GOV-1

Cyber Risk Strategy

Strategy

Control Statement

The organization has published a cyber risk strategy that is aligned with the technology and business strategies.

Description

A formal cyber risk strategy establishes the organization's approach to managing cyber risk in direct support of business objectives and technology direction. The strategy articulates how the organization will identify, assess, mitigate, and monitor cyber threats and vulnerabilities in a manner that supports the broader enterprise risk management framework. It ensures that cybersecurity investments, priorities, and risk tolerance decisions are driven by business needs rather than operating in isolation.

Key Implementation Activities

  • 1 Define and document a cyber risk strategy that explicitly references and supports the enterprise business strategy and technology roadmap
  • 2 Establish strategic cyber risk objectives with measurable outcomes tied to business value preservation and enablement
  • 3 Ensure the cyber risk strategy addresses the organization's threat landscape, including geopolitical, industry-specific, and technology-driven risks
  • 4 Communicate the strategy to all relevant stakeholders including executive leadership, the board, and operational teams
  • 5 Align cybersecurity investment priorities with business-critical processes and highest-risk areas identified in the strategy

Evidence Examples

  • Approved cyber risk strategy document with executive sign-off and publication date
  • Mapping document showing alignment between cyber risk strategy objectives and enterprise business/technology strategies
  • Board or executive committee meeting minutes documenting strategy review and approval
  • Annual strategy refresh documentation showing updates based on changes to business direction or threat landscape

Maturity Levels

Level 1 Initial

Cyber risk activities exist but are reactive and not guided by a formal strategy. No documented alignment to business or technology objectives.

Level 2 Managed

A formal cyber risk strategy is documented, approved by executive leadership, and explicitly aligned with the business and technology strategies. The strategy is communicated to stakeholders and reviewed periodically.

Level 3 Optimized

The cyber risk strategy is continuously refined based on threat intelligence, business changes, and performance metrics. It is deeply integrated with enterprise strategic planning cycles and informs resource allocation decisions.

Evidence Requirements View all evidence

Type Evidence Item Frequency Level
Document Approved Cyber Risk Strategy document with executive/Board sign-off Reviewed annually Required
Document Business strategy-to-cyber risk strategy alignment mapping or traceability matrix Updated with each strategy revision Required
Document Technology strategy-to-cyber risk strategy alignment mapping Updated with each strategy revision Required
Record Board or Executive Committee meeting minutes documenting strategy review and approval Per review cycle (at least annually) Required
Record Strategy communication records (distribution emails, briefing attendance, intranet publication) Per strategy update Expected
Record Annual strategy refresh documentation showing threat landscape and business change inputs Annually Expected

Framework Mappings

NIST CSF 2.0

GV.OC-01 GV.OC-02 GV.RM-01 GV.SC-01

ISO 27001:2022

5.1 5.2 6.2

COBIT 2019

APO02.01 APO02.04 EDM01.01

FFIEC CAT

Governance - Risk Management Strategy