GV.RM-06 A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated

Statement

A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated

Guidance

Establish criteria for using a quantitative approach to cybersecurity risk analysis, and specify probability and exposure formulas

Guidance

Create and use templates (e.g., a risk register) to document cybersecurity risk information (e.g., risk description, exposure, treatment, and ownership)

Guidance

Establish criteria for risk prioritization at the appropriate levels within the enterprise

Guidance

Use a consistent list of risk categories to support integrating, aggregating, and comparing cybersecurity risks

1. Visão geral

1.1 Referências

• 2.1 Risk management framework
• 7.1 For the purpose of Article 21(2), point (f) of Directive (EU) 2022/2555, the relevant entities …

1.2 Requisitos identificados

1.3 Regulamentos relacionados

2. Requisitos identificados

3. Regulamentos relacionados

Pedidos ligados

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final