GV.RM: Risk Management Strategy
Category is new to this version of the framework and incorporates the following item from the previous version: ID.RM: Risk Management Strategy.
Description
The organization's priorities, constraints, risk tolerance and appetite statements, and assumptions are established, communicated, and used to support operational risk decisions
Framework Subcategories
GV.RM-01: Risk management objectives are established and agreed to by organizational stakeholders
[csf.tools Note: Subcategories do not have detailed descriptions.]
GV.RM-02: Risk appetite and risk tolerance statements are established, communicated, and maintained
[csf.tools Note: Subcategories do not have detailed descriptions.]
GV.RM-03: Cybersecurity risk management activities and outcomes are included in enterprise risk management processes
[csf.tools Note: Subcategories do not have detailed descriptions.]
GV.RM-04: Strategic direction that describes appropriate risk response options is established and communicated
[csf.tools Note: Subcategories do not have detailed descriptions.]
GV.RM-05: Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties
[csf.tools Note: Subcategories do not have detailed descriptions.]
GV.RM-06: A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated
[csf.tools Note: Subcategories do not have detailed descriptions.]
GV.RM-07: Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions
[csf.tools Note: Subcategories do not have detailed descriptions.]