GV.RM-07 Positive risks considered: evidence and audit

What GV.RM-07 asks for and why upside risk belongs in cybersecurity decisions

If your CSF 2.0 assessment or a customer questionnaire cites GV.RM-07, the Subcategory asks your organization to identify strategic opportunities, which NIST calls positive risks, and to bring them into cybersecurity risk discussions alongside the negative risks you already track. It sits in the Risk Management Strategy (GV.RM) Category under the GOVERN Function, and NIST added it in CSF 2.0, so many programs built on CSF 1.1 have no existing practice to point to. The outcome is stated in terms of what must happen, not how, so your organization decides the method and records how it works.

The difficulty in practice is that security teams usually log only threats. Risk registers, vulnerability backlogs and incident reviews are built to capture what could go wrong, so opportunities such as a new product line that depends on a stronger security posture, a market that opens once a certification is held, or a cloud migration that would retire legacy systems rarely appear as entries anyone reviews. GV.RM-07 asks leaders to close that gap. NIST's Implementation Examples for this Subcategory point to methods such as SWOT analysis to identify opportunities, documented stretch goals, and calculating and prioritizing positive risks next to negative ones. Confirm with your own leadership which of these fits your planning cycle before you adopt any of them.

A practical first step is to decide where positive risks will be recorded, who reviews them, and how they are compared with the threats in your risk register. Ask your risk owner to keep a short, dated list of opportunities with the decision each one informs, and to show that the list was reviewed when cybersecurity priorities were set. An assessor will look for that trail rather than a particular template. Be clear about who owns this work: the organization owns its risk decisions, and an implementation partner can help design the record, but neither can attest to the outcome. Independent assessors test whether the practice exists and operates.

Which strategic opportunities and decisions fall in scope for GV.RM-07

GV.RM-07 asks that strategic opportunities be characterized and weighed alongside negative risks. Six scoping decisions determine how much work that involves and which discussions it reaches. Each choice should be written down before the first opportunity is reviewed, because the output only has value if the same boundaries apply every planning cycle.

Business initiatives that count

Decide which kinds of initiatives enter the review: new products, cloud migrations, market expansion into new jurisdictions, and security-enabled sales such as offering a certified or hardened service to customers. Initiatives that change the attack surface, data flows or regulatory exposure are the strongest candidates. Check whether a threshold, such as spend, customer count or data sensitivity, is needed so that small changes do not swamp the process. Record the threshold and the reason for it so auditors can see that the boundary was a deliberate choice.

Teams that contribute

Opportunities are usually sponsored by strategy, product or business units, but the cybersecurity view depends on security staff and finance. Strategy and product explain the expected benefit, finance estimates value and cost, and security describes how the initiative changes exposure and what controls it needs. Name an accountable owner for each contribution so that no analysis is skipped because it belongs to nobody. Confirm who can challenge an opportunity case and who approves the final characterization.

Risk register and planning inputs

Decide where the output lands. Characterized opportunities can feed the cybersecurity risk register as positive entries, sit beside negative risks in risk review packs, or inform the annual cybersecurity strategy and budget cycle. Each destination implies a different format and cadence. Confirm that the register template can hold an opportunity without distorting the totals used for negative risk, and that the planning calendar gives opportunity review a fixed slot rather than an ad hoc one.

Third-party and supplier opportunities

Decide whether opportunities that come from suppliers, managed service providers or cloud platforms are in scope. Examples include a vendor offering a consolidated security platform, a move to a provider with stronger resilience, or a partnership that opens a new market. These cases often carry dependency risk that the organization must weigh against the benefit. Ask whether supplier-driven proposals go through the same characterization steps as internal ones, and who reviews the supplier's own security posture before the opportunity is accepted.

Stretch goals and improvement targets

Decide whether stretch goals, such as moving to a higher maturity level or cutting response times below current service commitments, count as opportunities to be weighed. Including them connects GV.RM-07 to the target state set in planning. Excluding them keeps the scope narrower but may leave ambitious security targets without a documented trade-off against risk. Whichever choice is made, record the target, the assumptions behind it and the negative risks it may create.

Outcome and decision rights

The outcome of GV.RM-07 is that opportunities enter cybersecurity risk discussions with a documented characterization, not that every opportunity is pursued. Decide who may approve, defer or decline an opportunity, and whether that decision sits with executives or the board. Keep the decision separate from the risk characterization so that the record shows what security considered, even when the business chose otherwise. Confirm the decision record is kept with the initiative file.

How an assessor tests that positive risks are considered

This table compares what an assessor does, what records they ask for, and where GV.RM-07 usually fails when opportunities are weighed. Read each row as a step in the test: the approach shows the questions asked, the evidence shows what must exist, and the findings show what typically goes wrong. Assessors test the outcome through records and do not require a specific method, so the strongest position is a documented trail from opportunity to decision.

Test element	What the assessor does or checks	Common finding
Executive and risk function interviews	Asks how leaders identify strategic opportunities, who judges them, and how they reach cybersecurity risk discussions. Compares answers across the executive team and the risk function.	Leaders describe opportunities confidently, but the risk function cannot name one that was recorded.
Sampling of strategy and planning records	Selects recent strategy, roadmap or planning documents and checks whether opportunities are named, described and linked to cybersecurity outcomes, such as a stretch goal or a SWOT entry.	Opportunities are discussed only in informal meetings or slide decks with no owner, date or decision.
Review of scoring and prioritization	Checks whether opportunities are scored or ranked on the same basis as negative risks, and whether trade-offs between the two are visible in the record.	No link to negative risk decisions: opportunities are scored in a separate exercise that never affects the risk register or budget.
Tracing an opportunity forward	Picks one documented opportunity and follows it into the risk register, decision minutes, or a funded initiative. Confirms the decision was made by the accountable owner.	The trail stops at the planning document, so the assessor cannot confirm that any opportunity influenced a decision.
Currency of planning records	Checks the dates on opportunity records and whether they were reviewed when strategy or threat conditions changed.	Stale planning records that still describe opportunities the organization has already pursued, dropped or overtaken.
Evidence requested	Strategy or planning documents, SWOT or opportunity registers, stretch goal statements, risk register extracts, decision minutes and review records with dates.	Evidence exists for one planning cycle only, or the owner of the record cannot be identified.
Method neutrality	Accepts any consistent method that produces the outcome, such as SWOT analysis, a structured opportunity log, or documented stretch goals. The assessor tests the records, not the technique.	Organizations adopt a method but do not apply it, so the records show a template with blank entries.

Implementing positive risk characterization in six steps

This sequence turns GV.RM-07 from a statement of intent into a working practice, so leaders see strategic opportunities weighed in the same prioritization as negative cybersecurity risks and can trace each decision back to a documented choice.

Agree a working definition of positive risk
Senior leaders, with the CISO and a business owner from strategy or finance, agree in writing what counts as a positive cybersecurity risk in your organization: for example, a security capability that enables a new product line, a faster customer onboarding path, or a market entry that depends on a specific control posture. The output is a short definition memo that states the scope, the decision owner and the vocabulary used in risk registers. The step is done when leaders have signed off the memo and it is filed with the risk management strategy.
Collect strategic objectives and initiatives
The risk function gathers the current strategic plan, business objectives, and planned initiatives from each business unit, along with the cybersecurity objectives already agreed under GV.RM-01. Each objective is recorded with its owner, its time horizon and the systems, data or suppliers it depends on. The output is a single objectives inventory that links business goals to the technology they rely on. The step is complete when every objective has a named owner and the inventory has been reviewed by the business units that submitted it.
Run a structured opportunity analysis
Working sessions with the owners of each objective apply a structured method such as a SWOT analysis to surface opportunities, and convert ambitious goals into documented stretch goals with clear success measures. NIST's Implementation Examples for GV.RM-07 describe these approaches as ways to identify opportunities. Facilitators record each opportunity in plain language, note who proposed it and which objective it supports. The output is an opportunity list. The step is complete when each objective has been examined and the list has been checked against the inventory for gaps.
Characterize each opportunity
For every item on the opportunity list, the risk team records an estimated likelihood that the opportunity materializes, the expected benefit to the organization, and the security controls it depends on, such as identity controls for a partner integration or data protection for a new analytics service. Where a benefit can be expressed in money, time or customer outcomes, the owner states the basis for the estimate. The output is a characterized opportunity register with the same fields a negative risk entry would carry. The step is done when every opportunity has a stated dependency list and a named owner.
Weigh opportunities alongside negative risks
The characterized opportunities are placed in the same prioritization exercise as the negative risks produced under GV.RM-06, using one agreed scoring method and one set of criteria. This shows, for example, where a security investment that unlocks an opportunity competes with a control gap for the same budget or staff time. The output is a combined ranked register that lists both positive and negative items and records the reasoning behind each ranking. The step is complete when leadership has reviewed the ranking and the scoring method has been applied consistently to both types of entry.
Record decisions and review them each planning cycle
Leaders decide which opportunities to pursue, defer or decline, and record the decision, the accepted dependencies and the conditions that would trigger a re-review. The record is linked to the risk register and to the communication channels described under GV.RM-05 so that directors and affected departments see the same information. At each planning cycle, the risk team checks whether the likelihood, benefit and dependencies still hold. The output is a decision log with dated review notes. The step is ongoing, and it is working when decisions can be traced to the evidence that supported them.

Which records show that positive risks were weighed

An assessor looking at GV.RM-07 will want to see that opportunities were defined, written down, and weighed against negative risks in decisions the organization actually made. The cards below cover the records that together show this, and the upkeep needed so they stay current between assessments.

Documented definition of positive risk

A short policy or standard that says what the organization means by a positive risk, which strategic opportunities it tracks, and who may propose one. Without a written definition, opportunity entries tend to be inconsistent across teams and hard to compare with negative risks. Check that the definition names the owner, states how opportunities relate to the cybersecurity risk method used for threats, and is dated and approved by the leaders who own risk appetite.

SWOT and stretch-goal worksheets

Completed worksheets from a strengths, weaknesses, opportunities and threats exercise, or a list of stretch goals with the reasoning behind each. NIST's Implementation Examples for GV.RM-07 name SWOT analysis and documented stretch goals as methods for identifying opportunities. Check that each worksheet is linked to a business objective, names the participants, and records which opportunities were carried forward into the risk register rather than left as brainstorm notes.

Opportunity entries in the risk register

Register entries for opportunities that use the same fields as negative risks: description, owner, likelihood, impact, current treatment, target state, and review date. Using identical fields lets leaders weigh both kinds of risk on one scale. Check that opportunity entries are not held in a separate spreadsheet, that each one has a named owner, and that closed opportunities record the outcome, not just the status.

Planning and board minutes on trade-offs

Minutes from strategy, planning or board sessions where an opportunity was weighed against a cybersecurity risk, such as adopting a new platform that speeds delivery but expands the attack surface. This is the record that shows the trade-off was discussed by decision makers. The minutes should state the options considered, the decision taken, and who accepted any residual risk. Illustrative example: a minutes entry approving a faster release model with a named condition for security testing before launch.

Review log and dated versions

A log showing when the positive risk definition, worksheets and register entries were reviewed, by whom, and what changed. Keep each document as a dated version with owner sign-off, so an assessor can see the state of the record at any point in the period. Check that reviews happen on a schedule the organization sets itself, that superseded versions are retained, and that sign-off is recorded in the tool or document system rather than in an email thread.

Self-hosted GRC tool for the records

A self-hosted governance, risk and compliance tool can hold the definition, register entries, review dates and framework mappings in one place. CISO Assistant is an AGPL-3.0-only open-source option that ships NIST CSF among more than 200 frameworks and runs assessments against them. Confirm in your own environment whether it supports the opportunity fields, approval workflow and versioning you need, and whether its licence terms suit your use before adopting it.

What considering positive risks costs in time, tools and review

This table lists the cost components of running GV.RM-07 positive risk work, who is paid for each, whether it is one-time or recurring, and what drives it up or down. No dollar figures or durations are supplied for this work, so use the drivers and quote requests in the right-hand columns to compare written proposals. The main takeaway is that most of the recurring cost comes from people's time, not software.

Cost component	Who is paid or who spends time	One-time or recurring	Drivers and what to request in a quote
Strategy and leadership time for workshops	Executives and senior leaders in internal workshops, plus any facilitator the organization hires	One-time to set up, then recurring each planning cycle	Number of initiatives and planning cycle frequency. Request the expected workshop count, attendees and facilitator role in writing.
Analyst time to characterize opportunities	Internal risk or strategy analysts, or an implementation partner preparing SWOT and stretch-goal documentation	Recurring	Number of business units and initiatives. Request the analyst hours assumed per initiative and who owns the final register entries.
Register and tooling	Internal staff to configure the register; licence spend if a commercial GRC product is chosen	One-time setup, recurring hosting and upkeep	CISO Assistant is open source under AGPL-3.0-only, so licence spend can be removed if it is self-hosted. Request the hosting, backup and upgrade effort and whether the quote includes licences.
Ongoing review effort	Risk owners and the cybersecurity governance function reviewing positive and negative risks together	Recurring	Review frequency and how many risks are tracked. Request the review cadence and how positive risks are kept distinct in reporting.
External review or assessment fees	An independent assessor or consultant if the organization asks for outside review of its opportunity analysis	Recurring when used, often tied to a review cycle	Scope of the review and whether it covers only GV.RM-07 or wider governance. NIST does not offer certification for CSF work, so request a written scope that says what the reviewer will and will not test.

Who owns GV.RM-07, what a partner prepares, and where the auditor stops

Your organization owns GV.RM-07 in full. Leadership decides what counts as a positive risk for cybersecurity, which strategic opportunities are pursued, and which are set aside, and it accepts the resulting register and its trade-offs. The people who carry the decision are the ones who answer for it when a board, customer or assessor asks why an opportunity was taken or declined.

Definition: Senior leaders agree what a positive cybersecurity risk means for the business, such as a secure product launch or a faster entry into a regulated market.
Opportunity decisions: Named executives decide which opportunities proceed, with the negative risks that come with them recorded alongside.
Stretch goals: Leaders approve and document any stretch goals and the criteria for revisiting them.
Register acceptance: The accountable executive signs off on the positive risk register and reviews it at a set cadence.
Inputs: Business owners supply the SWOT or equivalent analysis and the context behind each entry.

Before any assessment, confirm that the decision owners are named in writing and that their approvals are dated and retained.

Where organizations fall short on positive risk and how to close each gap

GV.RM-07 asks organizations to characterize strategic opportunities and weigh them alongside negative risks. The gaps below show up repeatedly when teams try to evidence that practice, and each one can be closed with a specific, reviewable step.

Opportunities missing from the risk register

Most cybersecurity risk registers list only threats and weaknesses, so a planned security investment that could open a new market or shorten a customer onboarding cycle never appears where leaders look for it. Start by adding an opportunity type or flag to the register and recording at least one strategic opportunity per planning cycle, with a short statement of the upside and the security conditions that must hold for it to be realized. Check that the register can be filtered by this flag, because an assessor will ask how opportunities are distinguished from negative risks in the same record set.

No shared scoring with negative risks

When opportunities are scored with a different scale or never scored at all, leaders cannot compare a delayed product launch against a likely data exposure in the same discussion. Use the same likelihood and impact scale for both kinds of risk, with a defined sign or label that shows direction, and apply the organization's standard risk calculation method to each entry. Confirm with the risk owner that the scale has been agreed in writing before the first joint review, and document any adjustments made for opportunities.

Planning records that never mention security trade-offs

Product roadmaps, merger plans and market entry memos often describe business gains without noting the cybersecurity cost or the controls that would need to change. Add a mandatory security trade-off section to the planning template that asks which negative risks the opportunity increases, which controls it depends on and who accepted the residual exposure. Sample a few recent planning records and confirm that each one links back to a risk entry and a decision owner.

No owner for opportunity reviews

Opportunities tend to be discussed once at kickoff and then forgotten, so no one checks whether the expected upside was realized or whether the security conditions still hold. Assign a named executive owner for the opportunity review, set a review cadence in the governance calendar and define what triggers an early review, such as a change in market conditions or a new regulatory requirement. Ask the owner to show the last review minutes and the status of each open opportunity during an assessment.

Evidence that exists only in slides

Strategy decks often mention stretch goals and SWOT findings, but the slides are rarely version controlled, dated or traceable to decisions, so they do not show that positive risks were actually considered. Store SWOT outputs, stretch goal definitions and opportunity scoring in the same governed repository as the risk register, with dates, authors and approvals. Ask whether an assessor could pick one opportunity and follow it from identification to scoring, decision and review using only documents that the organization retains.

Common questions about GV.RM-07 cost, effort and audit testing

How much effort does GV.RM-07 take to meet?

The effort depends on how many strategic opportunities the organization already tracks and how well they are written down. Most of the work is a one-time characterization exercise, followed by a recurring review when strategy changes. The main drivers are the number of business units involved, whether stretch goals already exist in planning documents, and whether opportunities are linked to cybersecurity risk decisions today. No published figure applies here, so ask any provider to base its estimate on a written scope listing the planning documents, workshops and review cycles included. Fixed-scope quotes make the effort visible before work starts.

Can we meet GV.RM-07 in-house?

Yes, in most organizations the core work can be done internally, because it depends on leadership's strategy knowledge more than on specialist tooling. Internal staff usually own the outcome: identifying opportunities, documenting stretch goals and agreeing how they weigh against negative cybersecurity risks. An outside implementation partner can help with structure, facilitation, templates and evidence packaging, but it cannot decide the organization's strategy. The organization owns the outcome, and only an independent auditor or assessor can test whether it is met.

What evidence does an assessor accept for GV.RM-07?

An assessor usually looks for records showing that positive risks were identified, characterized and discussed alongside negative risks. Useful evidence includes dated strategy or planning documents that name cybersecurity-relevant opportunities, risk register entries or meeting minutes where opportunities were weighed, and documented stretch goals with owners. Assessors also check that the records are current and that leadership actually used them. Confirm the expected evidence set with your chosen auditor before work begins, because each assessment engagement sets its own sampling and testing approach.

Is a SWOT analysis required for GV.RM-07?

No, a SWOT analysis is not required. NIST lists SWOT analysis as one example method for identifying opportunities in its Implementation Examples for GV.RM-07, alongside documenting stretch goals and calculating and prioritizing positive risks. Organizations can choose any method that produces a clear, documented view of strategic opportunities and how they compare with negative risks. What matters to an assessor is that the method is consistent, the results are recorded and the outputs inform cybersecurity risk discussions.

How does GV.RM-07 relate to GV.RM-06 and GV.RM-03?

GV.RM-07 covers the upside side of risk, while GV.RM-06 and GV.RM-03 cover how risk is measured and escalated. GV.RM-06 sets a standard method for calculating, documenting and prioritizing cybersecurity risk, and that method can also hold positive risks so both sides are scored the same way. GV.RM-03 brings cybersecurity risk into enterprise risk management, where opportunities are often already weighed against financial and operational risks. Teams usually get the most value by designing these three subcategories together, so one register and one set of criteria serve all of them.

Does NIST certify compliance with GV.RM-07?

No, NIST does not certify compliance with GV.RM-07 or any other part of the CSF. NIST states that it does not offer certifications or endorsements of CSF-related products, implementations or services, and it has no plans for a conformity assessment program. The CSF is voluntary for most organizations, so any evidence of alignment is judged by the customer, regulator or independent assessor who requested it. Ask the requesting party which form of assurance it accepts before deciding on the level of independent review.

What does GV.RM-07 need from leadership?

GV.RM-07 needs senior leaders to name the strategic goals they expect the organization to pursue and to accept that cybersecurity can enable or constrain them. Leaders typically sponsor the exercise, approve the stretch goals, and take part in the discussions where positive and negative risks are weighed. Without that sponsorship, the records tend to become a list of IT wishes rather than a strategy input. Plan for a small number of recurring leadership reviews, and confirm the decision rights and sign-off steps in the written scope before the engagement starts.

How DeployOpen scopes and prepares evidence for GV.RM-07

DeployOpen works on GV.RM-07 by agreeing a written scope with your team, then preparing the records that show strategic opportunities are characterized and weighed alongside negative risks. We prepare systems and evidence; your organization owns the risk decisions, and an independent assessor reaches any conclusion about conformance.

How we scope

Confirm which strategic plans, business units and cybersecurity decisions fall inside the GV.RM-07 review.
Agree which opportunity methods you use, such as SWOT analysis, stretch goals or positive risk scoring.
Record scope, deliverables and timelines in writing before work starts, since engagements are fixed-scope.

How we build

Set up a register or template that holds opportunities next to negative risks in the same review cycle.
Document how a positive risk is characterized, scored and prioritized against your existing risk method.
Test the workflow with your risk owners so the records reflect how decisions are actually made.

How we hand over

Deliver the documented method, sample records and decision logs needed to show GV.RM-07 is operating.
Map each artifact to the GV.RM-07 Implementation Examples so your internal reviewers can trace it.
Walk your team through the evidence so they can maintain it without ongoing DeployOpen involvement.

How we support

Ongoing support, upgrades and reviews of the GV.RM-07 records are available as a retainer.
Retainer scope is agreed in writing and can be adjusted as strategy and risk appetite change.
Confirm with your independent assessor which evidence formats they accept before the records are finalized.