The 5 standards listed for cyber and digital risk in the subsite registry, each with its status, UNI (Unique Nexus Identifier) and the rules its text states. Every standard here is proposed: drafted and applied by consumers, not adopted by an authority. A UNI identifies and resolves; it never certifies truth, readiness or approval. Names of standards bodies and their standards belong to their stewards and are used only to identify the documents; no text of an external standard is reproduced here.
Status proposed · owner trust · NXS-STD-ST-000004
| Rule | Text |
|---|---|
NS0-P1 | Open · The standards, their registries, schemas, catalogs and reference tools are published in the canonical repository under a licence recorded by counsel; participation in development is open to every community and stakeholder under GOVERNANCE.md; no standard depends on a proprietary artifact to be applied. |
NS0-P2 | Machine-readable first · Every normative element exists as data (registry, schema, clause) before it exists as prose; prose explains, data governs. A standard with no machine form is not a Nexus Standard. |
NS0-P3 | Identified · Every artifact, record, deployment, policy and clause carries a UNI (NS-1, NS-3, NS-9). Nothing is cited by a name alone. |
NS0-P4 | Verified, not asserted · Conformance is a claim with evidence: receipts, digests, signed attestations and observations (NS-11). A claim without evidence is recorded as a claim, never as a fact; the claim ceiling of the consumer bounds every statement. |
NS0-P5 | Zero trust · Authenticated is not authorized; entitled is not authorized; deny by default. Every verification, monitoring and enforcement path assumes no implicit trust between systems, tenants, sites or agents, and records who verified what under which mandate. |
NS0-P6 | Real-time · Standards express obligations that can be evaluated continuously against live records (observations, releases, corrections, deployments), and the standards themselves are versioned so a consumer can state exactly which version it conforms to at any instant. |
NS0-P7 | Provenance everywhere · Every artifact records what it was derived from, who produced it, under which release and policy decision, and what corrected it (NS-3b PROV-O profile). Corrections supersede; nothing is silently rewritten. |
NS0-P8 | Honest · A UNI identifies and resolves; it never certifies. legalState defaults to review-required; readiness, approval and production status are never implied by a standard, a status, a page or a badge. |
NS0-P9 | Nexus-aware · Standards address cross-domain interdependence (water, energy, food, health, biodiversity, climate and the sectors they touch) explicitly: an obligation can reference artifacts in another domain, and cascades are first-class. |
NS0-P10 | Names are governed · Codes are never names. Public names follow the name architecture standard; a system or component is shown by its neutral display name and its UNI, which may change with context (NS-9) while the name does not infringe anyone's mark. |
NS0-P11 | Community-owned development · Proposals, comments, decisions and versions of every standard are themselves artifacts with UNIs; the development process is specified (NS-13) and open; authority to adopt is recorded, never assumed. |
NS0-P12 | Fail closed · Missing evidence, missing legal state, missing policy decision or unavailable verification is a refusal with a typed reason, never a pass. |
Status proposed · owner trust · NXS-STD-ST-000005
| Rule | Text |
|---|---|
NS9-R1 | One context record per deployment or programme instance; the concept keeps its own UNI; context.ofUni is required and must resolve. |
NS9-R2 | Context identifiers are allocated by the catalog for their SCOPE, never derived from names or typed by hand. |
NS9-R3 | A context's claim ceiling, legal state and conformance evidence are its own; they are never inherited from the concept or from another context. |
NS9-R4 | Closing a context never deletes it; context.validUntil is set and the status becomes WITHDRAWN or SUPERSEDED with supersededBy. |
NS9-R5 | Display names in context follow the name architecture standard; the UNI, not the name, is the key everywhere. |
Status proposed · owner trust; integrated posture and executive synthesis · NXS-STD-ST-000006
| Rule | Text |
|---|---|
NS10-R1 | Every obligation enforced anywhere in the ecosystem is a clause with a UNI; no hidden rule in code without a clause record (the code may implement it, the clause names it). |
NS10-R2 | Subjects are contextual UNIs; names, labels or free text never bind. |
NS10-R3 | The predicate is data in a declared language; evaluators record engine and version; the same clause evaluated by two conformant evaluators yields the same result for the same inputs. |
NS10-R4 | External obligations are cited, never copied. |
NS10-R5 | Failure effects are typed; refuse is the default for blocking clauses in production contexts. |
NS10-R6 | A clause or policy with legalState other than APPROVED may be evaluated but its results are displayed as claims under review. |
NS10-R7 | Policies and clauses are append-only artifacts: withdrawal and supersession keep the record. |
Status proposed · owner trust · NXS-STD-ST-000007
| Rule | Text |
|---|---|
NS11-R1 | No conformance statement without an attestation; no attestation without an evaluator, a mandate, evidence references and a digest. |
NS11-R2 | Zero trust: subject and evaluator are distinct; production evaluations run outside the subject's trust boundary. |
NS11-R3 | Missing or unresolvable evidence is INDETERMINATE or REFUSED, never PASS (NS0-P12). |
NS11-R4 | Attestations are append-only and supersede; monitoring records are observations with record UNIs. |
NS11-R5 | Every displayed conformance value carries its evaluation instant and evaluator; projections never store verdicts. |
NS11-R6 | Exports to Verifiable Credentials, in-toto or PROV-O are crosswalks; the Nexus attestation is the record of truth. |
Status proposed · owner software; trust · NXS-STD-ST-000012
| Rule | Text |
|---|---|
NS12-R1 | Software releases carry a bill of materials, a build attestation and signatures as evidence of the UNI version. |
NS12-R2 | Models carry a model card; datasets carry a sheet; both cite their sources by UNI. |
NS12-R3 | Agents act under recorded mandates and are credited as agents; they never adopt or certify. |
NS12-R4 | AI governance obligations are clauses bound to contextual UNIs and evaluated, never prose assurances. |
Risk Academy disciplines that teach Cyber and digital risk, with their courses; the GCRI Canada, The Global Risks Forum (GRF) and The Global Risks Alliance (GRA) subsites that carry those disciplines; and the Nexus Foundry systems the standards name. Mappings are proposed for review (Risk Academy standards map, 2026-10-17); a link says a page on the same subject exists, never an endorsement or a conformance statement; framework names in course titles are named and linked, never reproduced.
Every standard here is proposed. Changes enter as proposals under NS-13; conformance is shown by attestations under NS-11; nothing on this site is a certification, an approval or a readiness statement.
Nexus Standards documents CC BY 4.0 · tooling Apache-2.0 · counsel review pending (DEC-2026-10-16-NEXUS-STANDARDS-OPEN-LICENCE). External standards are named and linked under their own licences; a UNI (Unique Nexus Identifier) identifies, it never certifies. · Generated from the Nexus Standards corpus at commit 437ae044c5cb (2026-10-17); proposed and open.