+GV.RR Roles, Responsibilities, and Authorities
---+GV.RR-01 Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually …
---+GV.RR-02 Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced
---+GV.RR-03 Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies
---+GV.RR-04 Cybersecurity is included in human resources practices

GV.RR Roles, Responsibilities, and Authorities

Statement

Cybersecurity roles, responsibilities, and authorities to foster accountability, performance assessment, and continuous improvement are established and communicated

1. Přehled

GV.RR-01 Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually …

Statement

Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving

Guidance

Leaders (e.g., directors) agree on their roles and responsibilities in developing, implementing, and assessing the organization's cybersecurity strategy

Guidance

Share leaders' expectations regarding a secure and ethical culture, especially when current events present the opportunity to highlight positive or negative examples of cybersecurity risk management

Guidance

Leaders direct the CISO to maintain a comprehensive cybersecurity risk strategy and review and update it at least annually and after major events

Guidance

Conduct reviews to ensure adequate authority and coordination among those responsible for managing cybersecurity risk
GV.RR-02 Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced

Statement

Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced

Guidance

Document risk management roles and responsibilities in policy

Guidance

Document who is responsible and accountable for cybersecurity risk management activities and how those teams and individuals are to be consulted and informed

Guidance

Include cybersecurity responsibilities and performance requirements in personnel descriptions

Guidance

Document performance goals for personnel with cybersecurity risk management responsibilities, and periodically measure performance to identify areas for improvement

Guidance

Clearly articulate cybersecurity responsibilities within operations, risk functions, and internal audit functions
GV.RR-03 Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies

Statement

Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies

Guidance

Conduct periodic management reviews to ensure that those given cybersecurity risk management responsibilities have the necessary authority

Guidance

Identify resource allocation and investment in line with risk tolerance and response

Guidance

Provide adequate and sufficient people, process, and technical resources to support the cybersecurity strategy
GV.RR-04 Cybersecurity is included in human resources practices

Statement

Cybersecurity is included in human resources practices

Guidance

Integrate cybersecurity risk management considerations into human resources processes (e.g., personnel screening, onboarding, change notification, offboarding)

Guidance

Consider cybersecurity knowledge to be a positive factor in hiring, training, and retention decisions

Guidance

Conduct background checks prior to onboarding new personnel for sensitive roles, and periodically repeat background checks for personnel with such roles

Guidance

Define and enforce obligations for personnel to be aware of, adhere to, and uphold security policies as they relate to their roles

1.1 Odkazy

1.2 Identifikované požadavky

1.3 Související regulace

2. Identifikované požadavky

Požadavky

3. Související regulace

Regulace

Propojené úkoly

Vazby
is blocked by Defined Roles & Responsibilities
is blocked by Responsible, Accountable, Supportive, Consulted & Informed (RASCI) Matrix
  • NIST -

    EN: Publications of the National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, from their electronic versions (OSCAL; SP 800-63-4 from its HTML version, https://pages.nist.gov/800-63-4/). Works of NIST employees are not subject to copyright protection in the United States (17 U.S.C. § 105); the OSCAL content is dedicated to the public domain worldwide (CC0 1.0); outside the United States NIST grants the right to reprint its technical series publications in all formats (NIST copyright statement). Republished courtesy of the National Institute of Standards and Technology; each document names its citation. Divided into sections and converted into the GRCA format, the wording unchanged. Only the versions published by NIST are authoritative.

    DE: Veröffentlichungen des National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, aus ihren elektronischen Fassungen (OSCAL; SP 800-63-4 aus ihrer HTML-Fassung, https://pages.nist.gov/800-63-4/). Werke von NIST-Beschäftigten sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105); die OSCAL-Inhalte sind weltweit gemeinfrei gestellt (CC0 1.0); außerhalb der USA räumt das NIST das Recht ein, seine Technical-Series-Publikationen in allen Formaten neu zu veröffentlichen (Copyright-Hinweis des NIST). „Republished courtesy of the National Institute of Standards and Technology“; jedes Dokument nennt seine Zitierangabe. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert. Maßgeblich sind allein die vom NIST veröffentlichten Fassungen.