GV.RM-06 A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated

Statement

A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated

Guidance

Establish criteria for using a quantitative approach to cybersecurity risk analysis, and specify probability and exposure formulas

Guidance

Create and use templates (e.g., a risk register) to document cybersecurity risk information (e.g., risk description, exposure, treatment, and ownership)

Guidance

Establish criteria for risk prioritization at the appropriate levels within the enterprise

Guidance

Use a consistent list of risk categories to support integrating, aggregating, and comparing cybersecurity risks

1. Panoramica

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

3. Regolamentazioni correlate

Ticket collegati

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final