GV.OV-03: Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed

Info icon.

Subcategory is new to this version of the framework.

Description

[csf.tools Note: Subcategories do not have detailed descriptions. However NIST has provided the following implementation examples.]

Implementation Examples

1st: 1st Party Risk

Ex1: Review key performance indicators (KPIs) to ensure that organization-wide policies and procedures achieve objectives

Ex2: Review key risk indicators (KRIs) to identify risks the organization faces, including likelihood and potential impact

Ex3: Collect and communicate metrics on cybersecurity risk management with senior leadership

Related Controls

NIST Special Publication 800-53 Revision 5.2.0

PM-4: Plan of Action and Milestones Process

Implement a process to ensure that plans of action and milestones for the information security, privacy, and supply chain risk management programs and associated organizational systems: Are developed and maintained; Document the remedial information security, privacy, and supply chain risk management actions to adequately respond to risk to organizational operations and assets, individuals, other organizations,…

RA-7: Risk Response

Respond to findings from security and privacy assessments, monitoring, and audits in accordance with organizational risk tolerance.

SR-6: Supplier Assessments and Reviews

Assess and review the supply chain-related risks associated with suppliers or contractors and the system, system component, or system service they provide [Assignment: organization-defined frequency].

NIST SP 800-171 Revision 3.0

03.11.01: Risk Assessment

Assess the risk (including supply chain risk) of unauthorized disclosure resulting from the processing, storage, or transmission of CUI. Update risk assessments [Assignment: organization-defined frequency].

Cloud Controls Matrix v4.0

AIS-03: Application Security Metrics

Define and implement technical and operational metrics in alignment with business objectives, security requirements, and compliance obligations.