💼 GV.RM-06: A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated

Contextual name: 💼 GV.RM-06: A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated
ID: /frameworks/nist-csf-v2.0/gv-rm/06
Located in: 💼 Risk Management Strategy (GV.RM)

Description

Establish criteria for using a quantitative approach to cybersecurity risk analysis, and specify probability and exposure formulas
Create and use templates (e.g., a risk register) to document cybersecurity risk information (e.g., risk description, exposure, treatment, and ownership)
Establish criteria for risk prioritization at the appropriate levels within the enterprise
Use a consistent list of risk categories to support integrating, aggregating, and comparing cybersecurity risks

Section	Sub Sections	Internal Rules	Policies	Flags
💼 NIST CSF v1.1 → 💼 ID.RM-1: Risk management processes are established, managed, and agreed to by organizational stakeholders
💼 NIST SP 800-53 Revision 5 → 💼 PM-9 Risk Management Strategy
💼 NIST SP 800-53 Revision 5 → 💼 PM-18 Privacy Program Plan
💼 NIST SP 800-53 Revision 5 → 💼 PM-28 Risk Framing
💼 NIST SP 800-53 Revision 5 → 💼 PM-30 Supply Chain Risk Management Strategy	1
💼 NIST SP 800-53 Revision 5 → 💼 RA-3 Risk Assessment	4

Section	Sub Sections	Internal Rules	Policies	Flags