GV.RR-01 Leadership accountability and culture
Leadership's own responsibility and accountability for cybersecurity risk and for a risk-aware, ethical and continually improving culture, including directing the CISO to keep the risk strategy current.
GV.RR Roles, responsibilities and authorities
Roles, Responsibilities, and Authorities: leadership accountability, defined cybersecurity roles, adequate resources and cybersecurity in HR practices; four Subcategories.
GV.RR-02 Roles and responsibilities defined
Documenting and enforcing who is responsible and accountable for cybersecurity risk management activities, through policy, responsibility assignments, position descriptions and performance goals.
GV.RR-03 Adequate resources allocated
Allocating people, process and technology resources in line with the risk strategy and risk tolerance, and confirming through management reviews that responsible staff have the authority they need.
GV.RR-04 Cybersecurity in HR practices
Building cybersecurity into human resources: screening, onboarding, role changes, offboarding, background checks for sensitive roles and personnel obligations to follow security policy.
