GV: Govern

The circumstances – mission, stakeholder expectations, dependencies, and legal, regulatory, and contractual requirements – surrounding the organization's cybersecurity risk management decisions are understood

The organization's priorities, constraints, risk tolerance and appetite statements, and assumptions are established, communicated, and used to support operational risk decisions

Cybersecurity roles, responsibilities, and authorities to foster accountability, performance assessment, and continuous improvement are established and communicated

Organizational cybersecurity policy is established, communicated, and enforced

Results of organization-wide cybersecurity risk management activities and performance are used to inform, improve, and adjust the risk management strategy

Cyber supply chain risk management processes are identified, established, managed, monitored, and improved by organizational stakeholders