GOV-2

Cyber Risk Framework

Framework

Control Statement

The organization has an established cyber risk framework (e.g., a complete set of elements including policies, standards, roles and responsibilities, risk management processes, risk taxonomy, risk appetite and emerging threats and technologies) in support of the cyber risk strategy, and ongoing threat, risk and incident management.

Description

A comprehensive cyber risk framework provides the structural foundation for all cybersecurity governance activities. It translates the high-level cyber risk strategy into actionable components: policies that set expectations, standards that define requirements, roles that assign accountability, processes that enable consistent risk management, a taxonomy that ensures common language, and a risk appetite statement that guides decision-making. The framework must also account for the dynamic nature of the threat environment, including emerging threats and new technologies that may introduce or alter risk profiles.

Key Implementation Activities

  • 1 Develop and maintain a comprehensive set of cyber risk policies, standards, and procedures that collectively implement the cyber risk strategy
  • 2 Define and document a cyber risk taxonomy that provides a common language for categorizing, assessing, and communicating risks across the organization
  • 3 Establish a formal risk appetite statement approved by executive leadership that defines acceptable levels of cyber risk across different business areas
  • 4 Implement risk management processes covering risk identification, assessment, treatment, monitoring, and reporting
  • 5 Integrate emerging threat and technology monitoring into the framework to ensure it remains current and forward-looking

Evidence Examples

  • Complete cyber risk framework documentation including all component policies, standards, and procedures
  • Approved risk appetite statement with defined thresholds and escalation criteria
  • Risk taxonomy document showing categorization scheme and alignment with enterprise risk management
  • Process documentation for threat monitoring, risk assessment, and incident management workflows
  • Evidence of framework review cycles and version history showing updates for emerging threats and technologies

Maturity Levels

Level 1 Initial

Individual policies or procedures may exist but are not organized into a cohesive framework. Risk appetite is informal or undefined. No standard risk taxonomy is in use.

Level 2 Managed

A comprehensive framework is documented and approved, encompassing policies, standards, roles, risk processes, taxonomy, and risk appetite. Emerging threats are monitored and the framework is reviewed on a defined schedule.

Level 3 Optimized

The framework is fully integrated with enterprise risk management, continuously updated based on threat intelligence and technology changes, and its effectiveness is measured through key indicators tied to the risk appetite.

Evidence Requirements View all evidence

Type Evidence Item Frequency Level
Document Complete Cyber Risk Framework document with all component elements Reviewed annually Required
Document Approved Risk Appetite Statement with defined thresholds Reviewed annually Required
Document Risk Taxonomy document with categorization scheme Reviewed annually Required
Document Policy and standards inventory showing all framework component documents with review dates Maintained continuously Required
Document Risk management process documentation (identification, assessment, treatment, monitoring, reporting) Reviewed annually Required
Record Framework version history showing updates for emerging threats and technologies Per update Expected
Record Emerging threat watch list with review records Quarterly Expected

Framework Mappings

NIST CSF 2.0

GV.OC-03 GV.RM-01 GV.RM-02 GV.RM-03 GV.RM-07

ISO 27001:2022

4.1 4.2 5.2 6.1 8.1

COBIT 2019

APO01.01 APO12.01 APO12.02 EDM03.01

FFIEC CAT

Governance - Risk Management Program