GV.OV-01 Strategy outcomes reviewed
Reviewing whether the cybersecurity risk management strategy actually helped leaders decide and meet objectives, and adjusting strategies that impede operations or innovation.

Oversight: reviewing strategy outcomes, strategy coverage and risk management performance so leaders can adjust direction; three Subcategories, all new in CSF 2.0.
Reviewing whether the cybersecurity risk management strategy actually helped leaders decide and meet objectives, and adjusting strategies that impede operations or innovation.
Checking that the strategy covers the organization's requirements and risks, using audit findings, oversight of people in cybersecurity roles and lessons from incidents.
Measuring cybersecurity risk management performance with key performance indicators and key risk indicators, and reporting metrics to senior leadership.

Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.