Cybersecurity in Enterprise Risk Management (GV.RM-03) — NIST CSF 2.0 Subcategory
Apply GV.RM-03 to achieve this CSF 2.0 outcome: Cybersecurity risk management activities and outcomes are included in enterprise risk management processes.
Search & Discovery 2.0
Find the exact control, technique, lesson, or book.
Search the complete Bare Metal Cyber knowledge system with identifier-aware ranking, framework filters, topic discovery, and direct paths into books, podcasts, and Academy learning.
11,003searchable records
6,025Academy lessons
6framework families
144published books
Search results
65 results for “cybersecurity”
Cybersecurity in Human Resources (GV.RR-04) — NIST CSF 2.0 Subcategory
Apply GV.RR-04 to achieve this CSF 2.0 outcome: Cybersecurity is included in human resources practices.
Cybersecurity Risk Communication (GV.RM-05) — NIST CSF 2.0 Subcategory
Apply GV.RM-05 to achieve this CSF 2.0 outcome: Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties.
Cybersecurity Supply Chain Risk Management (GV.SC) — NIST CSF 2.0 Category
Use GV.SC to manage supplier criticality, requirements, due diligence, monitoring, incident coordination, and life-cycle risk within the Govern Function.
Establish and Enforce Cybersecurity Policy (GV.PO-01) — NIST CSF 2.0 Subcategory
Apply GV.PO-01 to achieve this CSF 2.0 outcome: Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced.
Evaluate Cybersecurity Performance (GV.OV-03) — NIST CSF 2.0 Subcategory
Apply GV.OV-03 to achieve this CSF 2.0 outcome: Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed.
General Cybersecurity Awareness and Training (PR.AT-01) — NIST CSF 2.0 Subcategory
Apply PR.AT-01 to achieve this CSF 2.0 outcome: Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind.
Improve Incident Response and Cybersecurity Plans (ID.IM-04) — NIST CSF 2.0 Subcategory
Apply ID.IM-04 to achieve this CSF 2.0 outcome: Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved.
Review and Update Cybersecurity Policy (GV.PO-02) — NIST CSF 2.0 Subcategory
Apply GV.PO-02 to achieve this CSF 2.0 outcome: Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission.
Adjust Strategy Coverage (GV.OV-02) — NIST CSF 2.0 Subcategory
Apply GV.OV-02 to achieve this CSF 2.0 outcome: The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks.
C-SCRM Program and Strategy (GV.SC-01) — NIST CSF 2.0 Subcategory
Apply GV.SC-01 to achieve this CSF 2.0 outcome: A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders.
Establish Post-Incident Operational Norms (RC.RP-04) — NIST CSF 2.0 Subcategory
Apply RC.RP-04 to achieve this CSF 2.0 outcome: Critical mission functions and cybersecurity risk management are considered to establish post-incident operational norms.
Govern (GV) — NIST CSF 2.0 Function
Use the Govern Function to establish decision rights, risk direction, accountability, policy, oversight, and supply chain governance so cybersecurity risk is managed as an enterprise concern.
Integrate C-SCRM with Risk Management (GV.SC-03) — NIST CSF 2.0 Subcategory
Apply GV.SC-03 to achieve this CSF 2.0 outcome: Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes.
Leadership Accountability and Risk-Aware Culture (GV.RR-01) — NIST CSF 2.0 Subcategory
Apply GV.RR-01 to achieve this CSF 2.0 outcome: Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving.
Legal, Regulatory, and Contractual Requirements (GV.OC-03) — NIST CSF 2.0 Subcategory
Apply GV.OC-03 to achieve this CSF 2.0 outcome: Legal, regulatory, and contractual requirements regarding cybersecurity — including privacy and civil liberties obligations — are understood and managed.
Life-Cycle Supply Chain Security (GV.SC-09) — NIST CSF 2.0 Subcategory
Apply GV.SC-09 to achieve this CSF 2.0 outcome: Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle.
Organizational Context (GV.OC) — NIST CSF 2.0 Category
Use GV.OC to manage mission, stakeholders, dependencies, and obligations that shape cybersecurity risk decisions within the Govern Function.
Organizational Mission (GV.OC-01) — NIST CSF 2.0 Subcategory
Apply GV.OC-01 to achieve this CSF 2.0 outcome: The organizational mission is understood and informs cybersecurity risk management.
Post-Relationship Supply Chain Provisions (GV.SC-10) — NIST CSF 2.0 Subcategory
Apply GV.SC-10 to achieve this CSF 2.0 outcome: Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement.
Review Strategy Outcomes (GV.OV-01) — NIST CSF 2.0 Subcategory
Apply GV.OV-01 to achieve this CSF 2.0 outcome: Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction.
Risk-Commensurate Resources (GV.RR-03) — NIST CSF 2.0 Subcategory
Apply GV.RR-03 to achieve this CSF 2.0 outcome: Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies.
Roles, Responsibilities, and Authorities (GV.RR-02) — NIST CSF 2.0 Subcategory
Apply GV.RR-02 to achieve this CSF 2.0 outcome: Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced.
Specialized Role Training (PR.AT-02) — NIST CSF 2.0 Subcategory
Apply PR.AT-02 to achieve this CSF 2.0 outcome: Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind.