GV.RM-07 Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions

Statement

Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions

Guidance

Define and communicate guidance and methods for identifying opportunities and including them in risk discussions (e.g., strengths, weaknesses, opportunities, and threats (SWOT) analysis)

Guidance

Identify stretch goals and document them

Guidance

Calculate, document, and prioritize positive risks alongside negative risks

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Regulations

2. Identified Requirements

3. Related Regulations

Linked Issues

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final