GV.RM Risk Management Strategy

Statement

Risk management objectives are established and agreed to by organizational stakeholders

Guidance

Update near-term and long-term cybersecurity risk management objectives as part of annual strategic planning and when major changes occur

Guidance

Establish measurable objectives for cybersecurity risk management (e.g., manage the quality of user training, ensure adequate risk protection for industrial control systems)

Guidance

Senior leaders agree about cybersecurity objectives and use them for measuring and managing risk and performance

Statement

Risk appetite and risk tolerance statements are established, communicated, and maintained

Guidance

Determine and communicate risk appetite statements that convey expectations about the appropriate level of risk for the organization

Guidance

Translate risk appetite statements into specific, measurable, and broadly understandable risk tolerance statements

Guidance

Refine organizational objectives and risk appetite periodically based on known risk exposure and residual risk

Statement

Cybersecurity risk management activities and outcomes are included in enterprise risk management processes

Guidance

Aggregate and manage cybersecurity risks alongside other enterprise risks (e.g., compliance, financial, operational, regulatory, reputational, safety)

Guidance

Include cybersecurity risk managers in enterprise risk management planning

Guidance

Establish criteria for escalating cybersecurity risks within enterprise risk management

Statement

Strategic direction that describes appropriate risk response options is established and communicated

Guidance

Specify criteria for accepting and avoiding cybersecurity risk for various classifications of data

Guidance

Determine whether to purchase cybersecurity insurance

Guidance

Document conditions under which shared responsibility models are acceptable (e.g., outsourcing certain cybersecurity functions, having a third party perform financial transactions on behalf of the organization, using public cloud-based services)

Statement

Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties

Guidance

Determine how to update senior executives, directors, and management on the organization's cybersecurity posture at agreed-upon intervals

Guidance

Identify how all departments across the organization - such as management, operations, internal auditors, legal, acquisition, physical security, and HR - will communicate with each other about cybersecurity risks

Statement

A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated

Guidance

Establish criteria for using a quantitative approach to cybersecurity risk analysis, and specify probability and exposure formulas

Guidance

Create and use templates (e.g., a risk register) to document cybersecurity risk information (e.g., risk description, exposure, treatment, and ownership)

Guidance

Establish criteria for risk prioritization at the appropriate levels within the enterprise

Guidance

Use a consistent list of risk categories to support integrating, aggregating, and comparing cybersecurity risks

Statement

Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions

Guidance

Define and communicate guidance and methods for identifying opportunities and including them in risk discussions (e.g., strengths, weaknesses, opportunities, and threats (SWOT) analysis)

Guidance

Identify stretch goals and document them

Guidance

Calculate, document, and prioritize positive risks alongside negative risks