Govern / Gobernar

The circumstances that surround the organization cybersecurity risk management decisions are understood.

Priorities, constraints, risk tolerance, risk appetite, and assumptions are established and used to support risk decisions.

Cybersecurity roles, responsibilities, and authorities are established, communicated, understood, and enforced.

Cybersecurity policy is established, communicated, enforced, reviewed, and updated.

Cybersecurity risk management performance is used to inform, improve, and adjust strategy.

Cyber supply chain risk management processes are identified, established, managed, monitored, and improved.