GOV-6

Cyber Risk Policies

Framework

Control Statement

The organization has documented cyber risk policies to explain staff and contractor roles, responsibilities, rules and constraints as well as possible penalties for non-compliance.

Description

Documented cyber risk policies establish the behavioral expectations and compliance obligations for all personnel who interact with organizational information systems and data. Effective policies clearly articulate what is expected of staff and contractors, what actions are prohibited, how roles and responsibilities are assigned, and what consequences follow from policy violations. These policies must be communicated, acknowledged, and enforced to be effective, and they form the contractual and disciplinary basis for addressing non-compliance.

Key Implementation Activities

  • 1 Develop and maintain a comprehensive set of cyber risk policies covering acceptable use, data handling, access control, incident reporting, and other relevant domains
  • 2 Clearly define roles and responsibilities for all personnel categories including employees, contractors, temporary staff, and third-party users
  • 3 Specify rules, constraints, and prohibited activities with sufficient clarity to support consistent enforcement
  • 4 Document non-compliance consequences including disciplinary actions, contractual penalties, and potential legal implications
  • 5 Implement a policy acknowledgment process ensuring all personnel confirm they have read, understood, and agree to comply with policies

Evidence Examples

  • Complete set of cyber risk policies with approval signatures, effective dates, and version history
  • Policy acknowledgment records showing staff and contractor sign-offs with dates
  • RACI or responsibility matrix mapping cyber risk roles to specific individuals or positions
  • Non-compliance enforcement records demonstrating that consequences are applied consistently
  • Policy distribution and communication records (email notifications, intranet postings, training sessions)

Maturity Levels

Level 1 Initial

Some policies exist but are incomplete, outdated, or not communicated effectively. Roles and responsibilities are ambiguous. Non-compliance consequences are not defined or enforced.

Level 2 Managed

A comprehensive policy set is maintained, communicated to all personnel, and acknowledged formally. Roles, rules, and consequences are clearly documented. Policies are reviewed and updated on a defined schedule.

Level 3 Optimized

Policies are continuously improved based on incident lessons, compliance feedback, and industry best practices. Automated compliance monitoring verifies policy adherence. Policy effectiveness is measured through metrics and testing.

Evidence Requirements View all evidence

Type Evidence Item Frequency Level
Document Complete set of cyber risk policies with approval signatures, effective dates, and version control Reviewed per policy schedule Required
Document RACI or responsibility matrix mapping cyber risk roles to individuals/positions Reviewed annually Required
Record Policy acknowledgment records with staff and contractor signatures and dates Annual re-acknowledgment Required
Record Policy distribution and communication records Per policy update Required
Record Non-compliance enforcement actions demonstrating consistent application of consequences Per incident Expected
Record Policy review and update records showing periodic refresh Per policy review cycle Expected

Framework Mappings

NIST CSF 2.0

GV.PO-01 GV.PO-02 GV.RR-01

ISO 27001:2022

5.1 5.2 6.3 A.5.1 A.5.4 A.6.2

COBIT 2019

APO01.02 APO01.03 DSS06.03

FFIEC CAT

Governance - Policies