GV.OC
— Organizational Context
The circumstances - mission, stakeholder expectations, dependencies, and legal, regulatory, and contractual requirements - surrounding the organization's cybersecurity risk management decisions are understood
The organization's cybersecurity risk management strategy, expectations, and policy are established, communicated, and monitored
| Citation | GV |
|---|---|
| Clé de plateforme | arcate:compliance:requirements/nist-csf/2.0/GV |
| Emplacement dans la source | row 3 of sheet 'CSF 2.0' |
| Publié par | NIST |
Exigences filles
GV.RM
— Risk Management Strategy
The organization's priorities, constraints, risk tolerance and appetite statements, and assumptions are established, communicated, and used to support operational risk decisions
GV.RR
— Roles, Responsibilities, and Authorities
Cybersecurity roles, responsibilities, and authorities to foster accountability, performance assessment, and continuous improvement are established and communicated
GV.PO
— Policy
Organizational cybersecurity policy is established, communicated, and enforced
GV.OV
— Oversight
Results of organization-wide cybersecurity risk management activities and performance are used to inform, improve, and adjust the risk management strategy
GV.SC
— Cybersecurity Supply Chain Risk Management
Cyber supply chain risk management processes are identified, established, managed, monitored, and improved by organizational stakeholders