities, experience, credentials and any verified jurisdictional or sector-specific conditions", "why_it_matters": "Allows suitability assessment without treating a commonly requested certificate as a universal requirement." }, { "name": "Security leadership capacity", "kind": "measurement", "unit_or_values": "Allocated hours per week or full-time equivalent, with period and organisational scope", "why_it_matters": "Makes limited or shared coverage visible when assessing whether the remit can be discharged." } ], "affordances": [ "Determine whether a proposed security decision falls within the CISO's remit and delegated authority.", "Route security risks, exceptions and unresolved disagreements to the appropriate accountable decision-maker.", "Compare required capabilities with linked evidence about a candidate or incumbent.", "Assess whether reporting access, staffing and availability support the assigned security responsibilities.", "Identify conflicts, uncovered responsibilities and dependencies on neighbouring executive roles.", "Prepare an appointment, delegation or handover checklist grounded in the organisation's mandate." ], "agent_conduct": { "may": [ "Explain the role, duties and typical reporting lines of a chief information security officer.", "Prepare security reports and risk summaries for a CISO in an organization that authorizes it.", "Escalate security incidents to the CISO under the organization's procedures." ], "must_not": [ "Impersonate a CISO to request credentials, payments or access.", "Hide security incidents or vulnerabilities from the CISO or regulators.", "Use security monitoring powers to spy on staff beyond the lawful, stated purpose.", "Change security controls under a CISO's name without their actual approval." ], "requires_human": [ "Declaring a breach, notifying regulators or informing affected people.", "Accepting a significant security risk on the organization's behalf." ] }, "ethics": { "considerations": [ "CISOs balance protecting people's data against business pressure; concealment harms those whose data leaks.", "Workplace monitoring must respect staff privacy." ], "affected_parties": [ "Customers whose data is held", "Employees", "The organization and its partners" ] }, "owners": { "steward": "The organization that appoints the CISO; the board holds ultimate accountability.", "master_systems": [] }, "failure_modes_and_hazards": [ "A CISO without real authority or budget leaves risks unmanaged.", "Impersonation of senior officers is common in fraud and phishing." ], "standards_and_regulation": [ "ISO/IEC 27001, Information security management systems - Requirements, ISO and IEC.", "Cybersecurity Framework, National Institute of Standards and Technology (United States)." ], "what_it_is_for": [ "This role is found in organizations that need senior leadership for information security governance and risk management.", "Its mandate is used to assign responsibility for security strategy, incident oversight and escalation to organizational leadership." ], "facets_not_applicable": { "recognition": "Professional authority cannot be identified from appearance and must be established through organizational records and delegated responsibilities." } }, "sources": [ { "id": "wikidata", "title": "Wikidata item Q1072318: chief information security officer", "url": "https://www.wikidata.org/wiki/Q1072318", "url_status": "live", "what_it_supports": "identity and sense of the item", "checked_by": "wikidata-api" }, { "id": "wikipedia-en", "title": "Wikipedia: Chief information security officer", "url": "https://en.wikipedia.org/wiki/Chief_information_security_officer", "url_status": "live", "what_it_supports": "general description of the item", "checked_by": "wikidata-api sitelink" } ], "structure": { "bundles": [ { "id": "security-mandate", "name": "Security mandate", "description": "Defines why the CISO role exists and the information security territory it covers.", "rationale": "CISO titles can conceal materially different responsibilities; recognition requires a bounded mandate.", "layers": [ { "id": "role-recognition", "name": "Role recognition", "description": "Establishes the role independently of its title and incumbent.", "findings": [ { "id": "information-security-leadership-accountability", "name": "Information security leadership accountability", "description": "Record the mandate assigning leadership of information security and the evidence establishing that assignment.", "questions": [ { "text": "What leadership accountability makes this a CISO role rather than a security specialist or an IT executive role?", "kind": "definition", "id": "information-security-leadership-accountability-q01" }, { "text": "Which approved charter, appointment instrument or equivalent evidence establishes this mandate?", "kind": "provenance", "id": "information-security-leadership-accountability-q02" } ] } ] }, { "id": "remit-boundaries", "name": "Remit boundaries", "description": "Locates security coverage across entities, information environments and adjacent responsibilities.", "findings": [ { "id": "covered-entities-and-security-domains", "name": "Covered entities and security domains", "description": "Record the covered organisational units and security domains, with explicit exclusions and shared responsibilities.", "questions": [ { "text": "Which legal entities, business units and information environments fall within this CISO's remit?", "kind": "boundary", "id": "covered-entities-and-security-domains-q01" }, { "text": "Where do responsibilities meet those of privacy, IT operations, product security, operational technology and physical security leaders?", "kind": "boundary", "id": "covered-entities-and-security-domains-q02" } ] } ] } ] }, { "id": "authority-and-governance", "name": "Authority and governance", "description": "Defines how the CISO exercises authority, reports concerns and handles disputed security decisions.", "rationale": "Responsibility for security does not by itself establish budget control, operational vetoes or authority to accept risk.", "layers": [ { "id": "reporting-and-independence", "name": "Reporting and independence", "description": "Captures management relationships and routes for raising security concerns.", "findings": [ { "id": "oversight-access-and-conflicts", "name": "Oversight access and conflicts", "description": "Record administrative and functional reporting, governing-body access and arrangements for conflicts involving the reporting chain.", "questions": [ { "text": "To whom does the CISO report administratively and functionally, and what direct access to governing bodies is documented?", "kind": "provenance", "id": "oversight-access-and-conflicts-q01" }, { "text": "How may the CISO escalate a material concern when the normal reporting manager owns the disputed decision?", "kind": "action", "id": "oversight-access-and-conflicts-q02" } ] } ] }, { "id": "security-decision-rights", "name": "Security decision rights", "description": "Separates advice, approval, intervention and risk ownership.", "findings": [ { "id": "delegations-and-risk-acceptance", "name": "Delegations and risk acceptance", "description": "Record authority by decision type, including limits, conditions and the party accountable for accepting residual risk.", "questions": [ { "text": "Which policies, exceptions, expenditures or service restrictions may the CISO approve, and under what delegation?", "kind": "action", "id": "delegations-and-risk-acceptance-q01" }, { "text": "Which residual risks may the CISO accept, if any, and which require a business owner or governing body?", "kind": "boundary", "id": "delegations-and-risk-acceptance-q02" } ] } ] } ] }, { "id": "security-programme-accountability", "name": "Security programme accountability", "description": "Describes the security outcomes and oversight work assigned to the role.", "rationale": "The model must distinguish accountable leadership from the operational tasks performed by security teams and suppliers.", "layers": [ { "id": "strategy-and-resourcing", "name": "Strategy and resourcing", "description": "Connects the security remit to priorities, programme plans and available resources.", "findings": [ { "id": "programme-direction-and-capacity", "name": "Programme direction and capacity", "description": "Record responsibility for security strategy, prioritisation and resource proposals, together with constraints on delivery.", "questions": [ { "text": "Which security outcomes and programme commitments is the CISO accountable for directing or overseeing?", "kind": "definition", "id": "programme-direction-and-capacity-q01" }, { "text": "What budget, staffing and leadership time are available for the remit, and which resource decisions belong elsewhere?", "kind": "measurement", "id": "programme-direction-and-capacity-q02" } ] } ] }, { "id": "assurance-and-crisis-leadership", "name": "Assurance and crisis leadership", "description": "Defines oversight of security effectiveness and the executive interface during incidents.", "findings": [ { "id": "assurance-reporting", "name": "Assurance reporting", "description": "Record the evidence and reporting obligations used to communicate security exposure, control effectiveness and unresolved weaknesses.", "questions": [ { "text": "Which indicators and assurance evidence must the CISO review, and at what reporting cadence?", "kind": "measurement", "id": "assurance-reporting-q01" }, { "text": "How are unresolved findings, overdue remediation and uncertainty communicated to accountable leaders?", "kind": "action", "id": "assurance-reporting-q02" } ] }, { "id": "incident-leadership-interface", "name": "Incident leadership interface", "description": "Record the CISO's incident responsibilities without assuming the role commands every response or approves every notification.", "questions": [ { "text": "During a serious security incident, does the CISO command the response, advise the crisis team or perform another defined function?", "kind": "boundary", "id": "incident-leadership-interface-q01" }, { "text": "Who authorises containment, restoration, external communications and any required notifications?", "kind": "action", "id": "incident-leadership-interface-q02" } ] } ] } ] }, { "id": "competence-and-eligibility", "name": "Competence and eligibility", "description": "Captures capabilities and appointment conditions appropriate to the specific CISO remit.", "rationale": "Suitability depends on organisational needs and applicable conditions, while credentials belong to separately identified people.", "layers": [ { "id": "leadership-and-security-capabilities", "name": "Leadership and security capabilities", "description": "Defines the capabilities needed to discharge the assigned security leadership responsibilities.", "findings": [ { "id": "required-capability-profile", "name": "Required capability profile", "description": "Record expectations for security judgement, risk communication, programme leadership and relevant technical or sector understanding.", "questions": [ { "text": "Which security, executive communication and organisational leadership capabilities does this remit require?", "kind": "definition", "id": "required-capability-profile-q01" }, { "text": "What evidence and assessment criteria establish that a linked candidate or incumbent meets each requirement?", "kind": "measurement", "id": "required-capability-profile-q02" } ] } ] }, { "id": "appointment-conditions", "name": "Appointment conditions", "description": "Separates verified external conditions from employer preferences and occupational classifications.", "findings": [ { "id": "qualifications-and-applicable-requirements", "name": "Qualifications and applicable requirements", "description": "Record credentials, experience and any applicable licensing, approval or fitness requirements with their source, scope and effective date.", "questions": [ { "text": "Which qualifications are organisational preferences, and which are mandatory under a verified rule applicable to this appointment?", "kind": "boundary", "id": "qualifications-and-applicable-requirements-q01" }, { "text": "What authoritative source establishes each mandatory condition and any applicable ISCO, SOC or ESCO classification?", "kind": "provenance", "id": "qualifications-and-applicable-requirements-q02" } ] } ] } ] }, { "id": "appointment-and-continuity", "name": "Appointment and continuity", "description": "Connects the persistent role to its current staffing arrangement and continuity provisions.", "rationale": "A CISO mandate can remain in force while incumbents, providers and availability change.", "layers": [ { "id": "role-holder-arrangement", "name": "Role holder arrangement", "description": "Records how a person or service arrangement supplies the CISO function.", "findings": [ { "id": "appointment-and-availability", "name": "Appointment and availability", "description": "Link the role to its incumbent and any service provider, recording appointment scope, term, availability and concurrent roles.", "questions": [ { "text": "Who currently holds the role, under which appointment or service arrangement, and for what term?", "kind": "provenance", "id": "appointment-and-availability-q01" }, { "text": "What routine and emergency availability is committed, including limits arising from shared or fractional coverage?", "kind": "measurement", "id": "appointment-and-availability-q02" } ] } ] }, { "id": "delegation-and-handover", "name": "Delegation and handover", "description": "Defines how security leadership continues during absence, vacancy or transition.", "findings": [ { "id": "continuity-of-security-authority", "name": "Continuity of security authority", "description": "Record acting coverage, delegated powers and handover obligations for outstanding security decisions and commitments.", "questions": [ { "text": "Who exercises each essential CISO responsibility during absence or vacancy, and what delegation makes that valid?", "kind": "action", "id": "continuity-of-security-authority-q01" }, { "text": "Which unresolved risks, exceptions, incidents and programme obligations must be transferred when the role holder changes?", "kind": "action", "id": "continuity-of-security-authority-q02" } ] } ] } ] }, { "id": "evidence-and-external-alignment", "name": "Evidence and external alignment", "description": "What the world already says about this thing, gathered so the model can be checked against it.", "rationale": "A model that cannot be lined up against existing standards, identifiers and practice cannot be adopted by anyone who already uses them.", "layers": [ { "id": "reported-evidence", "name": "Reported evidence", "description": "Findings from the breadth pass, kept separate from the structural claims.", "findings": [ { "id": "evidence-confidence-notes", "name": "Check these first", "description": "Recalled without web access and unsourced; every item is a lead to verify.", "evidence": [ "This is recalled knowledge, not a researched account; no sources were consulted.", "Verify occupational classification against the specific duties and national classification system.", "Check sector-specific legal obligations, reporting relationships and delegated authority before attributing responsibilities to a particular CISO." ], "questions": [ { "id": "evidence-confidence-notes-q01", "text": "Which of these check these first hold for the sense of chief information security officer this model covers, and on what evidence?", "kind": "provenance" } ] }, { "id": "evidence-kinds", "name": "Kinds and varieties", "description": "Recalled without web access and unsourced; every item is a lead to verify.", "evidence": [ "Enterprise or group CISO", "Business-unit or divisional CISO", "Regional CISO", "Fractional or virtual CISO", "Interim CISO" ], "questions": [ { "id": "evidence-kinds-q01", "text": "Which of these kinds and varieties hold for the sense of chief information security officer this model covers, and on what evidence?", "kind": "provenance" } ] }, { "id": "evidence-identifiers", "name": "Identifiers and schemes", "description": "Recalled without web access and unsourced; every item is a lead to verify.", "evidence": [ { "scheme": "ISCO-08, International Labour Organization", "value_or_pattern": "1330", "note": "Information and communications technology service managers is a possible broad classification; assignment depends on actual duties and is not specific to CISOs." } ], "questions": [ { "id": "evidence-identifiers-q01", "text": "Which of these identifiers and schemes hold for the sense of chief information security officer this model covers, and on what evidence?", "kind": "provenance" } ] }, { "id": "evidence-standards-and-regulation", "name": "Standards and regulation", "description": "Recalled without web access and unsourced; every item is a lead to verify.", "evidence": [ "ISO/IEC 27001, issued by ISO and IEC: requirements for an information security management system; it does not universally require the CISO title.", "ISO/IEC 27002, issued by ISO and IEC: guidance on information security controls.", "Cybersecurity Framework, issued by the US National Institute of Standards and Technology: a framework for managing cybersecurity risk." ], "questions": [ { "id": "evidence-standards-and-regulation-q01", "text": "Which of these standards and regulation hold for the sense of chief information security officer this model covers, and on what evidence?", "kind": "provenance" } ] }, { "id": "evidence-real-world-use", "name": "Real-world use", "description": "Recalled without web access and unsourced; every item is a lead to verify.", "evidence": [ "Define security strategy, policies, priorities and investment proposals.", "Communicate information security risks and program performance to executives and governing bodies.", "Coordinate security incident preparedness, response and recovery with operational teams.", "Oversee security assurance, third-party security risk and security awareness programs.", "Advise business and technology leaders on security requirements and risk treatment." ], "questions": [ { "id": "evidence-real-world-use-q01", "text": "Which of these real-world use hold for the sense of chief information security officer this model covers, and on what evidence?", "kind": "provenance" } ] }, { "id": "evidence-failure-modes-and-hazards", "name": "Failure modes and hazards", "description": "Recalled without web access and unsourced; every item is a lead to verify.", "evidence": [ "Accountability exceeds the role's authority, budget or access to leadership.", "Reporting arrangements suppress independent communication of security risks.", "Compliance activity substitutes for evaluation of actual security effectiveness.", "Unclear responsibility boundaries delay incident decisions and risk escalation.", "Security requirements poorly matched to operations encourage workarounds." ], "questions": [ { "id": "evidence-failure-modes-and-hazards-q01", "text": "Which of these failure modes and hazards hold for the sense of chief information security officer this model covers, and on what evidence?", "kind": "provenance" } ] }, { "id": "evidence-regional-variation", "name": "Regional variation", "description": "Recalled without web access and unsourced; every item is a lead to verify.", "evidence": [ "Use of the CISO title and expectations for seniority vary across countries, sectors and organization sizes.", "Legal requirements for security leadership, reporting and accountability depend on jurisdiction and regulated sector; the title alone does not establish statutory duties.", "Professional certifications may be employer preferences or requirements, but should not be treated as a universal occupational licence." ], "questions": [ { "id": "evidence-regional-variation-q01", "text": "Which of these regional variation hold for the sense of chief information security officer this model covers, and on what evidence?", "kind": "provenance" } ] }, { "id": "evidence-neighbours", "name": "Neighbouring kinds and how to tell them apart", "description": "Recalled without web access and unsourced; every item is a lead to verify.", "evidence": [ { "name": "Chief information officer", "difference": "Leads the broader information technology function; a CISO concentrates on information security and its associated risks." }, { "name": "Chief security officer", "difference": "May oversee physical, personnel and corporate security as well as information security; scope must be checked because titles sometimes overlap." }, { "name": "Information security manager", "difference": "Usually manages a security program or operational function within a defined remit; a CISO typically provides senior organizational security leadership." }, { "name": "Data protection officer", "difference": "Focuses on personal-data protection responsibilities and applicable privacy obligations rather than the full information security remit." }, { "name": "CISO role holder", "difference": "The role holder is a person appointed to perform the role; the role persists when its holder changes." } ], "questions": [ { "id": "evidence-neighbours-q01", "text": "Which of these neighbouring kinds and how to tell them apart hold for the sense of chief information security officer this model covers, and on what evidence?", "kind": "provenance" } ] } ] } ] } ] }, "openQuestions": [ "Does an existing Vercy world model already cover this role, requiring a registry link instead of a separate publication?", "What authoritative occupational classifications map to chief information security officer, and how do mappings vary with actual duties and classification version?", "Which jurisdictions or sectors impose appointment, qualification, independence or reporting requirements specifically applicable to this role?", "What minimum documented accountability distinguishes a CISO appointment from a senior security manager using the title?", "How should group, subsidiary and outsourced CISO arrangements allocate overlapping accountability and resolve conflicting instructions?" ], "statistics": { "bundles": 6, "layers": 11, "findings": 19, "questions": 30 } }