GV.OV Oversight

Statement

Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction

Guidance

Measure how well the risk management strategy and risk results have helped leaders make decisions and achieve organizational objectives

Guidance

Examine whether cybersecurity risk strategies that impede operations or innovation should be adjusted

Statement

The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks

Guidance

Review audit findings to confirm whether the existing cybersecurity strategy has ensured compliance with internal and external requirements

Guidance

Review the performance oversight of those in cybersecurity-related roles to determine whether policy changes are necessary

Guidance

Review strategy in light of cybersecurity incidents

Statement

Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed

Guidance

Review key performance indicators (KPIs) to ensure that organization-wide policies and procedures achieve objectives

Guidance

Review key risk indicators (KRIs) to identify risks the organization faces, including likelihood and potential impact

Guidance

Collect and communicate metrics on cybersecurity risk management with senior leadership