GV.RM-01 Risk management objectives agreed
Setting near-term and long-term cybersecurity risk management objectives that senior leaders agree on, can measure and revisit during strategic planning.
GV.RM Risk management strategy
Risk Management Strategy: objectives, risk appetite and tolerance, ERM integration, response options, communication lines, a standard risk method and positive risks; seven Subcategories.
GV.RM-02 Risk appetite and tolerance statements
Writing risk appetite statements, translating them into measurable risk tolerance statements and refining both as known risk exposure and residual risk change.
GV.RM-03 Cybersecurity risk in enterprise risk management
Bringing cybersecurity risk into enterprise risk management alongside financial, operational, compliance, reputational and safety risks, with criteria for escalating cybersecurity risks.
GV.RM-04 Risk response options set
Strategic direction on which risk responses are acceptable: when to accept or avoid risk for each data classification, whether to buy cybersecurity insurance and when shared responsibility or outsourcing is acceptable.
GV.RM-05 Risk communication lines
How cybersecurity risk information, including supplier and third-party risk, flows between executives, directors and departments such as legal, HR, operations and internal audit.
GV.RM-06 Standard risk calculation method
A consistent method for calculating, documenting, categorizing and prioritizing cybersecurity risk, including quantitative analysis criteria, a risk register template and a shared list of risk categories.
GV.RM-07 Positive risks considered
The one Subcategory about upside risk: characterizing strategic opportunities and weighing them alongside negative risks, for example through SWOT analysis and documented stretch goals.
