Does your organization update cybersecurity risk management objectives as part of annual strategic planning and when significant organizational or environmental changes occur?

Regular updates to cybersecurity risk management objectives ensure alignment with evolving business goals and the changing threat landscape. This process should incorporate both short-term tactical objectives and long-term strategic goals, with updates triggered by annual planning cycles and significant events such as mergers, new regulations, or major security incidents. Evidence could include documented cybersecurity objectives within strategic planning documents, meeting minutes showing risk objective discussions, a risk management framework that includes review triggers, or before/after examples of how objectives were modified following organizational changes.