GV.RR-02: Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced

Info icon.

Subcategory is new to this version of the framework and incorporates the following items from the previous version: ID.AM-6: Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established, ID.GV-2: Cybersecurity roles and responsibilities are coordinated and aligned with internal roles and external partners, DE.DP-1: Roles and responsibilities for detection are well defined to ensure accountability.

Description

[csf.tools Note: Subcategories do not have detailed descriptions. However NIST has provided the following implementation examples.]

Implementation Examples

1st: 1st Party Risk

Ex1: Document risk management roles and responsibilities in policy

Ex2: Document who is responsible and accountable for cybersecurity risk management activities and how those teams and individuals are to be consulted and informed

Ex3: Include cybersecurity responsibilities and performance requirements in personnel descriptions

Ex4: Document performance goals for personnel with cybersecurity risk management responsibilities, and periodically measure performance to identify areas for improvement

Ex5: Clearly articulate cybersecurity responsibilities within operations, risk functions, and internal audit functions

Related Controls

NIST Special Publication 800-53 Revision 5.2.0

PM-19: Privacy Program Leadership Role

Appoint a senior agency official for privacy with the authority, mission, accountability, and resources to coordinate, develop, and implement, applicable privacy requirements and manage privacy risks through the organization-wide privacy program.

PM-23: Data Governance Body

Establish a Data Governance Body consisting of [Assignment: organization-defined roles] with [Assignment: organization-defined responsibilities].

PM-24: Data Integrity Board

Establish a Data Integrity Board to: Review proposals to conduct or participate in a matching program; and Conduct an annual review of all matching programs in which the agency has participated.

PM-29: Risk Management Program Leadership Roles

Appoint a Senior Accountable Official for Risk Management to align organizational information security and privacy management processes with strategic, operational, and budgetary planning processes; and Establish a Risk Executive (function) to view and analyze risk from an organization-wide perspective and ensure management of risk is consistent across the organization.

Cloud Controls Matrix v4.0

HRS-02: Acceptable Use of Technology Policy and Procedures

Establish, document, approve, communicate, apply, evaluate and maintain policies and procedures for defining allowances and conditions for the acceptable use of organizationally-owned or managed assets. Review and update the policies and procedures at least annually.

HRS-03: Clean Desk Policy and Procedures

Establish, document, approve, communicate, apply, evaluate and maintain policies and procedures that require unattended workspaces to not have openly visible confidential data. Review and update the policies and procedures at least annually.

HRS-06: Employment Termination

Establish, document, and communicate to all personnel the procedures outlining the roles and responsibilities concerning changes in employment.

HRS-08: Employment Agreement Content

The organization includes within the employment agreements provisions and/or terms for adherence to established information governance and security policies.

HRS-13: Compliance User Responsibility

Make employees aware of their roles and responsibilities for maintaining awareness and compliance with established policies and procedures and applicable legal, statutory, or regulatory compliance obligations.

STA-02: SSRM Supply Chain

Apply, document, implement and manage the SSRM throughout the supply chain for the cloud service offering.

STA-04: SSRM Control Ownership

Delineate the shared ownership and applicability of all CSA CCM controls according to the SSRM for the cloud service offering.

UEM-14: Third-Party Endpoint Security Posture

Define, implement and evaluate processes, procedures and technical and/or contractual measures to maintain proper security of third-party endpoints with access to organizational assets.

Critical Security Controls Version 8.1

14.9: Conduct Role-Specific Security Awareness and Skills Training

Conduct role-specific security awareness and skills training. Example implementations include secure system administration courses for IT professionals, OWASP® Top 10 vulnerability awareness and prevention training for web application developers, and advanced social engineering awareness training for high-profile roles.