Does your organization have a comprehensive cybersecurity risk strategy that is reviewed and updated at least annually and after significant security events?
Explanation
A comprehensive cybersecurity risk strategy provides the foundation for an organization's security posture by establishing priorities, resource allocation, and response protocols.
Regular reviews ensure the strategy remains relevant as threats evolve, while updates after major security events incorporate lessons learned and adapt to emerging risks. Without a current strategy, organizations may have fragmented security controls that don't address their most significant risks.
Evidence of fulfillment could include a dated cybersecurity risk strategy document with revision history, meeting minutes from annual review sessions, documentation of strategy updates following security incidents, and a formal calendar or process document showing the scheduled review cycle.
Implementation Example
Leaders direct the CISO to maintain a comprehensive cybersecurity risk strategy and review and update it at least annually and after major events
ID: GV.RR-01.035
Context
- Function
- GV: GOVERN
- Category
- GV.RR: Roles, Responsibilities, and Authorities
- Sub-Category
- Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving
Related questions
- Have organizational leaders formally documented and agreed upon their specific roles and responsibilities for cybersecurity strategy development, implementation, and assessment?
- Does leadership actively communicate expectations for a secure and ethical culture, particularly leveraging current events as teaching opportunities?
- Does your organization conduct regular reviews to verify that individuals responsible for managing cybersecurity risk have appropriate authority and coordination mechanisms?
- Has your organization documented risk management roles and responsibilities in a formal policy?
- Has your organization formally documented the roles and responsibilities for cybersecurity risk management, including RACI (Responsible, Accountable, Consulted, Informed) designations?
- Are cybersecurity responsibilities and performance requirements explicitly included in job descriptions and personnel documentation?
