Law / Frameworks / NIST CSF 2.0 / Govern
NIST CSF 2.0, GovernGV.RM-01
Risk management objectives are established and agreed to by organizational stakeholdersNIST Cybersecurity Framework, version 2.0, February 2024 (NIST CSWP 29), GV.RM-01
We read each law below as bearing on this control. That does not mean the control, done well, meets the law: what each law asks is on its own page. Law library as of .
- 1
- law
- 1
- jurisdiction
- 0
- with court rulings behind them
- 0
- not yet in force
Sector security regimes
1 law, 1 jurisdiction| Jurisdiction | Law | What it asks, as read here |
|---|---|---|
 European Union |
DORA, Articles 5-16 (ICT Risk Management Framework) |
Include in the framework a digital operational resilience strategy that explains how the framework supports your business strategy, sets the risk tolerance level for ICT risk and the impact tolerance for ICT disruptions, sets information security objectives with key performance indicators and key risk metrics, describes the ICT reference architecture, outlines the mechanisms to detect and prevent the impact of ICT-related incidents, provides for digital operational resilience testing, and outlines a communication strategy for incident disclosure (Article 6(8)). |
Full text of the NIST Cybersecurity Framework, public domain (a US government work). Every control of the framework.