GV.RR: Roles, Responsibilities, And Authorities
Category is new to this version of the framework and incorporates the following item from the previous version: ID.GV-2: Cybersecurity roles and responsibilities are coordinated and aligned with internal roles and external partners.
Description
Cybersecurity roles, responsibilities, and authorities to foster accountability, performance assessment, and continuous improvement are established and communicated
Framework Subcategories
GV.RR-01: Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving
[csf.tools Note: Subcategories do not have detailed descriptions.]
GV.RR-02: Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced
[csf.tools Note: Subcategories do not have detailed descriptions.]
GV.RR-03: Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies
[csf.tools Note: Subcategories do not have detailed descriptions.]
GV.RR-04: Cybersecurity is included in human resources practices
[csf.tools Note: Subcategories do not have detailed descriptions.]