ROLE READER PATHS

Sequenced Reading Orders for New CERG Roles · CISO, Risk Lead, Engineering Lead, Business Owner

Table of Contents

1. Purpose and Scope
2. The Reader Path Format
3. CISO Reader Path
4. Risk Lead Reader Path
5. Engineering Lead Reader Path
6. Business Owner / System Sponsor Reader Path
7. When to Skip the Path
8. Document Control

1. Purpose and Scope

CERG is intentionally complete. That completeness can make the first hour difficult for a new reader. This document is the antidote.

Each section below is a sequenced reading order for a specific role. The order is chosen because each document in the sequence builds on the previous one. Total time for the CISO path is approximately 35 minutes. Total time for the Risk and Engineering paths is approximately 30 minutes each.

Use this document when:

• A new CISO, Risk Lead, Engineering Lead, Business Owner, or System Sponsor joins a team that has adopted CERG.
• An existing leader takes on a new CERG role or accountable business-owner role for the first time.
• An executive sponsor wants to understand what the leader they hired will be reading.

This document does not replace the documents it points at. It tells the reader which document to open next and why.

2. The Reader Path Format

Each reader path follows the same format:

The reader path is a reading list, not an action list. For action items, see the role-based implementation checklists (CERG-GOV-IMP-006). For the adoption-mode selection that determines which reader path is relevant, see CERG-GOV-IMP-005.

3. CISO Reader Path

Read time: 35 minutes.

Goal: You can explain the CERG program to a board member in five minutes, name the three pillars and what each one owns, identify your adoption mode (Lite, Standard, Regulated), and produce your first quarterly oversight checklist.

Sequence:

Skip if:

• You have held a CISO role at a CERG-adopting organization before. Skip step 7 and read steps 1-6 only.
• You are CERG Lite with fewer than 5 people. Spend the OM-001 time on the consolidation map (step 3) and the Small Team Adoption Path (CERG-GOV-IMP-003) instead of the Operating Model detail.

After the path:

1. Run CERG-GOV-IMP-006 §3.1 (First 48 hours) immediately. The reader path is preparation, not a substitute.
2. Schedule the first 30-day review (step §3.2) before the 30th day.
3. Bookmark CERG-GOV-FRM-002 for the duration of your tenure. It is the navigation reference.
4. Add the Day in the Life stories to your onboarding checklist for future new hires on your team.

4. Risk Lead Reader Path

Read time: 30 minutes.

Goal: You can name the risk pillar’s scope (exposure management, threat intelligence, threat modeling, adversarial validation, vendor risk), describe the canonical cross-pillar flows, and triage a critical finding from intake to closure.

Sequence:

Skip if:

• You have held a Risk Lead role at a CERG-adopting organization before. Skip step 6.

After the path:

1. Open the risk register and the exposure backlog. Read both before the next weekly cadence.
2. Run the biweekly vulnerability SLA review per CERG-GOV-IMP-003 §3.
3. Bookmark CERG-GOV-FLOW-001 §2 (Operating Principles) for reference.

5. Engineering Lead Reader Path

Read time: 30 minutes.

Goal: You can name the engineering pillar’s scope (architecture review, asset coverage, configuration baseline, secure development, remediation), describe how a project goes through intake to disposition, and route a high-risk architecture review correctly.

Sequence:

Skip if:

• You have held an Engineering Lead role at a CERG-adopting organization before. Skip step 6.

After the path:

1. Open the architecture review queue and the asset coverage report. Read both before the next weekly cadence.
2. Run the weekly intake review per CERG-GOV-IMP-003 §3.
3. Bookmark the standards catalog (CERG-GOV-CAT-001 §5.3) for the standards you are most likely to apply this quarter.

6. Business Owner / System Sponsor Reader Path

Read time: 25 minutes.

Goal: You can explain what CERG expects from a business owner or system sponsor: own the business objective, provide scope and priority, fund or accept treatment decisions, approve go-live for your system, and understand that Security/Risk recommends while the business owns residual consequence.

Sequence:

Skip if:

• You are only funding a one-time security project and do not own a system, business process, or residual risk decision. Read CERG-GOV-MTR-001 §3 instead.
• You have already sponsored a CERG-governed system through intake, pre-production, and go-live. Use CERG-GOV-FRM-002 §5 as your quick reference.

After the path:

1. Confirm the named Business Owner / System Sponsor for each system or project you own.
2. For active projects, confirm whether CERG-TMPL-AR-001 has been submitted and whether Phase 4/5 records are required.
3. For accepted risks, confirm the treatment owner, funding decision, expiration date, and next review date.

7. When to Skip the Path

Reader paths are for new readers. Skip them if:

• You are the executive sponsor and do not own a system, project, or residual-risk decision. Read README.md, START-HERE.md Path selection, and CERG-GOV-MTR-001 §3 (Board Reporting). Total time: 15 minutes.
• You are a program-level contributor (auditor, consultant, advisor). Read README.md, CERG-GOV-FRM-002, and one Day in the Life story relevant to your engagement. Total time: 20 minutes.
• You have already adopted CERG and run it for six months or more. Use CERG-GOV-CAT-001 §5 as your reference, not the reader path.

The reader paths are designed for the first hour of engagement. They are not a substitute for the operating rhythm that follows.

8. Document Control

Revision History

Review Triggers

• A change to the role consolidation map in CERG-GOV-OM-001.
• A change to the canonical cross-pillar flows in CERG-GOV-FLOW-001.
• A new role added to the workforce architecture in roles/ that warrants its own reader path.
• A material change to adoption sequencing in CERG-GOV-IMP-001 or CERG-GOV-IMP-005.
• User feedback indicating the path is too long, too short, missing a business-owner decision point, or in the wrong order.

Related Documents

• CERG-GOV-IMP-001 - Implementation and Adaptation Guide
• CERG-GOV-IMP-005 - Adoption Decision Tree and Dependency Matrix
• CERG-GOV-IMP-006 - Role-Based Implementation Checklists (action lists)
• CERG-GOV-FRM-002 - Framework System Map (navigation reference)
• README.md - Top-level project README
• START-HERE.md - First-48-hours adoption guide
• examples/day-in-the-life/ - Worked examples referenced from each reader path

Source: governance/CERG-GOV-IMP-007_Role_Reader_Paths.md · Download .md · View on GitHub