Skip to main content

💼 Risk Management Strategy (GV.RM)

  • Contextual name: 💼 Risk Management Strategy (GV.RM)
  • ID: /frameworks/nist-csf-v2.0/gv-rm
  • Located in: 💼 NIST CSF v2.0

Description​

The organization's priorities, constraints, risk tolerance and appetite statements, and assumptions are established, communicated, and used to support operational risk decisions.

Similar​

Sub Sections​

SectionSub SectionsInternal RulesPoliciesFlags
💼 GV.RM-01: Risk management objectives are established and agreed to by organizational stakeholders
💼 GV.RM-02: Risk appetite and risk tolerance statements are established, communicated, and maintained
💼 GV.RM-03: Cybersecurity risk management activities and outcomes are included in enterprise risk management processes
💼 GV.RM-04: Strategic direction that describes appropriate risk response options is established and communicated
💼 GV.RM-05: Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties
💼 GV.RM-06: A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated
💼 GV.RM-07: Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions