Rogue CISO

Rogue CISO is a governance operating model and VS Code extension for security leaders who need one place to run decisions, risks, actions, assurance, and reporting.

It is designed to turn security leadership into a practical operating rhythm, not a collection of disconnected documents, meetings, and spreadsheets.

The product is explicitly aligned to six practical CISO operating loops:

1. Know Surface: maintain a current view of systems, assets, suppliers, and exposure.
2. Govern Decisions: keep decision rights, forums, and escalation pathways clear.
3. Treat Risks: convert risk posture into owned, prioritised, and tracked actions.
4. Evidence Controls: maintain compliance and assurance evidence with clear traceability.
5. Plan Response: stay ready for disruption through incident and resilience planning.
6. Report Posture: package credible, audience-specific reporting for leadership decisions.

The Command Centre button palette exposes all six loops directly so users can run each loop at any time.

Get Rapid Value (First 15 Minutes)

If you are new, use this flow:

1. Open the Access Panel command: Rogue: Open Access Panel.
2. Create a small baseline set:
   • Create Risk
   • Create Action
   • Create Recommendation
   • Create Forum
3. Open Data Workspace and link the records together.
4. Open Graph Explorer from Access Panel to validate relationship topology quickly.
5. Open Recommendation Workspace to triage recommendation status quickly.
6. Open Forum Workspace to see decision flow between forums (escalations, decisions, and connections).
7. Open Continuous Risk Posture for an immediate executive-level view of current exposure.
8. Open Coverage Dashboard to see which critical assets are covered, partial, or exposed.
9. Open Stakeholder Accountability Dashboard to see ownership load, overdue actions, and unassigned work.

By that point you already have:

• A connected risk-to-action-to-recommendation story.
• A visible decision trail.
• An executive posture view.
• A first-pass coverage picture.
• A clear accountability snapshot.

What You Can Do Immediately

1) Run Governance in One Place

• Capture and manage outcomes, benefits, risks, actions, recommendations, and forums.
• Keep evidence, rationale, and links attached to the same records.
• Replace fragmented spreadsheet handoffs with a connected operating model.

2) Move Faster With Dedicated Workspaces

• Data Workspace: detail editing, linking, and relationship management across all core entities.
• Data Workspace V2: progressive master-detail experience for consistent data capture with relationship editing.
• Action Workspace: fast action operations (status, priority, due dates, and maintenance), plus one-click clipboard snapshots for rapid comms (Exec snapshot and Ultra-brief snapshot) suitable for Teams, email, and presentation updates.
• Assessment Workspace: VT100-style interactive CLI for guided assessment capture.
  • start [set-id] for grouped guided runs.
  • start full <framework-id> for full-framework question-by-question walkthrough.
  • next to suggest and prefill the next actionable command.
• Recommendation Workspace: triage recommendations with quick status updates and filters (status, source, text).
• Forum Workspace: visualise forum-to-forum item flow and why items moved.
• Communication Map: track mailboxes, distribution lists, mailing lists, outbound routes, owners, and response accountability.
• Graph Explorer: inspect linked records and governance topology through an interactive graph view.
• Coverage Dashboard: show which critical assets are covered, partial, or exposed.
• Stakeholder Accountability Dashboard: show who owns what, where work is overdue, and where accountability is thin.
• Command Centre: operational hub with quick-launch tiles, live status overview, and a View Compliance Posture workspace shortcut.
• PSPF Explorer: browse PSPF requirements, track response status, link actions/risks/policies/KPIs, capture recommendation/owner/target-date/priority, and save from both top and bottom of the detail panel with immediate in-panel save feedback.
• Compliance Workspace: browse and manage compliance entities with posture context.
• Data Register: entity browse with filtered register views.
• Systems Register: system component browse and management.
• Request Pipeline: intake and triage pipeline for governance requests.
• Initiative Planner: plan, phase, and task lifecycle management.
• Integration Workspace: configure external read-only source profiles, test connectivity, run risk sync previews, and apply approved local updates.

3) Get Executive Visibility Quickly

• Continuous Risk Posture: near-real-time view of aggregate risk exposure.
• Executive Risk Matrix: impact-effort prioritisation for treatment actions.
• Session Brief: what changed since last session.
• Insight Feed: prioritised governance signals and alerts.

4) Strengthen Assurance and Compliance

• Assurance workflows for KPI, policy, critical asset, assurance provider, and resilience checks.
• Record control test evidence with dates, outcomes, evidence references, and notes.
• Record assurance findings and automatically raise recommendations/actions for high-severity gaps.
• E8 and PSPF assessments with pinned framework versions.
• PSPF Explorer workflows: assess PSPF requirements, track response status, map recommended approaches, link related entities, and create action/risk records directly from approach guidance, with evidence-gated save validation after full-field capture.
• Compliance posture view and evidence pack export, including per-framework desired target defaults (with per-requirement manual override).

5) Prepare for Incidents and Supplier Failure

• Create incident response plans by incident type, with cadence, escalation contacts, and linked risks.
• Create incident logs with impacted assets, linked plans, and timeline entries.
• Raise control uplift actions directly from incident logs and link them back to the affected control implementations.
• Record supplier risk assessments with review dates and updated criticality scoring.

This closes the loop between current posture and operational response.

6) Produce Reporting Outputs

• Board and executive summaries in Markdown/PDF.
• Dedicated Control Orchestration Posture report covering system authorisation, control implementation coverage, ownership gaps, supplier linkage gaps, incident-linked uplift, and stale evidence.
• Curated links export.
• Compliance evidence pack export with evidence freshness flags.
• Storage diagnostics with control orchestration completeness metrics for release and operational review.

New User Playbooks

Daily 10-Minute Triage

1. Open Session Brief.
2. Review Insight Feed signals.
3. Use Recommendation Workspace and Action Workspace for quick updates.
4. Confirm posture in Continuous Risk Posture.

Weekly Governance Cadence

1. Record forum outcomes.
2. Open Forum Workspace to validate decision pathways and escalations.
3. Record control test results and assurance findings from the week.
4. Review overdue and blocked actions.
5. Open Coverage Dashboard and Stakeholder Accountability Dashboard for control and ownership drift.
6. Generate an updated board risk summary.
7. Generate a Control Orchestration Posture report if you are governing technology systems, shared responsibility, or supplier-linked controls.

Audit/Committee Readiness

1. Validate linked evidence in Data Workspace.
2. Confirm current control test evidence and open assurance findings.
3. Export compliance evidence pack.
4. Generate board-ready summary artifacts.
5. Generate the control orchestration posture report and inspect ownership, supplier linkage, and uplift gaps.

Incident Readiness

1. Create incident response plans for the incident types you expect to face.
2. Link plans to stakeholders, risks, and critical assets.
3. When something happens, create an incident log and keep the response timeline current.

Who It Is For

• CISOs and security leaders accountable for governance outcomes.
• Risk, assurance, and compliance managers needing traceability.
• Executive stakeholders needing concise, credible posture updates.
• Organisations with moderate to high compliance expectations, including Australian Government-aligned environments.

Delivery Status

Rogue CISO has completed the current six-phase implementation baseline, including control orchestration, shared responsibility mapping, supplier linkage, incident-to-control uplift, and orchestration reporting hardening.

P0 delivery batch (31-03-2026) is shipped and validated, and the current release baseline has passed compile, full automated tests, security audit, and release smoke packaging.

Recent workspace additions include:

• Assessment and Compliance Posture two-way updates, including inline posture assessment save and per-framework desired target defaults.
• Policy-to-requirement coverage model with diagnostics and gap visibility.
• Assessment Workspace iterative document evidence capture loop.
• Storage diagnostics uplift (freshness, schema confidence, and remediation linkage coverage).
• Outcome Workspace editing parity with richer inline fields and linked-item visibility.
• Data Workspace update-cadence grouping for stable versus frequently changed records.
• Risk Workspace interactivity uplift with portfolio fire-danger and matrix filtering.
• Forum Workspace governance policy support with per-forum policy coverage visibility.
• Forum Workspace for escalation/decision flow and movement rationale.
• Recommendation Workspace for rapid recommendation triage and filtering.
• Assessment Workspace CLI upgrades for guided and full-framework runs with terminal-first persistence feedback.
• PSPF Explorer with requirement browser/detail workflows, surfaced recommendation/owner/target-date/priority capture, approach-driven action/risk quick-create, top-and-bottom save controls, and immediate in-panel operation feedback, surfaced through both Access Panel tiles and the Command Centre button rail.
• Action Workspace clipboard snapshot export with mode selection (Exec snapshot and Ultra-brief snapshot) for immediate plain-text status sharing.
• Integration Workspace and sync command surface for external risk data alignment with local-only upsert safeguards, now surfaced through Access Panel mission tiles, Command Centre quick actions, and the Dashboard tree view core workspace list.
• Coverage Dashboard for asset coverage visibility across controls, policies, risks, and suppliers.
• Stakeholder Accountability Dashboard for ownership load and overdue accountability tracking.
• Technology systems, control implementations, authorisation decisions, control exceptions, and orchestration posture reporting.
• Control evidence capture, assurance finding workflows, supplier risk reassessment, incident response plan/log tracking, and incident-linked control uplift creation.

Core Feature Coverage

• Governance entities: outcomes, benefits, risks, actions, recommendations, forums.
• Assurance entities: KPIs, policies, critical assets, assurance providers, resilience checks.
• Compliance entities: E8, PSPF, and requirement assessments.
• PSPF value entities and workflows: Security Service Profiles with requirement, KPI, action, risk, policy, and control implementation linkage.
• Control orchestration: technology systems, control implementations, control test results, control exceptions, authorisation decisions, system components.
• Optional modules: controls, requirements, suppliers, people, digital assets, investigations, incident response plans, incident logs, and events.
• Visual analysis: graph explorer, risk posture, executive matrix.
• Coverage and accountability dashboards: critical asset coverage and stakeholder workload/accountability.
• Cross-panel refresh: all open webview panels and tree views update live when data changes.
• Webview serialisation: all workspace panels survive VS Code window reload.
• Bidirectional link validation: store-wide integrity checks on every save.
• Operational support: backup, restore, diagnostics, compact, and repair.
• Security posture: encrypted-local mode with VS Code SecretStorage-backed key handling.
• Integration sync baseline: manual risk-api preview/apply flow with retry-safe connector runtime, auth modes (bearer-token, api-key-header, oauth-client-credentials with token retrieval), apply modes (add-only, safe-update), pagination support, diagnostics redaction, and sync run diagnostics.

Current integration constraints:

• Manual runs only (no scheduling/incremental automation yet).
• Risk entity sync is implemented first; action and technology system connectors are planned next.
• Integration Workspace currently focuses on summary/state controls; full diff/reconciliation table UX is still in progress.

Development Commands

• Build (typecheck + bundle): npm run compile
• Lint + tests: npm run test:quality
• Release smoke validation: npm run release:smoke
• Full CI parity checks (smoke + audit): npm run test:ci
• Package VSIX manually: npx @vscode/vsce package

Release Artefact Posture

• Extension packaging is now bundled for reduced release footprint.
• Current VSIX packaging baseline is a compact artefact containing the bundled out/extension.js plus core metadata/assets.
• Validated VSIX filenames, checksums, and smoke-test evidence are tracked in the relevant release evidence document rather than hard-coded here.
• For the current validated artefact details, see the latest release evidence in docs/SPRINT5_RELEASE_EVIDENCE.md.

Repository

• Canonical repository: https://github.com/MegaTobyOne/VSC_RogueCISO
• Issue tracker: https://github.com/MegaTobyOne/VSC_RogueCISO/issues

Licence

• Licence: MIT
• See LICENSE for the canonical licence text.
• See LICENCE.md for a Markdown copy.

Read Next

• Customer value and ROI framing: docs/CUSTOMER_VALUE_REVIEW.md
• End-to-end architecture: docs/ARCHITECTURE.md
• Feature and scope design: docs/RC_DESIGN.md
• Data model and entities: docs/RC_DATA_MODEL.md
• Delivery plan and status tracking: docs/CONTROL_ORCHESTRATION_IMPLEMENTATION_PLAN.md
• Major build sequencing and release gates: docs/MAJOR_BUILD_PLAN.md
• Stream A technical design (save/cancel and unsaved-change safety): docs/STREAM_A_TECH_SPEC.md
• Sprint 5 release evidence: docs/SPRINT5_RELEASE_EVIDENCE.md