GV.RM-02: Risk appetite and risk tolerance statements are established, communicated, and maintained

Info icon.

Subcategory is new to this version of the framework and incorporates the following items from the previous version: ID.RM-2: Organizational risk tolerance is determined and clearly expressed, ID.RM-3: The organization’s determination of risk tolerance is informed by its role in critical infrastructure and sector specific risk analysis.

Description

[csf.tools Note: Subcategories do not have detailed descriptions. However NIST has provided the following implementation examples.]

Implementation Examples

1st: 1st Party Risk

3rd: 3rd Party Risk

Ex1: Determine and communicate risk appetite statements that convey expectations about the appropriate level of risk for the organization

Ex2: Translate risk appetite statements into specific, measurable, and broadly understandable risk tolerance statements

Ex3: Refine organizational objectives and risk appetite periodically based on known risk exposure and residual risk

Related Controls

NIST Special Publication 800-53 Revision 5.2.0

PM-9: Risk Management Strategy

Develops a comprehensive strategy to manage: Security risk to organizational operations and assets, individuals, other organizations, and the Nation associated with the operation and use of organizational systems; and Privacy risk to individuals resulting from the authorized processing of personally identifiable information; Implement the risk management strategy consistently across the organization; and Review and update…

Cloud Controls Matrix v4.0

GRC-02: Risk Management Program

Establish a formal, documented, and leadership-sponsored Enterprise Risk Management (ERM) program that includes policies and procedures for identification, evaluation, ownership, treatment, and acceptance of cloud security and privacy risks.