ANNUAL SECURITY AND GOVERNANCE CALENDAR

Program Cadence · Control Reviews · Audit Readiness · Exercises · Board Reporting

Table of Contents

1. Purpose and Scope
2. Calendar Rules
3. Standing Cadence Summary
4. Annual Calendar by Quarter
5. Monthly Operating Rhythm
6. Quarterly Operating Rhythm
7. Annual Operating Rhythm
8. Event-Driven Triggers
9. Calendar Maintenance
10. Document Control

1. Purpose and Scope

CERG contains review cycles, reporting cycles, test cadences, evidence refreshes, access reviews, tabletop exercises, audits, board reporting, DR tests, policy reviews, vendor reviews, and maturity assessments across many documents. This calendar consolidates those recurring obligations into one operating instrument.

It applies to all CERG-owned governance, risk, engineering, audit, evidence, and reporting activities. It does not replace the detail in each governing standard or procedure. It gives the CISO, Governance Pillar Leader, Risk Pillar Leader, Engineering Pillar Leader, and Evidence Librarian a single look-ahead view of what must happen, when, and who owns it.

A Program That Has No Calendar Has No Operating System

Policies say what must be true. Procedures say how work happens. The calendar says when the program proves it. Without a calendar, every review becomes a surprise, every audit becomes a scramble, and every control owner becomes a heroic exception handler.

2. Calendar Rules

1. The calendar is maintained by the Governance Pillar Leader.
2. Each activity has exactly one accountable role, using canonical roles from CERG-GOV-RAC-001.
3. The more specific source document controls when a cadence conflict exists.
4. Evidence-producing activities create or refresh evidence under CERG-PRC-AUD-001.
5. Missed calendar activities are tracked as program findings or risk-register entries.
6. Activities may be consolidated for small teams, but the role accountability does not disappear.
7. Regulated-scope activities are not moved without approval from the appropriate accountable role.

3. Standing Cadence Summary

4. Annual Calendar by Quarter

Q1: Reset, Baseline, and Plan

Q2: Evidence, Testing, and Assurance

Q3: Resilience, Maturity, and Regulatory Readiness

Q4: Closeout, Certification, and Next-Year Planning

5. Monthly Operating Rhythm

The monthly operating review uses a standard agenda:

1. material risk changes;
2. open Critical and High residual risks;
3. exception aging and upcoming expirations;
4. exposure and remediation SLA posture;
5. audit findings and evidence blockers;
6. vendor risk escalations;
7. project intake and threat modeling throughput;
8. metrics outside threshold;
9. decisions needed from the CISO or oversight forum;
10. open actions from the prior meeting.

The output is a monthly action tracker and a metrics snapshot. The action tracker is not optional. If a meeting produces decisions but no action record, the program has no memory.

6. Quarterly Operating Rhythm

The quarterly rhythm produces CISO or oversight reporting using CERG-TMPL-MTR-001. At minimum, the quarterly package includes:

• posture summary and trend;
• material risk changes;
• open High and Critical risks;
• exceptions opened, closed, expired, or renewed;
• control and audit findings;
• program maturity movement;
• vendor and supply-chain risk movement;
• incident and resilience summary;
• decisions required from leadership.

7. Annual Operating Rhythm

The annual rhythm resets the program. It includes:

• artifact review and catalog reconciliation;
• maturity self-assessment;
• control baseline review;
• annual assurance plan;
• annual tabletop and recovery exercises;
• annual review of regulated-scope requirements;
• budget, staffing, and program planning input;
• board / executive annual summary.

Annual work should not wait until Q4. Q4 is for closeout and next-year planning, not for discovering that the year’s required evidence was never collected.

8. Event-Driven Triggers

Calendar activities also occur when triggered by events.

9. Calendar Maintenance

The Governance Pillar Leader maintains this calendar. The Evidence Librarian maintains evidence that required activities occurred. The Risk Register Owner tracks missed or materially delayed activities when they create residual risk.

Calendar maintenance includes:

• annual confirmation of all recurring activities;
• monthly review of upcoming activities due in the next 60 days;
• quarterly reconciliation against the document catalog and planned artifacts;
• update after any new artifact introduces a review cycle or evidence cadence;
• removal of activities that are retired by approved catalog amendment.

10. Document Control

Revision History

Review Triggers

• New artifact introduces a recurring activity
• Existing artifact changes review cycle or evidence cadence
• New regulated scope enters CERG
• CISO changes reporting cadence
• Audit or assessment finding related to program cadence

Related Documents

Source: governance/CERG-GOV-CAL-001_Annual_Security_and_Governance_Calendar.md · Download .md · View on GitHub