GV.RR-01 Leadership accountability: requirements and evidence

What GV.RR-01 asks leaders to own, and why it is hard to evidence

GV.RR-01 asks organizational leaders to be responsible and accountable for cybersecurity risk, and to promote a culture that is risk-aware, ethical and continually improving. In practice, the CISO or compliance lead must show that the executive team owns the cybersecurity risk decision rather than delegating it entirely to the security function. Under the Govern Function added in CSF 2.0, this Subcategory sits in the Roles, Responsibilities, and Authorities Category, and NIST's Implementation Examples point to concrete leadership actions: leaders agreeing on their roles in the cybersecurity strategy, sharing expectations for a secure and ethical culture, and directing the CISO to review the risk strategy at least annually and after major events. The outcome is the leadership commitment itself, which is why it is easy to describe and hard to demonstrate.

GV.RR-01 is new in CSF 2.0. NIST's CSF 1.1 to 2.0 Core Transition Changes spreadsheet shows that its topic was not clearly present in any CSF 1.1 Category or Subcategory, so organizations that assessed against version 1.1 have no existing row to map their current evidence to. Leadership responsibility was implied in older programs, usually through executive sponsorship of an information security policy, but it was rarely stated as a separate outcome. Anyone moving an assessment forward should confirm the transition spreadsheet and the current Reference Tool entry before they build a baseline, because the Implementation Examples and informative references are updated separately from the framework document.

Leadership accountability is hard to prove with documents alone because a signed policy shows intent, not behavior. An assessor will look for a record that the CISO was directed to review the risk strategy, a dated decision in which executives accepted or rejected a risk, the minutes of board or committee discussions where cybersecurity risk was weighed against business objectives, and evidence that the review happened after a significant incident or change. Culture is harder still. Ask your leaders which records would show that they encouraged people to report near misses, and whether those records exist outside the security team. Confirm with your own assessor what sufficient evidence looks like for your organization before you assemble a file, since the framework does not define a minimum.

Which leaders, forums and records fall under GV.RR-01

GV.RR-01 places cybersecurity accountability on leadership, but the people who count as leadership depend on how the organization is governed. The cards below separate the executive, board, CISO, business and third-party roles, then flag the scoping choices that change how much evidence you need to keep.

Executive leadership team

The senior executives who set strategy and allocate budget are the first group GV.RR-01 reaches. Their accountability for cybersecurity risk should appear in their charters, objectives or meeting minutes, not only in the security policy. Check whether each executive has agreed in writing how cybersecurity fits their remit, since that agreement is the evidence an assessor will ask to see first.

Board or risk committee

The board or a delegated risk committee oversees whether leadership is managing cybersecurity risk well. Minutes should show that directors receive risk reporting, ask questions and direct follow-up. Confirm whether the committee's terms of reference name cybersecurity explicitly, because a generic risk remit may leave gaps an auditor can point to.

CISO reporting line

GV.RR-01 expects leaders to direct the CISO to keep the risk strategy current, so the reporting line matters. Record who the CISO reports to, how often they meet, and whether the CISO can escalate directly to the board or committee. A CISO who reports only to IT may make the direction in the subcategory hard to demonstrate.

Business unit heads who own risk

Heads of business units often own the systems, customer data and processes that carry most of the cybersecurity risk. Identify which heads hold risk acceptance authority, then confirm they have signed up to the strategy and the culture expectations. Their named ownership in the risk register is strong evidence that leadership accountability reaches beyond the security function.

Third parties with delegated authority

Managed service providers and outsourced security teams are in scope only where an organization's leaders delegate authority to them, such as approving risk acceptances or setting security standards. Where that delegation exists, the written terms should say what the third party may decide and how the organization's leaders keep oversight. Where no authority is delegated, the provider's contract is a supply chain matter rather than a GV.RR-01 record.

Group and subsidiary leadership

Scoping decides whether the group, each subsidiary or both must keep leadership records. Ask whether subsidiary boards hold their own cybersecurity authority and whether group leaders set the strategy they follow. Where a single leader holds several roles in a small business, the same person's records can serve more than one role, but the file should still show each role separately.

How an assessor tests leadership accountability

This table sets out what an assessor typically does, what evidence they request and where GV.RR-01 findings tend to appear. Read each row as a test step paired with the proof leadership should be ready to produce, since a statement of intent without records of follow-through is the most common gap.

Test area	What the assessor does	Evidence to have ready	Common finding
Executive interviews	Asks senior leaders to describe their own role in cybersecurity risk decisions and how they set expectations for a risk-aware culture.	Named executive owners for cybersecurity risk, and a short written account of how each one oversees it.	Leaders describe security as an IT matter and cannot name their own accountability.
Governance records	Reviews board and executive committee minutes, charters and agendas for cybersecurity items over the review period.	Charters that assign cybersecurity oversight, minutes showing discussion and decisions, and action logs.	Charters mention cybersecurity, but no meeting records show leaders discussing risk.
Risk strategy and review dates	Checks that the risk strategy exists, names an approver and shows dated reviews by leadership.	Current risk strategy with version history, approval records and the date of each leadership review.	The strategy was approved once and never reviewed by leadership since.
Direction to the CISO	Looks for evidence that leaders directed the CISO to review the risk strategy at least annually and after major events.	Written direction or minutes setting the review cycle, and records of reviews after incidents or major changes.	No documented direction, or reviews happen only when the CISO chooses to start them.
Event-driven review	Compares significant incidents and major business or technology changes against the record of strategy reviews that followed.	Incident post-review summaries linked to strategy review minutes or updated risk decisions.	A serious incident occurred, but no leadership review or strategy update is recorded afterward.
Culture communications	Samples leadership messages, town halls, onboarding material and intranet content about security and ethics.	Dated communications from leaders, with the audience and the message on secure and ethical conduct.	Culture statements exist, but no follow-through shows how they affect decisions or behavior.
Follow-through on culture	Checks whether leaders acted on culture signals such as reported concerns, training results or policy exceptions.	Records of actions taken after reports, training completion reviews and exception decisions made by leaders.	Messages promise accountability, yet concerns raised by staff have no recorded response.
Authority and coordination	Reviews whether leaders confirmed that the CISO has enough authority and coordination with other functions.	Documented assessments of authority and cross-functional coordination, with any gaps and their remediation.	Authority is assumed, not reviewed, and conflicts between security and business units are not recorded.

Implementing GV.RR-01 in sequence

The sequence moves leadership from agreeing its own role to testing whether authority and coordination are working, and each step leaves a document or record that an assessor can read. Done in order, the steps show that accountability is set by leaders, communicated, directed and checked rather than assumed.

Agree leadership roles in the cybersecurity strategy
Start with the executive team and the board or board committee that oversees risk. Leaders agree in a working session what each of them owns for cybersecurity risk, such as approving the risk strategy, funding decisions and accepting residual risk, and which decisions go to the board. The output is a signed role statement that names each leader's responsibilities and the forums where cybersecurity decisions are made. Confirm the statement is approved in minutes so it can be produced for an assessor or a customer questionnaire.
Set and share expectations for a secure and ethical culture
Once roles are agreed, leaders define what a risk-aware, ethical and continually improving culture looks like in practice, such as reporting incidents without blame, escalating concerns and treating security exceptions as decisions that need approval. They communicate these expectations to managers and staff through a written memo and a short briefing. The output is a communicated expectations memo, with distribution records and a named owner who answers questions. Ask whether managers have restated the memo to their teams, since a memo nobody repeats rarely changes behavior.
Direct the CISO to review the risk strategy
Leadership issues a formal directive to the CISO to review the cybersecurity risk strategy at least annually and after major events such as significant incidents, mergers, new regulatory obligations or major platform changes. The directive sets what the review must cover and who receives the results. The output is a signed directive and a review calendar that lists the annual review and the trigger events, with the reviewer and approver named for each. Keep the directive with the risk strategy so the review cadence is visible to anyone who audits it.
Record each strategy review and its outcome
The CISO carries out each directed review and records what was examined, what changed and which decisions leadership must take. Leadership receives the findings and approves or rejects proposed changes to the risk strategy. The output is a review record with dated minutes, the revised strategy version where changes were approved, and a list of open actions with owners. This record is the evidence that the directive is working, so it should show at least one completed cycle before the sequence is treated as operating.
Review whether authority and coordination are adequate
Leaders periodically test whether the people responsible for cybersecurity have enough authority to act, such as the power to stop a release or require a fix, and whether teams such as IT, legal, HR and business units coordinate well during incidents. They compare the findings with the roles agreed in the first step. The output is a documented adequacy review that lists gaps and the decisions taken to close them, such as changed reporting lines or revised escalation rules. Confirm with your own assessor how often this review should run in your environment, because the reference material does not set a fixed interval.

Evidence that passes GV.RR-01 and how to keep it current

GV.RR-01 is tested through records of what leaders actually did, not through a statement that they care. The cards below cover the artifacts an assessor will ask for and the review calendar and triggers that keep them current between formal assessments.

Board and committee minutes

Minutes that record cybersecurity risk being discussed as a business decision, with named leaders, the risks raised and the decisions taken. An assessor looks for evidence that leadership received risk information and responded to it, so a single line noting that cybersecurity was presented is weak. Check that minutes show questions asked, follow-up owners and dates, and that the same risks reappear until they are closed.

Approved risk strategy versions

The risk strategy must exist as a dated, approved document with a version history showing who approved each change. For GV.RR-01 the key point is that leaders agreed their roles within the strategy, so the approval record should name those leaders. Confirm that the current version is the one the board or executive team actually signed off, and that superseded versions are retained.

CISO directive and its review record

A written directive from leadership that asks the CISO to review the cybersecurity risk strategy, with a stated frequency and triggers. The review record should show when each review happened, what changed, and who accepted the result. Keep the directive itself, the review outputs and the decision log together so an assessor can trace the instruction to the action.

Leadership communications on culture

Messages from executives that set expectations for secure, ethical and continually improving behavior, such as policy announcements, town hall notes or onboarding material. Assessors look for evidence that the messages were delivered and that staff received them, so keep distribution records alongside the text. Check that the messages come from leaders with authority, not only from the security team.

Adequacy review outputs

Results of periodic reviews asking whether leaders' authority and coordination for cybersecurity are sufficient. Useful outputs include the questions reviewed, gaps found, and the actions and owners assigned. A review that finds no gaps still needs a record of what was examined. Confirm the review covers decision rights and escalation paths, not only budget.

Review calendar and out-of-cycle triggers

Evidence stays current only if reviews run on a fixed calendar and are reopened when something material happens. Set an annual review date for the risk strategy and CISO directive, and record a defined list of triggers, such as a significant incident, a major change in business model or a new regulatory obligation. The NIST Subcategory's Implementation Examples point to annual and post-event review, so document both the schedule and each triggered review.

Showing a risk-aware, ethical and improving culture

Culture is the hardest part of GV.RR-01 to evidence, because a culture leaves few formal artifacts. An assessor can read a policy that says leaders promote a risk-aware, ethical and continually improving culture, but the policy alone does not show that anyone acted on it. A reasonable record is built from ordinary management activity: leadership communications that name cybersecurity expectations, dated minutes or messages where executives explain why a security decision was made, and performance discussions where security behavior is treated as part of the job rather than a separate compliance chore. NIST's Small Business Quick-Start Guide (SP 1300, February 2024) suggests that leadership communicate support for this culture, and the same logic scales to larger organizations. Confirm with your own leadership team which channels they already use, because evidence drawn from existing channels is easier to keep current than a special program created for an audit.

Two signals show whether the culture is working. The first is near-miss reporting: a steady flow of reported near misses, misdirected emails, failed phishing tests and unsafe configurations usually means staff trust that raising a problem will not be punished. A quiet log is not automatically good news and may mean people are not reporting. Ask for the number of near-miss reports by quarter, the share that led to a documented change, and any cases where leadership publicly thanked a reporter. The second is how the organization acts on lessons learned. Retrospectives after incidents, exercises or tabletop tests should produce tracked actions with owners and due dates, and leadership should review whether those actions closed. Record decisions that were deliberately not taken, with the reasoning, since an assessor will often ask what the organization chose to accept.

Keep this section separate from two neighboring Subcategories. GV.RR-02 covers the documented assignment of who is responsible and accountable, which lives in policy, responsibility matrices and position descriptions. GV.RR-04 covers HR processes such as screening, onboarding and offboarding. GV.RR-01 is about what leaders say, reward, review and act on. The useful check is whether an assessor could sample a leadership communication, a performance discussion and a lessons-learned action from the last year and trace each to a stated expectation. If the organization cannot produce those three items, the culture is probably real but unevidenced, and that gap is worth closing before an assessment rather than during one. Confirm the review frequency and the reporting path with your governance owner before you define the evidence set.

What meeting GV.RR-01 costs in time, tooling and review

This table breaks down the people, tooling and review costs of meeting GV.RR-01, showing who is paid for each component, whether it is one-time or recurring, and what drives it up or down. Use it to structure a quote request so that leadership time, evidence upkeep and outside review are priced separately. No fee or duration figures are given because none are supplied for this topic.

Cost component	Who carries the cost	One-time or recurring	What drives it
Executive time for strategy and review sessions	Board members and executive team, paid through salary time	Recurring	Number of leaders in scope, frequency of strategy reviews and whether reviews follow major events
CISO and risk team preparation of materials	Internal security and risk staff or an outside facilitator if engaged	Recurring	Breadth of the risk strategy, number of business units and quality of existing risk reporting
Drafting the leadership cybersecurity charter	Internal legal, governance or security staff	One-time, with periodic revision	Whether a charter or equivalent already exists and how many approval layers apply
Minutes, decision logs and document upkeep	Governance or secretariat staff	Recurring	Meeting cadence, number of decisions recorded and retention rules set by the organization
Tooling for evidence storage	Internal IT, or a vendor if a hosted GRC product is licensed	Setup one-time, licenses or hosting recurring	Licensing model, data residency needs and whether a self-hosted open-source GRC platform is used in the organization's own environment
External facilitation or review	Outside consultant or implementation partner under a written scope	Usually one-time for setup, optional recurring for review	Scope agreed in writing, number of sessions and whether the organization prepares its own evidence
Auditor or assessor time	Independent auditor or assessor, who issues any report	Recurring with each assessment cycle	Assessment scope, how many business units are sampled and the quality of prepared evidence

Who owns leadership accountability, and what a partner can prepare

GV.RR-01 asks that organizational leaders be responsible and accountable for cybersecurity risk and that they promote a risk-aware, ethical and continually improving culture. That accountability cannot be delegated to a vendor or consultant. Executives decide the risk strategy, set risk appetite, agree on their own roles in it and direct the CISO to review the strategy at least annually and after major events. The CISO runs the program day to day, but the people who sign off on strategy and resourcing are the executives themselves.

Strategy decisions: Executives approve the cybersecurity risk strategy and their individual roles in carrying it out.
Culture signals: Leaders communicate expectations for secure and ethical behavior in their own words and actions.
Review direction: Leaders instruct the CISO to review the risk strategy on a set schedule and after significant incidents.
Authority checks: Leaders examine whether the CISO and security staff have enough authority and coordination to act.
Minutes and sign-off: Records of these decisions, in board or executive minutes, are the primary evidence an assessor will ask for.

Before any engagement, confirm which executive owns each decision in writing and that the review cadence is already on the governance calendar.

Where organizations fall short on GV.RR-01

GV.RR-01 is easy to claim and hard to evidence. The gaps below share one pattern: leadership's accountability exists in intent but leaves no record that an assessor can test. Each card names the gap, why it matters for leadership accountability and culture, and how to close it.

Risk strategy never reviewed by leaders

The organization has a written cybersecurity risk strategy, but no leader has reviewed it since it was approved. GV.RR-01 expects leaders to be accountable for cybersecurity risk, and a strategy nobody revisits shows accountability only on paper. Close the gap by putting the strategy on a standing leadership agenda with a named owner, a review date and a recorded decision to keep, change or retire each element. Ask whether the last review changed anything.

CISO directive given verbally

Leadership asks the CISO to keep the risk strategy current, but the instruction lives in a hallway conversation. Without a written mandate, the CISO cannot show that the direction came from leadership, and the review cadence has no anchor. Put the directive in a signed charter or a board or executive committee resolution that states the scope, the review frequency and the reporting line. Record it in the minutes so the instruction survives a change of people.

Culture messages not recorded

Executives talk about security, ethics and continual improvement in town halls and emails, but none of those messages is captured in a form an assessor can review. GV.RR-01 names a risk-aware, ethical and continually improving culture, and the outcome is only visible when leaders communicate it consistently. Keep a simple log of leadership communications on cybersecurity, with date, audience, channel and the message. Include the expectations leaders set for secure and ethical conduct.

Minutes show no cybersecurity discussion

Executive and board minutes cover budgets and growth, yet no cybersecurity topic appears across several meetings. Leaders may be engaged, but the record does not show it, and an assessor will read the minutes as the evidence. Add cybersecurity risk as a standing agenda item with a short report: open risks, changes to the risk strategy and decisions taken. Confirm with the board secretary that the minutes capture questions and decisions, not only attendance.

Authority and coordination never checked

Leaders assume the CISO, security team and business owners can act, but nobody tests whether they hold the authority and coordination channels they need. GV.RR-01 includes reviewing whether authority and coordination are adequate, and a review that never happens leaves gaps hidden until an incident. Run a periodic review: can the CISO stop a risky change, approve a security exception, or reach the executive team during an incident? Record gaps and the fixes assigned to owners.

Roles asserted without leadership sign-off

Security responsibilities appear in a policy or organization chart, but leadership has never formally accepted them. Without sign-off, the claim that leaders are accountable for cybersecurity risk is an assumption rather than a decision. Have the accountable executives approve the role assignments in writing, and link that approval to the risk strategy and the policy set. Revisit the approvals when reporting lines or the risk strategy change.

Questions buyers ask about GV.RR-01

What does GV.RR-01 require in plain words?

GV.RR-01 asks that the organization's leaders are responsible and accountable for cybersecurity risk, and that they promote a culture that is risk-aware, ethical and continually improving. In practice, an assessor looks for evidence that leaders have agreed their roles in the cybersecurity strategy, set shared expectations for security behavior, and directed the CISO to review the risk strategy at least annually and after major events. Assessors also check whether leaders have reviewed if the authority and coordination given to security staff are adequate. The subcategory is new in CSF 2.0, so older CSF 1.1 documentation rarely covers it directly and usually needs to be extended.

Is GV.RR-01 mandatory, and can customers require it?

NIST is voluntary. The CSF is not a regulation, and NIST does not offer certifications or endorsements of CSF-based implementations or services. Still, some customers and suppliers write CSF alignment into contracts, and a 2017 executive order made the framework mandatory for U.S. federal agencies. The practical question is what your contract or regulator actually asks for. Ask the requesting party whether they want a self-attested statement, a gap analysis, or evidence for specific subcategories such as GV.RR-01, and confirm the wording in writing before you start.

How much effort does GV.RR-01 take to evidence?

Effort depends mostly on whether leadership already has a documented cybersecurity strategy, a named CISO and regular board reporting. Where those exist, the work is largely collecting and dating records: strategy minutes, role agreements, the CISO's review of the risk strategy and board materials. Where they do not, the work involves drafting a leadership charter, agreeing responsibilities and setting a review cadence, which takes more executive time. Ongoing costs are mainly the recurring review cycle. Ask any provider to break its quote into the one-time setup and the recurring review work.

How long does it take to put GV.RR-01 in place?

No researched timeline is available for this subcategory, and the duration depends on how mature your governance is today. Timing is usually driven by the next board meeting cycle, the date the risk strategy is due for review, and how quickly leaders can agree roles in writing. Ask a provider for a milestone plan tied to your governance calendar, and confirm which items depend on executive availability rather than technical work. Any firm that promises a fixed duration without seeing your current documents should be questioned.

What does GV.RR-01 need from executives?

GV.RR-01 needs visible executive involvement, not delegated paperwork. Leaders must agree their roles in the cybersecurity strategy, state expectations for a secure and ethical culture, and direct the CISO to review the risk strategy. They also need to take part in reviewing whether security authority and coordination are adequate. Practically, that means a few decisions recorded in minutes, a named executive sponsor, and a review date on the calendar. Written leadership communication about the culture is also part of the evidence, so plan for the CEO or a board member to sign or present it.

Can a small team handle GV.RR-01 alone?

A small team can meet GV.RR-01 without outside help, because the subcategory is about leadership decisions and records rather than technical tooling. NIST's Small Business Quick-Start Guide (SP 1300, February 2024) cites this subcategory and suggests that leaders communicate support for a risk-aware, ethical and continually improving culture, which signals that small organizations are expected to address it in simple form. The main risks for a small team are that the CISO role is part-time or combined with IT, and that no one tracks the annual review. Assign a named owner and a calendar reminder before deciding whether to bring in help.

Can DeployOpen prepare GV.RR-01 evidence without issuing an attestation?

Yes, DeployOpen can help prepare the systems, records and evidence for a GV.RR-01 review, but it does not issue audit reports, attestations or certifications. The organization owns its controls and the leadership decisions behind them. DeployOpen's role is to prepare the supporting material and tie it to the subcategory, and independent auditors or assessors are the only parties who issue reports or certificates. Engagements are fixed-scope, so ask for the written scope listing which documents will be prepared, who signs them and what the assessor will receive.

How DeployOpen prepares GV.RR-01 evidence

DeployOpen helps organizations prepare the systems, records and evidence that show leadership is accountable for cybersecurity risk and for a risk-aware culture. The organization's leaders own the commitments and the decisions, while DeployOpen works with the people and platforms that produce the supporting records, under a written scope.

How we scope

We agree in writing which GV.RR-01 evidence sources, platforms and reporting lines the engagement covers.
We confirm with leadership which risk strategy documents, meeting records and CISO reporting cycles exist today.
Engagements are fixed-scope, so deliverables and timelines are agreed before any work starts.

How we build

We configure self-hosted open-source platforms in your infrastructure to record risk strategy reviews and leadership decisions.
We set up recurring review workflows that capture the annual and post-major-event CISO review of the risk strategy.
We document how culture expectations are communicated and tracked, using records your own organization controls.

How we hand over

We deliver written procedures describing who reviews the risk strategy, how often, and what records result.
We provide an evidence index mapping each record to the GV.RR-01 Implementation Examples it supports.
Your leaders and CISO receive walkthroughs so they can run and maintain the review cycle without us.

How we support

Ongoing support, upgrades and continuous testing are available as retainers after the initial handover.
We can update evidence records when leadership structures, the risk strategy or the platforms change.
Independent auditors or certification bodies, not DeployOpen, decide whether the evidence meets any assessment.