Cyber Wiki Topic 09
Governance, Risk, Compliance & Privacy
Decision rights, risk management, policy, assurance, standards, regulation, and privacy.
Topic Directory
365 entries
AI Acceptable Use Policy
An AI acceptable use policy defines approved, restricted, and prohibited uses of AI services, models, data, accounts, and generated content.
AI assurance · AdvancedAI Audit Analytics
AI audit analytics applies reproducible queries, statistics, visualizations, and anomaly detection to evaluate populations and focus testing without replacing professional judgment.
AI assurance · AdvancedAI Audit Evidence Integrity
AI audit evidence integrity is the ability to show that logs, model artifacts, data extracts, test results, approvals, and screenshots are authentic, complete, attributable, and unchanged.
AI assurance · IntermediateAI Audit Finding Follow-Up
AI audit finding follow-up verifies that corrective actions address the root cause, operate as intended, and reduce the stated risk before a finding is closed.
AI audit · AdvancedAI Audit Hallucination Controls
AI audit hallucination controls prevent unsupported generated statements from being treated as evidence, criteria, citations, calculations, or conclusions.
AI audit · AdvancedAI Audit Overreliance Safeguards
AI audit overreliance safeguards keep auditors responsible for scoping, evidence evaluation, judgment, challenge, and conclusions even when AI performs analysis or drafting.
AI assurance · AdvancedAI Audit Sampling Strategy
An AI audit sampling strategy selects transactions, prompts, outputs, decisions, users, periods, or model versions in a way that supports the audit objective and exposes meaningful failure modes.
AI assurance · IntermediateAI Audit Scope and Criteria
AI audit scope defines the systems, life-cycle stages, data, decisions, vendors, locations, and stakeholders included in an engagement, while audit criteria define the requirements used to judge them.
AI change assurance · AdvancedAI Change Evidence Package
An AI change evidence package assembles the artifacts needed to understand, approve, reproduce, and later audit a model, data, prompt, configuration, or integration change.
AI assurance · AdvancedAI Control Design Effectiveness
AI control design effectiveness asks whether a control, as documented and configured, is capable of preventing, detecting, or correcting the risk it was selected to address.
AI assurance · AdvancedAI Control Operating Effectiveness
AI control operating effectiveness evaluates whether an appropriately designed control performed consistently, by the right people or automation, throughout the period under review.
AI privacy governance · AdvancedAI Data Rights and Deletion
AI data-rights and deletion processes handle access, correction, objection, restriction, portability, and erasure across datasets, models, embeddings, caches, logs, and derived outputs.
AI governance · FoundationalAI Governance Roles and Accountability
AI governance roles assign decision rights and obligations across executives, business owners, developers, data stewards, security, privacy, legal, risk, and users.
AI workforce governance · FoundationalAI Literacy and Training
AI literacy and training give each stakeholder enough role-specific knowledge to use, build, supervise, procure, govern, or challenge AI responsibly.
Management system · IntermediateAI Management System
An AI management system integrates policy, objectives, roles, risk processes, resources, competence, operations, measurement, audit, and continual improvement.
Third-party AI risk · IntermediateAI Procurement and Contract Controls
AI procurement and contract controls convert governance, security, privacy, performance, audit, incident, and exit requirements into enforceable supplier obligations.
AI legal governance · AdvancedAI Regulatory Role Mapping
AI regulatory role mapping identifies whether an organization acts as a provider, deployer, importer, distributor, user, controller, processor, or another regulated actor for each system.
AI risk management · AdvancedAI Risk Appetite Statement
An AI risk appetite statement describes the types and amount of AI-related risk an organization is willing to pursue or retain in support of its objectives.
AI risk management · AdvancedAI Risk Reassessment Triggers
AI risk reassessment triggers are defined events that require risk assumptions, ratings, controls, and approvals to be reviewed before normal cadence.
AI risk management · IntermediateAI Risk Register Integration
AI risk register integration records AI risks within the enterprise risk structure rather than isolating them in project-only documents.
AI risk management · AdvancedAI Risk Scenario Analysis
AI risk scenario analysis describes a plausible chain from threat, vulnerability, error, misuse, or change through affected assets, stakeholders, and consequences.
AI risk management · AdvancedAI Risk Tolerance Thresholds
AI risk tolerance thresholds translate risk appetite into measurable limits for performance, safety, privacy, bias, security, availability, cost, or human-impact indicators.
AI risk management · IntermediateAI Risk Treatment Tracking
AI risk treatment tracking follows mitigation, transfer, avoidance, acceptance, or pursuit decisions from approval through implementation and validation.
AI security management · AdvancedAI Security Metrics Governance
AI security metrics governance defines which measures support decisions, how they are calculated, who owns them, and how limitations and thresholds are communicated.
AI life-cycle assurance · AdvancedAI System Decommissioning Assurance
AI system decommissioning assurance verifies that retired models, endpoints, data, credentials, integrations, copies, and monitoring obligations are removed or transferred as approved.
AI assurance · AdvancedAI Third-Party Assurance
AI third-party assurance evaluates whether suppliers and service providers can substantiate their claims about governance, security, privacy, performance, and legal compliance.
AI transparency · IntermediateAI Transparency Notices
AI transparency notices tell people when AI is used, what it does, what information it relies on, important limitations, and how to seek review or correction.
AI risk management · IntermediateAI Use-Case Intake Governance
AI use-case intake governance creates a controlled entry point where proposed AI uses are identified, classified, owned, and screened before procurement or development proceeds.
AI third-party risk · AdvancedAI Vendor Change Notification
AI vendor change notification requires providers to disclose material changes that could alter risk, performance, data handling, compliance, or system behavior.
AI third-party risk · AdvancedAI Vendor Control Monitoring
AI vendor control monitoring evaluates whether a provider continues to meet security, privacy, resilience, transparency, and notification commitments after onboarding.
AI audit · AdvancedAI-Assisted Audit Governance
AI-assisted audit governance establishes approved uses, boundaries, validation, confidentiality, accountability, and documentation when auditors use AI tools.
NIST CSF Subcategory profile · IntermediateAdjust Strategy Coverage (GV.OV-02) — NIST CSF 2.0 Subcategory
Apply GV.OV-02 to achieve this CSF 2.0 outcome: The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks.
Agile delivery · IntermediateAgile Coaching and Mentoring
Agile coaching and mentoring build capability through questions, observation, practice, feedback, modeling, and the deliberate transfer of judgment.
Agile delivery · IntermediateAgile Collective Ownership
Agile collective ownership means the team shares responsibility for product outcomes, work quality, flow, knowledge, and improvement rather than protecting narrow individual tasks.
Agile delivery · IntermediateAgile Feedback Loops
Agile feedback loops create frequent, purposeful opportunities to compare assumptions and work with user, operational, technical, and business evidence.
Agile delivery · IntermediateAgile Metrics Selection
Agile metrics selection chooses a small set of measures that support decisions about value, flow, quality, predictability, learning, risk, and sustainability.
Agile delivery · IntermediateAgile Mindset in Practice
An agile mindset applies learning, customer value, collaboration, transparency, adaptation, and sustainable delivery as decision principles rather than as a set of ceremonies.
Agile delivery · IntermediateAgile Product Vision Alignment
Agile product vision alignment connects daily prioritization and increment decisions to a shared purpose, target users, desired outcomes, constraints, and strategic direction.
Agile delivery · IntermediateAgile Psychological Safety
Agile psychological safety is the shared confidence that people can raise concerns, admit uncertainty, ask for help, challenge assumptions, and report mistakes without retaliation or humiliation.
Agile delivery · IntermediateAgile Retrospectives
Agile retrospectives are structured learning sessions that examine how work occurred and commit to a small number of testable improvements.
Agile delivery · IntermediateAgile Suitability Assessment
Agile suitability assessment examines uncertainty, feedback availability, delivery constraints, stakeholder access, technical coupling, compliance, and organizational readiness before choosing an approach.
Agile delivery · IntermediateAgile Tailoring by Context
Agile tailoring selects and adjusts practices to fit the product, team, risk, governance, technology, and organizational environment while preserving rapid learning and value delivery.
Agile delivery · IntermediateAgile Working Agreements
Agile working agreements define how a team collaborates, makes decisions, handles interruptions, shares information, manages quality, and resolves conflict.
AI risk assessment · IntermediateAlgorithmic Impact Assessment
An algorithmic impact assessment examines purpose, affected people, benefits, harms, data, rights, alternatives, controls, and residual risk before a consequential AI use proceeds.
Privacy engineering · AdvancedAnonymization and De-identification
Anonymization and de-identification reduce the ability to associate released or shared data with a specific person, while accounting for linkage and re-identification risk.
Privacy engineering technique · AdvancedAnonymization and Pseudonymization
Anonymization aims to prevent data from being linked to an identifiable person, while pseudonymization replaces direct identifiers but retains a controlled path to re-link the data.
ATT&CK mitigation profile · IntermediateAudit (M1047)
Use independent, evidence-based assessment to determine whether security controls are designed appropriately and operating as intended. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
Assurance practice · IntermediateAudit Readiness
Audit readiness is the ongoing ability to demonstrate control design, operation, ownership, evidence, scope, and remediation without a last-minute reconstruction effort.
Assurance follow-through practice · IntermediateAudit Remediation Management
Audit remediation management turns findings into owned, risk-informed corrective actions and verifies that the underlying condition and exposure were actually reduced.
Risk acceptance decision · AdvancedAuthorization to Operate
An authorization to operate is a formal decision by an authorized official to accept the risk of operating a system under stated conditions.
Agile delivery · IntermediateBacklog Prioritization
Backlog prioritization orders work using value, urgency, risk, learning, dependencies, cost of delay, capacity, and strategic commitments.
Agile delivery · IntermediateBacklog Refinement and Clarity
Backlog refinement develops shared understanding of upcoming work by clarifying value, users, scope, acceptance, dependencies, risk, and an appropriate level of detail.
Value-management practice · AdvancedBenefits Realization
Benefits realization governs whether technology and security investments produce the intended measurable outcomes after delivery.
Project management · IntermediateBusiness Environment Change Response
Business environment change response evaluates external and internal shifts that may alter project scope, assumptions, priorities, viability, compliance, or expected value.
Resilience planning · FoundationalBusiness Impact Analysis
A business impact analysis identifies essential activities, dependencies, outage consequences, and recovery priorities so continuity and disaster-recovery plans reflect business needs.
NIST CSF Subcategory profile · IntermediateC-SCRM Program and Strategy (GV.SC-01) — NIST CSF 2.0 Subcategory
Apply GV.SC-01 to achieve this CSF 2.0 outcome: A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders.
Framework mapping practice · IntermediateCIS Controls Crosswalks
CIS Controls crosswalks map safeguards to requirements or outcomes in other frameworks so organizations can reuse evidence and understand overlapping intent.
Control prioritization model · IntermediateCIS Controls Implementation Groups
CIS Controls Implementation Groups organize safeguards into prioritized sets that reflect organizational resources, complexity, data sensitivity, and threat exposure.
Control framework · IntermediateCIS Critical Security Controls
The CIS Controls provide a prioritized set of safeguards that organizations can use to improve defensive capability and reduce common attack paths.
Security control guidance · IntermediateCIS Safeguards
CIS Safeguards are specific, actionable practices organized under the CIS Critical Security Controls and prioritized through Implementation Groups.
Change management · AdvancedChange Automation Evidence
Change automation evidence records what an automated change intended, who authorized it, what code and inputs ran, which targets changed, and whether outcomes matched the plan.
Service management · IntermediateChange Enablement Practice
Change enablement maximizes successful changes by assessing risk, authorizing work, coordinating schedules, preserving evidence, and learning from results without imposing unnecessary friction.
Assurance practice · AdvancedCloud Compliance and Assurance
Cloud compliance and assurance map obligations to provider, customer, and shared controls and collect evidence that those controls are designed and operating effectively.
Operating practice · IntermediateCloud Cost Optimization
Cloud cost optimization continually aligns resource configuration, purchasing choices, architecture, and usage with the value a workload delivers.
Data governance practice · AdvancedCloud Data Governance
Cloud data governance assigns ownership and rules for classification, access, quality, lineage, retention, location, sharing, and disposal across cloud data services.
Data governance concept · AdvancedCloud Data Residency and Sovereignty
Data residency concerns where data is stored or processed, while data sovereignty concerns the legal authority that may apply to that data and its providers.
Financial concept · BeginnerCloud Economics and Consumption Pricing
Cloud economics links metered consumption, pricing models, operating flexibility, and business value to technology decisions.
Governance practice · IntermediateCloud Governance with Tags, Policies, and Resource Locks
Cloud tags, policies, and locks organize resources, enforce requirements, assign ownership, and prevent unauthorized or accidental change.
Operating model · AdvancedCloud Operating Model
A cloud operating model defines how teams make decisions, provide platforms, govern risk, manage cost, operate services, and improve capabilities in a cloud environment.
Reliability practice · IntermediateCloud Service-Level Objectives
Service-level objectives define measurable reliability targets for a service, such as availability, latency, durability, or successful request rate.
Governance practice · BeginnerCloud Tagging and Cost Allocation
Cloud tags, labels, accounts, subscriptions, and projects provide metadata that supports ownership, policy, inventory, automation, and cost allocation.
Service management · IntermediateCollaborate and Promote Visibility
Collaborate and promote visibility means involving the right contributors and making work, constraints, risks, decisions, and results understandable to the people who depend on them.
Control allocation concept · AdvancedCommon, Inherited, and System-Specific Controls
Common controls support multiple systems, inherited controls are received from another provider or environment, and system-specific controls are implemented for one system.
Risk communication practice · IntermediateCommunicating Cyber Risk in Business Terms
Communicating cyber risk in business terms connects plausible scenarios, affected outcomes, uncertainty, options, cost, and decision deadlines without stripping away material technical truth.
Control design practice · IntermediateCompensating Controls
A compensating control is an alternate safeguard used when the prescribed control cannot be implemented, while still addressing the original security or privacy objective.
Assurance artifact · IntermediateCompliance Evidence and Artifacts
Compliance evidence and artifacts show how a requirement is implemented and whether the related control operates effectively.
Risk decision practice · AdvancedCompliance Exceptions and Risk Waivers
A compliance exception or risk waiver documents an authorized, time-bound decision to deviate from a requirement while the resulting exposure, compensating measures, owner, and remediation plan remain visible.
Privacy operations practice · IntermediateConsent Management
Consent management records, enforces, and updates a person's choices about defined data uses where consent is the appropriate basis or control.
Privacy rights operations · IntermediateConsent Withdrawal and Preference Operations
Consent withdrawal and preference operations propagate a person’s choice across interfaces, profiles, downstream systems, vendors, and future processing.
Project risk management · IntermediateContingency, Fallback, and Reserves
Contingency actions are prepared for defined triggers, fallback actions are alternatives when the primary response fails, and reserves provide time or money for recognized uncertainty.
Assurance practice · AdvancedContinuous Control Monitoring
Continuous control monitoring uses defined data, tests, and review cycles to identify changes in control condition and risk between formal assessments.
Control selection practice · AdvancedControl Baselines and Tailoring
A control baseline is a starting set of safeguards selected for a defined impact or risk context; tailoring adjusts that set to the system, organization, threats, and applicable requirements.
Control assurance concept · IntermediateControl Design and Effectiveness
Control design asks whether a control is capable of addressing the intended risk, while operating effectiveness asks whether it works consistently in the real environment.
Assurance practice · IntermediateControl Implementation Evidence
Control implementation evidence demonstrates that a control is designed, configured, operated, monitored, and corrected as claimed within a defined scope and time period.
Project management · IntermediateCost Baseline and Forecasting
Cost baseline and forecasting combine approved funding, time-phased planned expenditure, actual cost, commitments, remaining estimates, and uncertainty into a current financial view.
Business analysis practice · IntermediateCritical Business Process Mapping
Critical business process mapping connects products and services to people, technology, data, facilities, suppliers, timing needs, and failure consequences.
Privacy data governance · AdvancedCross-Border Data Flow Inventory
A cross-border data-flow inventory identifies where personal data originates, transits, is accessed, is stored, and is supported across jurisdictions and legal entities.
Negotiation practice · IntermediateCross-Functional Security Negotiation
Cross-functional security negotiation searches for workable agreements across risk, delivery, cost, authority, and timing while protecting non-negotiable security outcomes.
Compliance analysis practice · AdvancedCross-Jurisdiction Compliance Analysis
Cross-jurisdiction compliance analysis identifies where legal, regulatory, contractual, data-transfer, reporting, retention, and access obligations conflict or overlap across locations.
Professional practice · IntermediateCybersecurity Professional Ethics
Cybersecurity professional ethics applies duty, honesty, proportionality, competence, confidentiality, and public-interest judgment to security decisions where rules alone do not settle the answer.
NIST CSF Subcategory profile · IntermediateCybersecurity Risk Communication (GV.RM-05) — NIST CSF 2.0 Subcategory
Apply GV.RM-05 to achieve this CSF 2.0 outcome: Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties.
Management discipline · IntermediateCybersecurity Risk Management
Cybersecurity risk management connects assets, threats, vulnerabilities, controls, consequences, uncertainty, priorities, and accountable decisions.
Strategic planning artifact · IntermediateCybersecurity Roadmap
A cybersecurity roadmap sequences capabilities, investments, dependencies, milestones, and decisions needed to move from the current security posture toward a defined target state.
NIST CSF Category profile · IntermediateCybersecurity Supply Chain Risk Management (GV.SC) — NIST CSF 2.0 Category
Use GV.SC to manage supplier criticality, requirements, due diligence, monitoring, incident coordination, and life-cycle risk within the Govern Function.
NIST CSF Subcategory profile · IntermediateCybersecurity in Enterprise Risk Management (GV.RM-03) — NIST CSF 2.0 Subcategory
Apply GV.RM-03 to achieve this CSF 2.0 outcome: Cybersecurity risk management activities and outcomes are included in enterprise risk management processes.
NIST CSF Subcategory profile · IntermediateCybersecurity in Human Resources (GV.RR-04) — NIST CSF 2.0 Subcategory
Apply GV.RR-04 to achieve this CSF 2.0 outcome: Cybersecurity is included in human resources practices.
Privacy engineering · IntermediateDark Pattern Review
A dark pattern review tests whether interface structure, language, defaults, repetition, friction, or visual emphasis steers people away from a free and informed privacy choice.
Information governance · FoundationalData Dictionaries and Metadata
Data dictionaries and metadata describe fields, formats, meanings, allowed values, ownership, sensitivity, and relationships so data can be interpreted consistently.
Privacy and data governance practice · IntermediateData Inventory and Mapping
A data inventory identifies important data assets, while data mapping shows where data comes from, how it moves, who uses it, where it is stored, and where it leaves the organization.
Data governance · IntermediateData Lineage
Data lineage records how information moves from origin to destination, including transformations, joins, systems, owners, and reporting products.
Privacy principle · BeginnerData Minimization
Data minimization limits collection, use, sharing, precision, and retention to what is necessary for a defined and legitimate purpose.
Data governance practice · IntermediateData Ownership and Stewardship
Data ownership assigns accountability for decisions about a data domain, while stewardship performs or coordinates the day-to-day practices that maintain quality, protection, access, and lifecycle rules.
Third-party privacy · AdvancedData Processing Agreement Controls
Data processing agreement controls translate privacy obligations into enforceable purpose, instruction, security, rights, retention, transfer, incident, audit, and exit requirements.
Privacy data governance · IntermediateData Processing Inventory
A data processing inventory records how personal data is collected, used, stored, shared, retained, protected, and governed across business activities and systems.
Information governance · IntermediateData Provenance
Data provenance establishes the origin, custody, processing history, and authoritative context of a data item or dataset.
Data governance · FoundationalData Quality Dimensions
Data quality dimensions provide a repeatable way to judge whether information is complete, accurate, consistent, timely, valid, and fit for its intended use.
Records governance · IntermediateData Retention and Legal Holds
Data retention and legal holds govern how long information is kept, when normal disposal must pause, and how records remain discoverable and protected.
Privacy operations practice · IntermediateData Subject Rights
Data subject rights are mechanisms through which individuals may request access, correction, deletion, restriction, portability, objection, or other actions under applicable rules and promises.
Reporting assurance · IntermediateData Visualization Integrity and Accessibility
Data-visualization integrity and accessibility ensure charts, dashboards, maps, and reports represent data honestly and can be understood and operated by intended audiences, including people with disabilities.
Governance concept · IntermediateDecision Rights and Accountability
Decision rights specify who may make which decisions, under what conditions, with whose input, and with what accountability.
Privacy rights operations · IntermediateDeletion Verification and Exceptions
Deletion verification confirms that approved deletion reaches active systems, derived stores, archives, vendors, and future restoration paths while preserving documented legal exceptions.
Service management · IntermediateDesign, Transition, Obtain, Build, Deliver, and Support
These value-chain activities turn requirements and designs into ready capabilities, deploy them safely, operate them, fulfill demand, and support users through controlled end-to-end flow.
Service management · IntermediateDigital Product and Service Lifecycle
The digital product and service lifecycle connects discovery, design, acquisition, build, transition, operation, delivery, and support as one governed path to value.
ATT&CK mitigation profile · IntermediateDo Not Mitigate (M1055)
Represent a deliberate decision not to apply a direct preventive treatment to a specific adversary behavior while governing the remaining risk. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
Governance practice · AdvancedEnterprise Architecture Governance
Enterprise architecture governance guides technology, information, application, and infrastructure decisions toward a coherent target state.
Risk governance practice · IntermediateEnterprise Risk Management
Enterprise risk management coordinates risk decisions across business objectives, technology, operations, finance, compliance, and cybersecurity.
NIST CSF Subcategory profile · IntermediateEstablish and Enforce Cybersecurity Policy (GV.PO-01) — NIST CSF 2.0 Subcategory
Apply GV.PO-01 to achieve this CSF 2.0 outcome: Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced.
NIST CSF Subcategory profile · IntermediateEvaluate Cybersecurity Performance (GV.OV-03) — NIST CSF 2.0 Subcategory
Apply GV.OV-03 to achieve this CSF 2.0 outcome: Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed.
Risk decision practice · IntermediateEvidence-Based Risk Prioritization
Evidence-based risk prioritization uses exposure, criticality, threat activity, control performance, uncertainty, and consequence to make funding and sequencing choices defensible.
Leadership communication practice · AdvancedExecutive Security Reporting
Executive security reporting gives decision makers a concise view of material exposure, control performance, incidents, obligations, trends, and choices requiring action.
Change-management practice · IntermediateExecutive Sponsorship for Security Change
Executive sponsorship for security change provides visible authority, resources, conflict resolution, accountability, and reinforcement so cross-organizational change can survive resistance.
Project risk management · IntermediateExpected Monetary Value
Expected monetary value combines the probability of an uncertain outcome with its financial effect to compare choices, contingencies, and decision paths.
NIST CSF Subcategory profile · IntermediateExternal Stakeholder Dependencies (GV.OC-04) — NIST CSF 2.0 Subcategory
Apply GV.OC-04 to achieve this CSF 2.0 outcome: Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated.
Risk analysis practice · AdvancedExtreme-but-Plausible Impact Analysis
Extreme-but-plausible impact analysis explores severe scenarios that remain credible enough to challenge assumptions about concentration, dependency, recovery, safety, and decision thresholds.
Government program · AdvancedFedRAMP
FedRAMP establishes security requirements and repeatable authorization processes for cloud services used by United States federal agencies.
Agile delivery · IntermediateFlow Optimization
Flow optimization improves the movement of valuable work through a system by managing demand, capacity, queues, dependencies, variability, quality, and feedback.
Service management · IntermediateFocus on Value Principle
Focus on value requires every activity, investment, control, and improvement to remain connected to outcomes that matter to customers, users, sponsors, and the organization.
Service management · IntermediateFour Dimensions of Service Management
The four dimensions provide a balanced view of organizations and people, information and technology, partners and suppliers, and value streams and processes.
AI regulatory governance · AdvancedGeneral-Purpose AI Governance
General-purpose AI governance addresses models that can support many downstream tasks and whose risks depend partly on capabilities, distribution, and later integration.
NIST CSF Function profile · FoundationalGovern (GV) — NIST CSF 2.0 Function
Use the Govern Function to establish decision rights, risk direction, accountability, policy, oversight, and supply chain governance so cybersecurity risk is managed as an enterprise concern.
Governance design practice · AdvancedGovernance Frameworks and Decision Rights
Governance frameworks organize principles, structures, processes, information, culture, skills, and accountability so important decisions are made by the right people at the right level.
Governance measurement practice · AdvancedGovernance Performance Management
Governance performance management measures whether governance structures, decisions, and processes are producing intended enterprise outcomes.
Governance discipline · AdvancedGovernance of Enterprise IT
Governance of enterprise IT ensures that technology-related decisions support enterprise objectives, deliver value, manage risk, and use resources responsibly.
Control framework · AdvancedHITRUST CSF
The HITRUST CSF combines requirements from multiple sources into a structured control framework used for risk management and assurance.
Communication practice · IntermediateHigh-Pressure Security Communications
High-pressure security communications deliver concise, accurate, prioritized messages with clear actions, uncertainty, ownership, and update timing when attention and time are limited.
Human-centered governance · IntermediateHuman Oversight Design
Human oversight design gives qualified people timely information, authority, capacity, and practical controls to understand and intervene in AI-supported decisions.
Risk assessment practice · IntermediateHuman Risk Assessment
Human risk assessment examines roles, access, incentives, workload, behaviors, and likely failure modes so awareness and controls address real exposure rather than generic messaging.
International standard · AdvancedISO/IEC 27001
ISO/IEC 27001 specifies requirements for establishing, implementing, maintaining, and continually improving an information security management system.
Investment governance practice · AdvancedIT Investment Governance
IT investment governance evaluates, selects, funds, monitors, and retires technology-enabled investments according to enterprise value, risk, capacity, and strategic priorities.
Portfolio governance practice · AdvancedIT Portfolio Management
IT portfolio management evaluates investments, services, applications, infrastructure, and technical debt as a connected set rather than as isolated projects.
Resource governance practice · AdvancedIT Resource Optimization
IT resource optimization aligns people, skills, information, applications, infrastructure, suppliers, and funding with enterprise priorities and constraints.
Service management · IntermediateITIL Continual Improvement Model
The continual improvement model provides a repeatable path from vision and current-state evidence through target definition, execution, measurement, and sustained momentum.
Service management · IntermediateITIL Engage Value Chain Activity
The engage activity establishes transparent relationships and a continuing understanding of stakeholder needs, expectations, experience, demand, and feedback.
Service management · IntermediateITIL Guiding Principles
The ITIL guiding principles are adaptable recommendations that help people make coherent decisions across governance, value streams, practices, technologies, suppliers, and improvement work.
Service management · IntermediateITIL Improve Value Chain Activity
The improve activity ensures continual enhancement of products, services, practices, value-chain activities, and the service-management system using prioritized evidence.
Service management · IntermediateITIL Plan Value Chain Activity
The plan activity creates shared understanding of vision, current status, priorities, policies, architecture, and improvement direction across products, services, and stakeholders.
Service management · IntermediateITIL Service Value Chain
The ITIL service value chain is a flexible operating model whose activities combine in different value streams to create, deliver, support, and improve products and services.
Service management · IntermediateITIL Service Value System
The ITIL service value system brings guiding principles, governance, the service value chain, practices, and continual improvement together to convert opportunity and demand into value.
NIST CSF Function profile · FoundationalIdentify (ID) — NIST CSF 2.0 Function
Use the Identify Function to maintain an evidence-based understanding of assets, dependencies, threats, vulnerabilities, likelihood, impact, and opportunities for improvement.
NIST CSF Subcategory profile · IntermediateImprove Incident Response and Cybersecurity Plans (ID.IM-04) — NIST CSF 2.0 Subcategory
Apply ID.IM-04 to achieve this CSF 2.0 outcome: Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved.
NIST CSF Category profile · IntermediateImprovement (ID.IM) — NIST CSF 2.0 Category
Use ID.IM to manage learning from evaluations, tests, exercises, operations, incidents, and plan execution within the Identify Function.
NIST CSF Subcategory profile · IntermediateImprovements from Evaluations (ID.IM-01) — NIST CSF 2.0 Subcategory
Apply ID.IM-01 to achieve this CSF 2.0 outcome: Improvements are identified from evaluations.
NIST CSF Subcategory profile · IntermediateImprovements from Operations (ID.IM-03) — NIST CSF 2.0 Subcategory
Apply ID.IM-03 to achieve this CSF 2.0 outcome: Improvements are identified from execution of operational processes, procedures, and activities.
NIST CSF Subcategory profile · IntermediateImprovements from Tests and Exercises (ID.IM-02) — NIST CSF 2.0 Subcategory
Apply ID.IM-02 to achieve this CSF 2.0 outcome: Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties.
NIST CSF Subcategory profile · IntermediateInclude Suppliers in Incident Activities (GV.SC-08) — NIST CSF 2.0 Subcategory
Apply GV.SC-08 to achieve this CSF 2.0 outcome: Relevant suppliers and other third parties are included in incident planning, response, and recovery activities.
Agile delivery · IntermediateIncrement Goals and Acceptance
Increment goals describe the coherent outcome sought in a delivery cycle, while acceptance criteria define the observable conditions required for work to be considered suitable.
Information management practice · IntermediateInformation Governance
Information governance directs how information is created, classified, owned, used, shared, protected, retained, and disposed to support enterprise objectives and obligations.
Information governance practice · IntermediateInformation Governance and Data Stewardship
Information governance establishes decision rights and policies for the value, quality, security, privacy, retention, use, and disposal of information.
Service management · IntermediateInformation and Technology Dimension
The information and technology dimension addresses the data, knowledge, applications, infrastructure, automation, architecture, and security needed to manage products and services.
Risk analysis concept · IntermediateInherent and Residual Risk
Inherent risk is the exposure before considering relevant controls, while residual risk is the exposure that remains after controls and other responses are applied.
NIST CSF Subcategory profile · IntermediateIntegrate C-SCRM with Risk Management (GV.SC-03) — NIST CSF 2.0 Subcategory
Apply GV.SC-03 to achieve this CSF 2.0 outcome: Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes.
Project management · IntermediateIntegrated Project Planning
Integrated project planning coordinates scope, schedule, cost, resources, quality, risk, procurement, communications, stakeholders, and change assumptions as one connected management system.
Information handling practice · AdvancedIntelligence Handling Caveats
Intelligence handling caveats communicate restrictions, sensitivities, source protections, legal limits, and conditions that apply in addition to general sharing labels.
Service management · IntermediateKeep It Simple and Practical
Keep it simple and practical means using the fewest steps and controls needed to achieve the intended outcome without discarding necessary assurance, accountability, or resilience.
Risk measurement practice · IntermediateKey Risk Indicators
Key risk indicators are measures that signal changing exposure, deteriorating conditions, or movement toward an unacceptable risk threshold.
NIST CSF Subcategory profile · IntermediateLeadership Accountability and Risk-Aware Culture (GV.RR-01) — NIST CSF 2.0 Subcategory
Apply GV.RR-01 to achieve this CSF 2.0 outcome: Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving.
Leadership practice · IntermediateLeadership Credibility and Follow-Through
Leadership credibility and follow-through grow when security leaders are consistent, candid about uncertainty, fair in tradeoffs, reliable in commitments, and visible in correcting mistakes.
NIST CSF Subcategory profile · IntermediateLegal, Regulatory, and Contractual Requirements (GV.OC-03) — NIST CSF 2.0 Subcategory
Apply GV.OC-03 to achieve this CSF 2.0 outcome: Legal, regulatory, and contractual requirements regarding cybersecurity — including privacy and civil liberties obligations — are understood and managed.
NIST CSF Subcategory profile · IntermediateLife-Cycle Supply Chain Security (GV.SC-09) — NIST CSF 2.0 Subcategory
Apply GV.SC-09 to achieve this CSF 2.0 outcome: Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle.
Risk analysis · FoundationalLikelihood and Impact
Likelihood estimates how plausible or frequent a harmful event is, while impact estimates the magnitude of consequences if it occurs.
Framework governance · IntermediateMITRE ATT&CK® Identifiers, Versioning, and Object Lifecycle
How stable identifiers, versions, modified dates, deprecation, and revocation support defensible mappings and repeatable maintenance.
Third-party governance practice · AdvancedManaged Service Security Governance
Managed service security governance defines how an organization directs, monitors, and assures security outcomes when important capabilities are operated by external providers.
Change-management practice · IntermediateManaging Resistance to Security Change
Managing resistance to security change distinguishes legitimate operational concerns from avoidance, engages affected groups, adapts implementation, and protects non-negotiable outcomes.
Data governance · IntermediateMaster Data and the Source of Truth
Master-data management defines authoritative records for shared entities and governs how duplicates, conflicts, reference values, and downstream copies are resolved.
NIST CSF Subcategory profile · IntermediateMonitor Supplier and Third-Party Risk (GV.SC-07) — NIST CSF 2.0 Subcategory
Apply GV.SC-07 to achieve this CSF 2.0 outcome: The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship.
Framework · IntermediateNIST Cybersecurity Framework
The NIST Cybersecurity Framework organizes cybersecurity outcomes so organizations can understand current capability, identify priorities, communicate risk, and improve over time.
Control catalog · AdvancedNIST SP 800-53
NIST SP 800-53 provides a broad catalog of security and privacy controls that organizations can select, tailor, implement, assess, and monitor according to risk and requirements.
Operational technology risk · IntermediateOT Asset Criticality
OT asset criticality ranks components and functions by their contribution to safety, process control, environmental protection, quality, continuity, and recovery.
Operational technology risk · AdvancedOT Consequence-Driven Risk Analysis
OT consequence-driven risk analysis starts with unacceptable physical, safety, environmental, operational, and business outcomes, then identifies the cyber-enabled paths that could produce them.
Operational technology security · IntermediateOT Job Safety Analysis
An OT job safety analysis breaks work into steps, identifies hazards and cyber dependencies, and defines controls before maintenance, testing, configuration, or incident activity begins.
Operational technology risk · AdvancedOT Scenario-Based Risk Assessment
An OT scenario-based risk assessment describes a credible actor or failure path, affected assets and process, enabling conditions, controls, consequences, uncertainty, and response options.
Operational technology risk · AdvancedOT Supply Chain Risk
OT supply chain risk includes weaknesses, malicious functionality, counterfeit components, insecure development, remote services, support dependencies, and lifecycle failures in products and providers.
Operational readiness · IntermediateOperational Transition and Handover
Operational transition and handover move a deliverable into sustained service with accepted ownership, documentation, training, support, monitoring, access, recovery, maintenance, and unresolved-risk records.
Service management · IntermediateOptimize and Automate Principle
Optimize and automate requires improving the underlying work before automating it and retaining human judgment, accountability, observability, and recovery around automated decisions.
Project management · IntermediateOrganizational Change Support
Organizational change support prepares affected people, processes, structures, incentives, and operating practices to adopt and sustain a project outcome.
NIST CSF Category profile · IntermediateOrganizational Context (GV.OC) — NIST CSF 2.0 Category
Use GV.OC to manage mission, stakeholders, dependencies, and obligations that shape cybersecurity risk decisions within the Govern Function.
NIST CSF Subcategory profile · IntermediateOrganizational Dependencies (GV.OC-05) — NIST CSF 2.0 Subcategory
Apply GV.OC-05 to achieve this CSF 2.0 outcome: Outcomes, capabilities, and services that the organization depends on are understood and communicated.
NIST CSF Subcategory profile · IntermediateOrganizational Mission (GV.OC-01) — NIST CSF 2.0 Subcategory
Apply GV.OC-01 to achieve this CSF 2.0 outcome: The organizational mission is understood and informs cybersecurity risk management.
Service management · IntermediateOrganizations and People Dimension
The organizations and people dimension covers structure, culture, roles, authority, communication, competence, capacity, and the human conditions required to create and support value.
NIST CSF Category profile · IntermediateOversight (GV.OV) — NIST CSF 2.0 Category
Use GV.OV to manage reviewing outcomes, coverage, performance, and changes that require strategy adjustment within the Govern Function.
Service management · IntermediatePCI Attestation of Compliance
A PCI Attestation of Compliance is the signed declaration that identifies the assessed entity, validation method, applicable environment, and compliance status supported by the associated assessment.
Service management · IntermediatePCI Business-as-Usual Compliance
PCI business-as-usual compliance embeds payment-security responsibilities, control operation, evidence, change review, monitoring, and remediation into normal work throughout the year.
Service management · IntermediatePCI Compensating Controls
PCI compensating controls address a legitimate technical or documented business constraint by providing additional protection that meets the intent and rigor of the original requirement.
Service management · IntermediatePCI DSS Customized Approach
The PCI DSS customized approach allows an entity to meet a requirement’s customized objective through controls designed for its environment, supported by targeted risk analysis and rigorous validation.
Service management · IntermediatePCI DSS Defined Approach
The PCI DSS defined approach implements and assesses the stated requirements and testing procedures as written in the standard.
Service management · IntermediatePCI DSS Scope Determination
PCI DSS scope determination identifies the people, processes, technologies, facilities, and third parties that store, process, transmit, or can affect the security of payment account data.
Service management · IntermediatePCI Report on Compliance
A PCI Report on Compliance records the assessor’s scope, methods, evidence, observations, testing, findings, and conclusion for an on-site PCI DSS assessment.
Service management · IntermediatePCI Self-Assessment Questionnaire Selection
PCI self-assessment questionnaire selection matches an eligible merchant or service environment to the validation instrument that reflects its payment channels, technology, outsourcing, and account-data handling.
Service management · IntermediatePCI Shared Responsibility Matrix
A PCI shared responsibility matrix assigns each applicable requirement and control activity among the assessed entity, service providers, customers, and other parties, including the evidence each must produce.
Service management · IntermediatePCI Targeted Risk Analysis
A PCI targeted risk analysis uses documented threat, likelihood, impact, asset, control, and operating context to justify certain frequencies or support customized-approach controls.
Service management · IntermediatePCI Third-Party Service Provider Oversight
PCI third-party service provider oversight establishes which payment-security responsibilities a provider performs, how compliance is evidenced, and how the customer monitors changes, incidents, subcontractors, and gaps.
Service management · IntermediatePartners and Suppliers Dimension
The partners and suppliers dimension considers external capabilities, contracts, shared responsibilities, concentration risk, integration, assurance, and relationship governance.
Remediation governance artifact · IntermediatePlan of Action and Milestones
A Plan of Action and Milestones records an identified weakness, the corrective work, accountable owner, resources, milestones, schedule, status, dependencies, and remaining risk.
NIST CSF Category profile · IntermediatePolicy (GV.PO) — NIST CSF 2.0 Category
Use GV.PO to manage risk-informed policy establishment, communication, enforcement, review, and revision within the Govern Function.
Security assurance · IntermediatePost-Implementation Security Review
A post-implementation security review evaluates whether delivered controls, requirements, operations, benefits, and risk outcomes remain effective after the system has entered real use.
NIST CSF Subcategory profile · IntermediatePost-Relationship Supply Chain Provisions (GV.SC-10) — NIST CSF 2.0 Subcategory
Apply GV.SC-10 to achieve this CSF 2.0 outcome: Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement.
ATT&CK mitigation profile · IntermediatePre-compromise (M1056)
Reduce the information, exposure, trust, and infrastructure opportunities an adversary can exploit before obtaining access. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
NIST CSF Subcategory profile · IntermediatePrioritize Suppliers by Criticality (GV.SC-04) — NIST CSF 2.0 Subcategory
Apply GV.SC-04 to achieve this CSF 2.0 outcome: Suppliers are known and prioritized by criticality.
Privacy assurance · AdvancedPrivacy Audit Evidence Management
Privacy audit evidence management preserves relevant, reliable, traceable, and access-controlled records so an independent reviewer can reconstruct what a control did and when.
Privacy program operations · IntermediatePrivacy Complaint Intake and Resolution
Privacy complaint operations provide a controlled path to receive, classify, investigate, resolve, communicate, and learn from concerns about personal-data handling.
Privacy assurance · AdvancedPrivacy Control Effectiveness Testing
Privacy control effectiveness testing evaluates whether a control is appropriately designed, implemented, and operating consistently enough to achieve its stated objective.
Privacy program operations · IntermediatePrivacy Governance Operating Model
A privacy governance operating model describes how oversight, policy, execution, assurance, escalation, and reporting work together across centralized and distributed teams.
Privacy risk assessment · IntermediatePrivacy Impact Assessment
A privacy impact assessment examines how a system, process, or change affects individuals and how privacy risks will be managed.
Incident response practice · IntermediatePrivacy Incident Management
Privacy incident management addresses events that may harm individuals or violate expectations for how personal information is handled.
Privacy program operations · IntermediatePrivacy Notice Change Management
Privacy notice change management keeps public and internal disclosures synchronized with actual collection, use, sharing, retention, automation, and rights practices.
Privacy program operations · IntermediatePrivacy Policy and Control Hierarchy
A privacy policy and control hierarchy connects principles and policy statements to standards, procedures, technical requirements, evidence, and accountable owners.
Privacy program operations · IntermediatePrivacy Program Charter
A privacy program charter states the program’s mandate, scope, authority, decision rights, priorities, and reporting obligations in terms that leaders and operators can use.
Privacy assurance · IntermediatePrivacy Program Maturity Assessment
A privacy program maturity assessment evaluates how consistently governance, processes, people, technology, evidence, and improvement operate across the organization.
Privacy governance practice · IntermediatePrivacy Program Metrics
Privacy program metrics show whether privacy obligations, controls, and outcomes are improving, deteriorating, or requiring a decision.
Privacy program operations · IntermediatePrivacy Regulatory Change Monitoring
Privacy regulatory change monitoring identifies relevant legal, regulatory, and enforcement changes and translates them into scoped program, product, contract, and control updates.
Privacy rights operations · IntermediatePrivacy Rights Request Deadline Management
Privacy rights request deadline management converts jurisdictional timing rules and internal service targets into tracked milestones, dependencies, escalation, and proof of completion.
Privacy risk assessment · AdvancedPrivacy Risk in Mergers and Divestitures
Privacy risk in mergers and divestitures arises when data, systems, notices, permissions, vendors, obligations, and controls are combined, separated, transferred, or retired.
Privacy program operations · IntermediatePrivacy Role Accountability Matrix
A privacy role accountability matrix assigns who is responsible, accountable, consulted, and informed for recurring privacy decisions and control activities.
Privacy engineering · IntermediatePrivacy Usability Testing
Privacy usability testing evaluates whether people can notice, understand, choose, change, and verify privacy-relevant actions without coercion or unnecessary effort.
Privacy engineering principle · IntermediatePrivacy by Design
Privacy by Design integrates privacy objectives into requirements, architecture, defaults, workflows, testing, and operations rather than adding notices after deployment.
Privacy engineering technology · AdvancedPrivacy-Enhancing Technologies
Privacy-enhancing technologies reduce exposure or enable useful processing with less disclosure, linkage, or centralized access to personal data.
Project risk management · IntermediateProbability–Impact Scoring
Probability–impact scoring combines an estimate of likelihood with the magnitude of effect on objectives to support relative risk prioritization.
Service management · IntermediateProgress Iteratively with Feedback
Progress iteratively with feedback divides work into manageable increments, tests assumptions early, and uses evidence from stakeholders and operations to redirect the next step.
Project management · IntermediateProject Artifact Governance
Project artifact governance controls the creation, ownership, version, approval, access, retention, and authoritative status of records used to direct and evidence project work.
Project risk management · IntermediateProject Assumption Analysis
Project assumption analysis identifies statements treated as true, evaluates their stability and evidence, and determines the risk created if they prove wrong.
Project governance · IntermediateProject Change Control
Project change control evaluates, authorizes, communicates, implements, verifies, and records proposed changes to scope, schedule, cost, quality, security, or operational configuration.
Project management · IntermediateProject Change Control and Approval
Project change control evaluates proposed changes, their combined effects, available options, authority, and implementation conditions before baselines are modified.
Project management · IntermediateProject Charter and Mandate
A project charter formally authorizes work, identifies the accountable sponsor and project leader, and establishes the initial purpose, boundaries, authority, and success conditions.
Project management · IntermediateProject Communications Planning
Project communications planning defines who needs what information, why they need it, when it is needed, how it will be delivered, and how understanding will be confirmed.
Project management · IntermediateProject Compliance Management
Project compliance management identifies applicable obligations, assigns evidence and control responsibilities, and integrates verification into planning, delivery, change, and acceptance.
Project management · IntermediateProject Conflict Management
Project conflict management identifies the source, stage, interests, power dynamics, and consequences of disagreement before selecting an appropriate resolution approach.
Project management · IntermediateProject Ethics and Professional Conduct
Project ethics and professional conduct guide decisions involving responsibility, respect, fairness, honesty, resources, people, data, suppliers, and the environment.
Project management · IntermediateProject Governance Structure
Project governance defines decision rights, oversight forums, approval thresholds, escalation paths, and accountability for a project across its life cycle.
Project governance · IntermediateProject Issue Management
Project issue management records active problems, assigns ownership, evaluates severity and impact, escalates when necessary, tracks resolution, and captures the final outcome.
Project management · IntermediateProject Issue Triage and Resolution
Project issue triage and resolution turns current problems into owned actions by assessing impact, urgency, root cause, options, dependencies, and escalation needs.
Project management · IntermediateProject Knowledge Transfer
Project knowledge transfer prepares people and organizations to operate, support, govern, and improve a delivered capability after project work changes hands.
Project risk management · IntermediateProject Opportunity Management
Project opportunity management identifies and acts on uncertain conditions that could improve value, capability, schedule, cost, quality, learning, or strategic position.
Project management · IntermediateProject Phase Closure
Project phase closure confirms completion or authorized termination, obtains acceptance, resolves obligations, transfers ownership, preserves records, releases resources, and captures lessons.
Project assurance · IntermediateProject Phase Gates
Project phase gates are formal decision points that determine whether work may proceed based on evidence, unresolved risk, readiness, resources, quality, and security obligations.
Project management · IntermediateProject Procurement Strategy
Project procurement strategy determines what work or capability should be obtained externally, how suppliers will be selected, how risk will be allocated, and how performance will be governed.
Project management · IntermediateProject Quality Planning
Project quality planning converts stakeholder needs, technical requirements, standards, and risk into measurable criteria, prevention activities, assurance methods, and acceptance evidence.
Project management · IntermediateProject Resource Planning
Project resource planning determines the people, skills, facilities, tools, services, and timing needed to perform work while accounting for availability and competing commitments.
Project risk management · IntermediateProject Risk Breakdown Structure
A project risk breakdown structure organizes sources of uncertainty into a hierarchy that supports systematic identification, analysis, ownership, and reporting.
Project risk management · IntermediateProject Risk Governance Roles
Project risk governance roles assign accountability for owning exposure, performing actions, facilitating analysis, approving resources, accepting residual risk, and escalating decisions.
Project risk management · IntermediateProject Risk Identification Workshops
Project risk identification workshops use structured facilitation and diverse perspectives to discover threats, opportunities, assumptions, dependencies, causes, and early warning conditions.
Project risk management · IntermediateProject Risk Management Plan
A project risk management plan documents the approach, roles, categories, scales, methods, cadence, reporting, reserves, escalation, and records used to manage uncertainty.
Project risk management · IntermediateProject Risk Management Strategy
A project risk management strategy establishes how uncertainty will be governed, integrated with decisions, resourced, communicated, and adapted across the project life cycle.
Project risk management · IntermediateProject Risk Monitoring and Closure
Project risk monitoring and closure track exposure, indicators, response progress, emerging risk, residual and secondary risk, and the evidence required to retire a risk responsibly.
Project risk management · IntermediateProject Risk Register
A project risk register is the controlled record of identified risks, analysis, owners, responses, indicators, decisions, status, and closure evidence.
Project risk management · IntermediateProject Risk Response Planning
Project risk response planning selects and designs actions that change probability, impact, exposure, ownership, or preparedness for threats and opportunities.
Project risk management · IntermediateProject Risk Statements
Project risk statements describe an uncertain event or condition, its cause or context, and the potential effect on one or more objectives.
Project management · IntermediateProject Stakeholder Engagement
Project stakeholder engagement identifies affected parties, understands their interests and influence, and creates deliberate participation throughout decisions and delivery.
Project management · IntermediateProject Team Ground Rules
Project team ground rules are explicit agreements about behavior, communication, decision-making, conflict, accountability, focus, and respectful collaboration.
Project management · IntermediateProject Value and Benefits Delivery
Project value and benefits delivery connects outputs to measurable outcomes, responsible owners, adoption conditions, timing, and continued verification after delivery.
Privacy principle · BeginnerPurpose Limitation
Purpose limitation requires personal data to be collected and used for specific, understandable purposes rather than reused without evaluation or authority.
Project risk management · IntermediateQualitative Project Risk Analysis
Qualitative project risk analysis prioritizes individual risks using agreed scales and factors such as probability, impact, urgency, proximity, detectability, and manageability.
Risk analysis · FoundationalQualitative and Quantitative Risk Analysis
Qualitative risk analysis uses descriptive judgments and ordered scales, while quantitative analysis uses numeric estimates, ranges, distributions, or monetary values to support decisions.
Project risk management · IntermediateQuantitative Project Risk Analysis
Quantitative project risk analysis uses numerical models and distributions to estimate combined uncertainty, outcome ranges, confidence levels, drivers, and the value of response options.
Accountability design · IntermediateRACI and Security Accountability
RACI and security accountability identify who is responsible, accountable, consulted, and informed for security decisions, evidence, remediation, acceptance, and operational ownership.
Privacy data governance · IntermediateRecords of Processing Activities
Records of processing activities organize accountable descriptions of personal-data processing, including purpose, categories, recipients, transfers, retention, safeguards, and owners.
Compliance response practice · AdvancedRegulatory Incident Reporting
Regulatory incident reporting identifies applicable notification duties, responsible authorities, required content, decision evidence, and deadlines for a specific organization and event.
Agile delivery · IntermediateRelative Estimation and Sizing
Relative estimation compares the effort, complexity, uncertainty, and risk of work items using shared reference points instead of pretending to know precise duration too early.
Analytic assurance · AdvancedReproducible Data Science
Reproducible data science enables an authorized reviewer to rerun an analysis with the documented data, code, environment, parameters, and random-state controls and obtain explainable results.
NIST CSF Subcategory profile · IntermediateReview Strategy Outcomes (GV.OV-01) — NIST CSF 2.0 Subcategory
Apply GV.OV-01 to achieve this CSF 2.0 outcome: Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction.
NIST CSF Subcategory profile · IntermediateReview and Update Cybersecurity Policy (GV.PO-02) — NIST CSF 2.0 Subcategory
Apply GV.PO-02 to achieve this CSF 2.0 outcome: Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission.
Risk decision concept · IntermediateRisk Appetite and Risk Tolerance
Risk appetite describes the amount and type of risk an organization is willing to pursue or retain, while risk tolerance defines acceptable variation around specific objectives.
NIST CSF Subcategory profile · IntermediateRisk Appetite and Tolerance (GV.RM-02) — NIST CSF 2.0 Subcategory
Apply GV.RM-02 to achieve this CSF 2.0 outcome: Risk appetite and risk tolerance statements are established, communicated, and maintained.
Project risk management · IntermediateRisk Appetite, Tolerance, and Thresholds
Risk appetite expresses the broad amount and type of uncertainty an organization is willing to pursue or retain, while tolerances and thresholds translate that position into actionable boundaries.
Project risk management · IntermediateRisk Escalation Triggers
Risk escalation triggers are predefined conditions that require a risk, decision, or response to move to a higher level of authority or broader organizational view.
NIST CSF Subcategory profile · IntermediateRisk Management Objectives (GV.RM-01) — NIST CSF 2.0 Subcategory
Apply GV.RM-01 to achieve this CSF 2.0 outcome: Risk management objectives are established and agreed to by organizational stakeholders.
NIST CSF Category profile · IntermediateRisk Management Strategy (GV.RM) — NIST CSF 2.0 Category
Use GV.RM to manage risk objectives, appetite, tolerance, assessment methods, communication, response direction, and strategic opportunity within the Govern Function.
Risk governance · FoundationalRisk Ownership
Risk ownership assigns an accountable person or role to understand a risk, sponsor treatment, monitor changes, and accept or escalate the remaining exposure within delegated authority.
Risk analysis method · AdvancedRisk Quantification
Risk quantification expresses uncertainty, frequency, and consequence in numerical terms so leaders can compare exposures and evaluate response options more consistently.
Risk management artifact · BeginnerRisk Register
A risk register is a maintained record of identified risks, their causes, impacts, owners, ratings, responses, status, and supporting evidence.
Risk response concept · BeginnerRisk Treatment Options
Common risk treatments are to avoid, mitigate, transfer or share, and accept the risk, with monitoring and ownership continuing after the decision.
Project risk management · IntermediateRisk Urgency and Proximity
Risk urgency reflects how quickly action is needed, while proximity describes how soon an uncertain event could occur or begin affecting objectives.
NIST CSF Subcategory profile · IntermediateRisk-Commensurate Resources (GV.RR-03) — NIST CSF 2.0 Subcategory
Apply GV.RR-03 to achieve this CSF 2.0 outcome: Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies.
NIST CSF Category profile · IntermediateRoles, Responsibilities, and Authorities (GV.RR) — NIST CSF 2.0 Category
Use GV.RR to manage leadership accountability, decision authority, role clarity, resources, and workforce integration within the Govern Function.
NIST CSF Subcategory profile · IntermediateRoles, Responsibilities, and Authorities (GV.RR-02) — NIST CSF 2.0 Subcategory
Apply GV.RR-02 to achieve this CSF 2.0 outcome: Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced.
Change resilience · IntermediateRollback and Backout Planning
Rollback and backout planning defines the conditions, data protection, technical steps, authority, timing, validation, and communication needed to reverse a change safely.
Assurance report · AdvancedSOC 2
SOC 2 reports provide independent assurance about a service organization’s controls relevant to security, availability, processing integrity, confidentiality, or privacy.
Project management · IntermediateSchedule Baseline Control
Schedule baseline control establishes an approved timing model and uses progress, dependencies, forecasts, and authorized changes to keep delivery expectations credible.
Project risk management · IntermediateSchedule Risk Analysis
Schedule risk analysis examines uncertainty in activity duration, dependencies, resources, calendars, rework, external events, and path convergence to estimate completion exposure.
Project management · IntermediateScope Baseline Integrity
Scope baseline integrity means approved deliverables, boundaries, acceptance conditions, and decomposition remain traceable and change only through authorized control.
Privacy engineering · AdvancedSecondary Use Governance
Secondary use governance controls whether data collected for one purpose may be reused for analytics, targeting, model development, research, sharing, or another objective.
Security assurance · IntermediateSecurity Acceptance Criteria
Security acceptance criteria define the measurable conditions, evidence, tolerances, and unresolved-risk decisions required before a feature, system, or project deliverable is accepted.
Program measurement practice · IntermediateSecurity Awareness Effectiveness
Security awareness effectiveness evaluates whether education and reinforcement change risky behavior, improve reporting, and reduce preventable exposure for specific audiences.
Configuration assurance · IntermediateSecurity Benchmark Compliance
Security benchmark compliance compares system configuration with approved hardening guidance, evaluates justified deviations, and verifies that remediation does not break required services.
Financial management practice · AdvancedSecurity Budgeting
Security budgeting translates strategy, risk, service commitments, staffing, technology, compliance, and resilience needs into a funded plan that can be governed and adjusted.
Investment analysis practice · AdvancedSecurity Business Cases and Return on Investment
A security business case explains the problem, options, expected outcomes, costs, risks, dependencies, and recommendation in a form decision makers can compare with other investments.
Strategy practice · IntermediateSecurity Business Value Drivers
Security business value drivers are the revenue, mission, safety, trust, resilience, legal, customer, and strategic outcomes that determine why a security investment matters.
Assurance activity · IntermediateSecurity Control Assessment
A security control assessment determines whether selected controls are implemented correctly, operating as intended, and producing the desired outcome.
Control model · BeginnerSecurity Control Categories and Types
Security controls can be grouped by implementation category and by function, helping practitioners select, explain, and evaluate safeguards.
Organizational practice · IntermediateSecurity Culture
Security culture is the pattern of real behavior created by leadership reactions, incentives, peer expectations, operating pressure, and the usability of security processes.
Leadership practice · IntermediateSecurity Leader One-on-Ones
Security leader one-on-ones create a recurring space to surface blockers, clarify priorities, exchange feedback, develop judgment, and strengthen trust without replacing team governance.
Leadership practice · IntermediateSecurity Leadership Coaching
Security leadership coaching uses structured observation, questions, feedback, practice, and accountability to improve judgment, performance, and ownership in security teams.
Leadership practice · AdvancedSecurity Leadership and Influence
Security leadership aligns people and decisions around risk, resilience, trust, and enterprise outcomes, often without direct authority over every contributing team.
Facilitation practice · IntermediateSecurity Meeting Facilitation
Security meeting facilitation structures purpose, participants, evidence, options, decisions, owners, and follow-up so meetings resolve issues instead of merely exchanging status.
Measurement practice · IntermediateSecurity Metrics
Security metrics should clarify coverage, exposure, control performance, resilience, and business consequence so that leaders can make better decisions.
Organizational design concept · AdvancedSecurity Operating Model
A security operating model defines how security work is organized, governed, delivered, funded, measured, and integrated across centralized and distributed teams.
Workforce practice · IntermediateSecurity Personnel Development and Retention
Security personnel development and retention use role clarity, coaching, growth paths, workload management, recognition, and succession depth to sustain security capability.
Measurement practice · IntermediateSecurity Policy Adoption Metrics
Security policy adoption metrics test whether affected groups understand, implement, and sustain required behavior, not merely whether a document was acknowledged.
Policy assurance concept · IntermediateSecurity Policy Drift
Security policy drift is the growing gap between approved intent and actual practice caused by technology, process, ownership, exceptions, workarounds, or organizational change.
Policy governance practice · IntermediateSecurity Policy Lifecycle
The security policy lifecycle governs conception, drafting, approval, communication, implementation, exception handling, measurement, review, revision, and retirement.
Policy concept · IntermediateSecurity Policy Principles
Security policy principles state durable intentions and decision boundaries that guide requirements even as technologies, structures, and procedures change.
Policy lifecycle practice · IntermediateSecurity Policy Retirement
Security policy retirement formally removes or supersedes obsolete requirements while preserving decision history, dependencies, communications, and any continuing obligations.
Policy design practice · IntermediateSecurity Policy Type Selection
Security policy type selection determines whether an issue needs an enterprise policy, topic-specific policy, standard, baseline, procedure, or guideline based on authority and use.
Policy assurance practice · IntermediateSecurity Policy Validation
Security policy validation uses pilots, stakeholder review, scenario testing, legal and operational checks, and evidence criteria before broad release.
Strategy execution practice · IntermediateSecurity Priority Setting
Security priority setting converts strategy and risk into a limited set of measurable outcomes, explicit tradeoffs, owners, and sequencing decisions that focus effort.
Supplier governance practice · AdvancedSecurity Procurement and Contracts
Security procurement integrates risk, architecture, privacy, resilience, assurance, and lifecycle requirements into sourcing and contract decisions.
Acquisition security practice · AdvancedSecurity Procurement and Vendor Selection
Security procurement incorporates protection, resilience, privacy, evidence, supply-chain, and lifecycle requirements into sourcing, evaluation, contracting, acceptance, and ongoing supplier oversight.
Program governance artifact · IntermediateSecurity Program Charter
A security program charter establishes the program's purpose, authority, scope, leadership, responsibilities, decision rights, and relationship to enterprise objectives.
Program management practice · AdvancedSecurity Program Management
Security program management coordinates strategy, governance, people, services, architecture, risk, operations, suppliers, assurance, investment, and improvement as one managed system.
Program assessment concept · IntermediateSecurity Program Maturity
Security program maturity describes how consistently and effectively capabilities are governed, performed, measured, improved, and adapted to changing needs.
Investment governance · IntermediateSecurity Project Business Cases
Security project business cases connect a proposed investment to mission need, risk reduction, benefits, costs, alternatives, dependencies, uncertainty, and measures of realized value.
Records governance · IntermediateSecurity Project Communication Records
Security project communication records preserve decisions, approvals, risks, actions, requirements, evidence, and sensitive correspondence with appropriate integrity, access, retention, and discoverability.
Program delivery practice · IntermediateSecurity Project Management
Security project management controls scope, schedule, dependencies, risk, acceptance evidence, and stakeholder commitments for work that changes security capability.
Project governance · IntermediateSecurity Project Scope Management
Security project scope management defines boundaries, deliverables, exclusions, assumptions, interfaces, acceptance, and controlled change so security obligations are neither omitted nor expanded informally.
Third-party governance · IntermediateSecurity Project Vendor Oversight
Security project vendor oversight verifies that external providers meet contractual security, evidence, access, delivery, change, incident, and transition obligations throughout the engagement.
Governance design practice · IntermediateSecurity Roles and Accountability
Security roles and accountability define who owns outcomes, makes decisions, performs work, provides advice, verifies results, and accepts remaining risk.
Stakeholder practice · IntermediateSecurity Stakeholder Mapping
Security stakeholder mapping identifies who owns outcomes, controls resources, bears risk, supplies expertise, can block change, and must understand or approve a decision.
Strategic management practice · AdvancedSecurity Strategy Alignment
Security strategy alignment connects protection priorities, capabilities, architecture, investment, and measures to enterprise mission, objectives, operating model, and risk appetite.
Service management · IntermediateService Consumer Roles
Service consumer roles distinguish customers who define requirements, users who interact with services, and sponsors who authorize budgets or resources.
Service management · IntermediateService Level Management Practice
Service level management sets business-based targets for service quality and experience, monitors actual performance, and uses continuing dialogue to improve both expectations and outcomes.
Service management · IntermediateService Offerings and Relationships
A service offering packages goods, access to resources, and service actions into a defined proposition, while the service relationship covers provision, consumption, and relationship management.
Service management · IntermediateService Outcomes, Outputs, Costs, and Risks
Service decisions should distinguish delivered outputs from stakeholder outcomes and should evaluate the costs and risks removed, introduced, or shared through the relationship.
Service management · IntermediateService Utility and Warranty
Utility describes what a service does to support a need, while warranty describes the assurance that it will be available, secure, continuous, and capable enough for the intended use.
Service management · IntermediateService Value Co-Creation
Service value co-creation is the joint process through which providers, consumers, users, sponsors, partners, and other stakeholders combine capabilities and decisions to produce useful outcomes.
Service governance artifact · IntermediateService-Level Agreements
A service-level agreement defines measurable service commitments, responsibilities, reporting, remedies, review processes, and escalation paths between a provider and customer.
Agile delivery · IntermediateSmall-Batch Delivery
Small-batch delivery limits the size of work moving through the system so value, quality, uncertainty, and feedback can be evaluated sooner.
Leadership practice · IntermediateStakeholder Engagement for Security
Stakeholder engagement identifies whose objectives, authority, knowledge, incentives, and support affect a security decision or program outcome.
Stakeholder practice · IntermediateStakeholder Expectation Management
Stakeholder expectation management turns needs, constraints, assumptions, deadlines, and decision rights into explicit commitments that can be reviewed and renegotiated.
NIST CSF Subcategory profile · IntermediateStakeholder Needs and Expectations (GV.OC-02) — NIST CSF 2.0 Subcategory
Apply GV.OC-02 to achieve this CSF 2.0 outcome: Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood.
NIST CSF Subcategory profile · IntermediateStandardized Risk Method (GV.RM-06) — NIST CSF 2.0 Subcategory
Apply GV.RM-06 to achieve this CSF 2.0 outcome: A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated.
Service management · IntermediateStart Where You Are Principle
Start where you are means assessing current services, data, practices, controls, skills, and results before replacing them, while refusing to preserve weak arrangements merely because they already exist.
Privacy engineering · AdvancedStatistical Disclosure Control
Statistical disclosure control reduces the chance that published statistics, tables, queries, or analytic outputs reveal confidential information about individuals or small groups.
NIST CSF Subcategory profile · IntermediateStrategic Opportunities (GV.RM-07) — NIST CSF 2.0 Subcategory
Apply GV.RM-07 to achieve this CSF 2.0 outcome: Strategic opportunities — positive risks — are characterized and are included in organizational cybersecurity risk discussions.
NIST CSF Subcategory profile · IntermediateStrategic Risk Response Direction (GV.RM-04) — NIST CSF 2.0 Subcategory
Apply GV.RM-04 to achieve this CSF 2.0 outcome: Strategic direction that describes appropriate risk response options is established and communicated.
NIST CSF Subcategory profile · IntermediateSupplier Due Diligence (GV.SC-06) — NIST CSF 2.0 Subcategory
Apply GV.SC-06 to achieve this CSF 2.0 outcome: Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships.
NIST CSF Subcategory profile · IntermediateSupply Chain Requirements in Agreements (GV.SC-05) — NIST CSF 2.0 Subcategory
Apply GV.SC-05 to achieve this CSF 2.0 outcome: Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties.
NIST CSF Subcategory profile · IntermediateSupply Chain Roles and Responsibilities (GV.SC-02) — NIST CSF 2.0 Subcategory
Apply GV.SC-02 to achieve this CSF 2.0 outcome: Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally.
Change-management practice · IntermediateSustaining Security Change
Sustaining security change embeds new behavior through ownership, cadence, reinforcement, recognition, measurement, training, and correction after initial attention fades.
AI and data governance · AdvancedSynthetic Data Governance
Synthetic data governance evaluates how generated records are produced, validated, labeled, shared, and protected, including whether they preserve sensitive patterns or distort intended use.
Assessment foundation · IntermediateSystem Boundary and Scope
A system boundary identifies the components, data, people, services, interfaces, and dependencies included in a security or privacy assessment.
Risk classification practice · AdvancedSystem Categorization and Impact Level
System categorization determines the potential impact of losing confidentiality, integrity, or availability for the information and services a system supports.
Network security governance · AdvancedTLS Inspection Governance
TLS inspection governance controls when encrypted traffic may be decrypted for security analysis, how trust is established, and how privacy, performance, compatibility, and key risk are managed.
Service management · IntermediateThink and Work Holistically
Think and work holistically treats products, services, people, partners, technology, information, controls, and value streams as an interacting system rather than isolated components.
Risk program · IntermediateThird-Party Cyber Risk Management
Third-party risk management identifies, evaluates, treats, monitors, and responds to cyber risk introduced by vendors, cloud services, software, partners, and other external dependencies.
Third-party risk practice · IntermediateThird-Party Privacy Risk
Third-party privacy risk arises when suppliers, partners, processors, platforms, or data recipients handle personal information on an organization’s behalf or for a shared purpose.
Program measurement practice · AdvancedThreat Intelligence Program Measurement
Threat intelligence program measurement evaluates whether intelligence changes decisions, improves defensive action, reduces uncertainty, or accelerates response.
Risk analysis practice · IntermediateThreat Scenario Prioritization
Threat scenario prioritization ranks credible actor, path, target, consequence, and control-failure combinations by relevance to the organization and decisions at hand.
Information-sharing protocol · IntermediateTraffic Light Protocol
The Traffic Light Protocol uses standardized labels to communicate how far potentially sensitive information may be shared by recipients.
Privacy risk assessment · AdvancedTransfer Impact Assessment
A transfer impact assessment evaluates the legal, operational, technical, and contextual risks of moving or permitting access to personal data across jurisdictions.
Agile delivery · IntermediateUser Story and Work Decomposition
User story and work decomposition divide large outcomes into coherent, testable slices that preserve user value and expose learning, dependencies, and risk.
Agile delivery · IntermediateValue Stream Mapping
Value stream mapping visualizes the steps, waits, decisions, handoffs, information, and feedback required to move from a need to a delivered outcome.
Service management · IntermediateValue Streams and Processes Dimension
The value streams and processes dimension explains how activities, decisions, controls, information, and handoffs combine to transform demand or opportunity into outcomes.
Third-party privacy · IntermediateVendor Privacy Due Diligence
Vendor privacy due diligence evaluates whether a provider’s processing, controls, governance, history, and supply chain are appropriate for the intended data and service risk.
Third-party governance practice · IntermediateVendor Security Negotiation
Vendor security negotiation uses requirements, evidence, leverage, alternatives, and contract terms to reach defensible security outcomes with suppliers.
Project management · IntermediateVirtual Project Team Management
Virtual project team management deliberately creates communication, coordination, trust, inclusion, security, and decision practices for people working across locations and time zones.
Agile delivery · IntermediateWork-in-Progress Limits
Work-in-progress limits constrain how many items can occupy defined workflow states so teams finish work, expose bottlenecks, and reduce delay.