GV.RR Roles, Responsibilities, and Authorities

Statement

Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving

Guidance

Leaders (e.g., directors) agree on their roles and responsibilities in developing, implementing, and assessing the organization's cybersecurity strategy

Guidance

Share leaders' expectations regarding a secure and ethical culture, especially when current events present the opportunity to highlight positive or negative examples of cybersecurity risk management

Guidance

Leaders direct the CISO to maintain a comprehensive cybersecurity risk strategy and review and update it at least annually and after major events

Guidance

Conduct reviews to ensure adequate authority and coordination among those responsible for managing cybersecurity risk

Statement

Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced

Guidance

Document risk management roles and responsibilities in policy

Guidance

Document who is responsible and accountable for cybersecurity risk management activities and how those teams and individuals are to be consulted and informed

Guidance

Include cybersecurity responsibilities and performance requirements in personnel descriptions

Guidance

Document performance goals for personnel with cybersecurity risk management responsibilities, and periodically measure performance to identify areas for improvement

Guidance

Clearly articulate cybersecurity responsibilities within operations, risk functions, and internal audit functions

Statement

Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies

Guidance

Conduct periodic management reviews to ensure that those given cybersecurity risk management responsibilities have the necessary authority

Guidance

Identify resource allocation and investment in line with risk tolerance and response

Guidance

Provide adequate and sufficient people, process, and technical resources to support the cybersecurity strategy

Statement

Cybersecurity is included in human resources practices

Guidance

Integrate cybersecurity risk management considerations into human resources processes (e.g., personnel screening, onboarding, change notification, offboarding)

Guidance

Consider cybersecurity knowledge to be a positive factor in hiring, training, and retention decisions

Guidance

Conduct background checks prior to onboarding new personnel for sensitive roles, and periodically repeat background checks for personnel with such roles

Guidance

Define and enforce obligations for personnel to be aware of, adhere to, and uphold security policies as they relate to their roles