Back to Roles

Guide Origin: Official | ArcKit Version: [VERSION]

DDaT Role Family: Chief Digital and Data Framework: UK Government DDaT Capability Framework

Overview

The CISO sets security strategy and risk appetite for the organisation. You use ArcKit's security and compliance commands at a strategic level — ensuring security assessments are consistent, risk registers are maintained, and architecture conforms to security standards.

Primary Commands

Command Purpose Guide
/arckit:secure Review Secure by Design assessments across projects Guide
/arckit:mod-secure Review MOD Secure by Design assessments (if MOD) Guide
/arckit:dpia Oversee DPIAs for data protection compliance Guide
/arckit:risk Set risk appetite and review risk registers Guide
/arckit:conformance Monitor security conformance across the portfolio Guide

Secondary Commands

Command Your Involvement Guide
/arckit:principles Define security principles (Zero Trust, defence in depth) Guide
/arckit:requirements Review NFR-SEC security requirements standards Guide
/arckit:tcop Review TCoP compliance for security-related points Guide
/arckit:analyze Review governance quality for security gaps Guide
/arckit:health Monitor for stale security artifacts Guide
/arckit:ai-playbook Review AI safety and security controls Guide
/arckit:jsp-936 Review MOD AI assurance (if applicable) Guide

Typical Workflow

principles (security) → risk → secure / mod-secure → conformance → analyze

Step-by-step

  1. Define security principles: Set organisational security principles in /arckit:principles
  2. Set risk appetite: Review /arckit:risk registers across projects
  3. Review assessments: Review /arckit:secure or /arckit:mod-secure outputs
  4. Check conformance: Run /arckit:conformance to verify security decisions are implemented
  5. Monitor quality: Review /arckit:analyze for security governance gaps

Key Artifacts You Oversee

  • ARC-{PID}-SECD-v*.md — Secure by Design assessments (owned by Security Architect)
  • ARC-{PID}-SECD-MOD-v*.md — MOD Secure by Design assessments
  • ARC-{PID}-RISK-v*.md — Risk registers
  • ARC-{PID}-DPIA-v*.md — Data Protection Impact Assessments
  • ARC-{PID}-CONF-v*.md — Conformance assessments