Skip to main content

​
Security Program Hub

The Security Program Hub is the leadership and governance experience within Compliance OS. It is intended for authorized executives, client administrators, and other users who need a program-level view of cybersecurity work rather than only the detail of an individual remediation task.

​
What the hub can provide

Depending on the engagement and authorization, the hub can present published information about:
  • assessments,
  • findings,
  • risks,
  • roadmap initiatives,
  • governance decisions,
  • documents and plans,
  • program or domain health,
  • leadership attention items,
  • progress and status trends.
The specific modules available to your organization depend on what Cyber Op Source has published and what your account is authorized to access.

​
Executive governance

Some risks or remediation decisions require leadership action. The hub can support governance workflows such as:
  • risk acceptance,
  • treatment approval,
  • risk closure,
  • assigned executive responses,
  • documented rationale,
  • status tracking.
These workflows are intended to create an auditable record of the decision rather than burying it in email.

​
Program health

Program health is a high-level governance view derived from authorized published information. It should be interpreted as an engagement tool, not as a guarantee that an organization is secure or compliant. A health indicator can help leadership identify where attention is needed, but the underlying findings, evidence, risks, and assessment conclusions remain important.

​
Documents and plans

Where enabled, the hub can make approved client-facing documents and plans available to leadership. Examples may include policies, roadmaps, program plans, or other governance artifacts.

​
Published information only

The Security Program Hub operates on client-safe published information. It does not provide unrestricted access to Cyber Op Source’s internal assessment workspace. This distinction is especially important for leadership views: concise executive information should be traceable to assessment work without exposing every internal working note.