GV.OV-03 — Evaluate Cybersecurity Performance | Defense Map
Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed
Search & Discovery 2.0
Find the exact control, technique, lesson, or book.
Search the complete Bare Metal Cyber knowledge system with identifier-aware ranking, framework filters, topic discovery, and direct paths into books, podcasts, and Academy learning.
11,003searchable records
6,025Academy lessons
6framework families
144published books
Search results
31 results for “cybersecurity”
GV.PO-01 — Establish and Enforce Cybersecurity Policy | Defense Map
Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
GV.PO-02 — Review and Update Cybersecurity Policy | Defense Map
Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission
GV.RM-03 — Cybersecurity in Enterprise Risk Management | Defense Map
Cybersecurity risk management activities and outcomes are included in enterprise risk management processes
GV.RM-05 — Cybersecurity Risk Communication | Defense Map
Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties
GV.RR-04 — Cybersecurity in Human Resources | Defense Map
Cybersecurity is included in human resources practices
ID.IM-04 — Improve Incident Response and Cybersecurity Plans | Defense Map
Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved
PR.AT-01 — General Cybersecurity Awareness and Training | Defense Map
Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind
Guided Defense Playbooks
Choose an operational cybersecurity playbook and follow connected NIST, D3FEND, ATT&CK, book, podcast, and Academy paths.
AI Security and Governance
Govern AI systems, data, models, services, identities, dependencies, risks, safeguards, monitoring, exceptions, and improvement as part of the wider cybersecurity program.
Incident Response
Prepare the organization to declare, manage, investigate, contain, communicate, recover from, and learn from cybersecurity incidents.
Supply Chain Risk
Establish a cybersecurity supply-chain program, prioritize suppliers, set agreement requirements, monitor risk across the lifecycle, and integrate suppliers into incident and recovery work.
GV.OC-01 — Organizational Mission | Defense Map
The organizational mission is understood and informs cybersecurity risk management
GV.OC-02 — Stakeholder Needs and Expectations | Defense Map
Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood
GV.OC-03 — Legal, Regulatory, and Contractual Requirements | Defense Map
Legal, regulatory, and contractual requirements regarding cybersecurity — including privacy and civil liberties obligations — are understood and managed
GV.OV-01 — Review Strategy Outcomes | Defense Map
Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction
GV.OV-02 — Adjust Strategy Coverage | Defense Map
The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks
GV.RM-06 — Standardized Risk Method | Defense Map
A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated
GV.RM-07 — Strategic Opportunities | Defense Map
Strategic opportunities — positive risks — are characterized and are included in organizational cybersecurity risk discussions
GV.RR-01 — Leadership Accountability and Risk-Aware Culture | Defense Map
Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving
GV.RR-02 — Roles, Responsibilities, and Authorities | Defense Map
Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced
GV.RR-03 — Risk-Commensurate Resources | Defense Map
Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies
GV.SC-01 — C-SCRM Program and Strategy | Defense Map
A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders
GV.SC-02 — Supply Chain Roles and Responsibilities | Defense Map
Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally