+GV GOVERN
---+GV.OC Organizational Context
------+GV.OC-01 The organizational mission is understood and informs cybersecurity risk management
------+GV.OC-02 Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and …
------+GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and …
------+GV.OC-04 Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated
------+GV.OC-05 Outcomes, capabilities, and services that the organization depends on are understood and communicated
---+GV.OV Oversight
------+GV.OV-01 Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction
------+GV.OV-02 The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks
------+GV.OV-03 Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed
---+GV.PO Policy
------+GV.PO-01 Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated …
------+GV.PO-02 Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and …
---+GV.RM Risk Management Strategy
------+GV.RM-01 Risk management objectives are established and agreed to by organizational stakeholders
------+GV.RM-02 Risk appetite and risk tolerance statements are established, communicated, and maintained
------+GV.RM-03 Cybersecurity risk management activities and outcomes are included in enterprise risk management processes
------+GV.RM-04 Strategic direction that describes appropriate risk response options is established and communicated
------+GV.RM-05 Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties
------+GV.RM-06 A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated
------+GV.RM-07 Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions
---+GV.RR Roles, Responsibilities, and Authorities
------+GV.RR-01 Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually …
------+GV.RR-02 Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced
------+GV.RR-03 Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies
------+GV.RR-04 Cybersecurity is included in human resources practices
---+GV.SC Cybersecurity Supply Chain Risk Management
------+GV.SC-01 A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational …
------+GV.SC-02 Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and …
------+GV.SC-03 Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes
------+GV.SC-04 Suppliers are known and prioritized by criticality
------+GV.SC-05 Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of …
------+GV.SC-06 Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships
------+GV.SC-07 The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, …
------+GV.SC-08 Relevant suppliers and other third parties are included in incident planning, response, and recovery activities
------+GV.SC-09 Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored …
------+GV.SC-10 Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service …

GV GOVERN

GOVERN

The organization's cybersecurity risk management strategy, expectations, and policy are established, communicated, and monitored

1. Pregled

Naslov Standard
GV.OC Organizational Context

Statement

The circumstances - mission, stakeholder expectations, dependencies, and legal, regulatory, and contractual requirements - surrounding the organization's cybersecurity risk management decisions are understood

GV.OV Oversight

Statement

Results of organization-wide cybersecurity risk management activities and performance are used to inform, improve, and adjust the risk management strategy

GV.PO Policy

Statement

Organizational cybersecurity policy is established, communicated, and enforced

GV.RM Risk Management Strategy

Statement

The organization's priorities, constraints, risk tolerance and appetite statements, and assumptions are established, communicated, and used to support operational risk decisions

GV.RR Roles, Responsibilities, and Authorities

Statement

Cybersecurity roles, responsibilities, and authorities to foster accountability, performance assessment, and continuous improvement are established and communicated

GV.SC Cybersecurity Supply Chain Risk Management

Statement

Cyber supply chain risk management processes are identified, established, managed, monitored, and improved by organizational stakeholders

1.1 Sklici

1.2 Ugotovljene zahteve

1.3 Povezani predpisi

2. Ugotovljene zahteve

Zahteve
Vir Zahteva

3. Povezani predpisi

Predpisi
Vir Regulativa

Povezane zadeve

  • NIST -

    EN: Publications of the National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, from their electronic versions (OSCAL; SP 800-63-4 from its HTML version, https://pages.nist.gov/800-63-4/). Works of NIST employees are not subject to copyright protection in the United States (17 U.S.C. § 105); the OSCAL content is dedicated to the public domain worldwide (CC0 1.0); outside the United States NIST grants the right to reprint its technical series publications in all formats (NIST copyright statement). Republished courtesy of the National Institute of Standards and Technology; each document names its citation. Divided into sections and converted into the GRCA format, the wording unchanged. Only the versions published by NIST are authoritative.

    DE: Veröffentlichungen des National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, aus ihren elektronischen Fassungen (OSCAL; SP 800-63-4 aus ihrer HTML-Fassung, https://pages.nist.gov/800-63-4/). Werke von NIST-Beschäftigten sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105); die OSCAL-Inhalte sind weltweit gemeinfrei gestellt (CC0 1.0); außerhalb der USA räumt das NIST das Recht ein, seine Technical-Series-Publikationen in allen Formaten neu zu veröffentlichen (Copyright-Hinweis des NIST). „Republished courtesy of the National Institute of Standards and Technology“; jedes Dokument nennt seine Zitierangabe. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert. Maßgeblich sind allein die vom NIST veröffentlichten Fassungen.