Law / Frameworks / NIST CSF 2.0 / Govern
NIST CSF 2.0, GovernGV.RM-02
Risk appetite and risk tolerance statements are established, communicated, and maintainedNIST Cybersecurity Framework, version 2.0, February 2024 (NIST CSWP 29), GV.RM-02
We read each law below as bearing on this control. That does not mean the control, done well, meets the law: what each law asks is on its own page. Law library as of .
- 3
- laws
- 3
- jurisdictions
- 0
- with court rulings behind them
- 0
- not yet in force
Sector security regimes
3 laws, 3 jurisdictions| Jurisdiction | Law | What it asks, as read here |
|---|---|---|
 Canada |
OSFI Guideline B-13, Technology and Cyber Risk Management |
Define, document, approve and implement a strategic technology and cyber plan aligned to your business strategy, and establish a technology and cyber risk management framework that sets a risk appetite and defines how technology and cyber risks are identified, assessed, managed, monitored and reported. |
 Czech Republic |
Decree on the Security Measures of a Provider of a Regulated Service in the Lower-Obligations Regime (Vyhláška č. 410/2025 Sb.) |
Set the tolerable level of harm from a cybersecurity incident and the areas for assessing the significance of an incident's impact on the regulated service (Section 14). |
 European Union |
DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework |
Develop, document and implement ICT risk management policies and procedures that contain the approved risk tolerance level for ICT risk, a procedure and a methodology to conduct the ICT risk assessment, ICT risk treatment measures, and provisions on the review of accepted residual ICT risks at least once a year (Article 3). |
Full text of the NIST Cybersecurity Framework, public domain (a US government work). Every control of the framework.