GV.RM-03: Cybersecurity risk management activities and outcomes are included in enterprise risk management processes

Include the resources needed to implement the information security and privacy programs in capital planning and investment requests and document all exceptions to this requirement; Prepare documentation required for addressing information security and privacy programs in capital planning and investment requests in accordance with applicable laws, executive orders, directives, policies, regulations, standards; and Make available…

Develops a comprehensive strategy to manage: Security risk to organizational operations and assets, individuals, other organizations, and the Nation associated with the operation and use of organizational systems; and Privacy risk to individuals resulting from the authorized processing of personally identifiable information; Implement the risk management strategy consistently across the organization; and Review and update…

Develop an organization-wide strategy for managing supply chain risks associated with the development, acquisition, maintenance, and disposal of systems, system components, and system services; Implement the supply chain risk management strategy consistently across the organization; and Review and update the supply chain risk management strategy on [Assignment: organization-defined frequency] or as required, to address organizational…

Respond to findings from security and privacy assessments, monitoring, and audits in accordance with organizational risk tolerance.

Design organizational systems, system components, or system services to achieve cyber resiliency by: Defining the following cyber resiliency goals: [Assignment: organization-defined cyber resiliency goals]. Defining the following cyber resiliency objectives: [Assignment: organization-defined cyber resiliency objectives]. Defining the following cyber resiliency techniques: [Assignment: organization-defined cyber resiliency techniques]. Defining the following cyber resiliency implementation approaches: [Assignment: organization-defined…

Develop a plan for managing supply chain risks associated with the research and development, design, manufacturing, acquisition, delivery, integration, operations and maintenance, and disposal of the following systems, system components or system services: [Assignment: organization-defined systems, system components, or system services]; Review and update the supply chain risk management plan [Assignment: organization-defined frequency] or as…