NIST Cybersecurity Framework 2.0
Govern

NIST Cybersecurity Framework 2.0 NIST-CSF-GV.OV-01: Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction

Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction

What else in your programme already covers this

This control maps to 80 controls across 28 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

ISO 22301:2019 · 6 controls

  • 10.1 Nonconformity and corrective action
  • 9.1 Monitoring, measurement, analysis and evaluation
  • 9.3 Management review
  • 9.3.1 General
  • 9.3.2 Management review input
  • 9.3.3 Management review outputs

NIST SP 800-53 Rev 5 · 6 controls

  • NIST800-CA-7 Continuous monitoring
  • NIST800-PM-1 Information Security Program Plan. Develop and disseminate an organization-wide information security program plan that: Provides an overview of the requirements for the security program and a description of the security program management controls and
  • NIST800-PM-31 Continuous Monitoring Strategy. Develop an organization-wide continuous monitoring strategy and implement continuous monitoring programs that include: Establishing the following organization-wide metrics to be monitored: [organization-defined]; Establishing [organization-defined] and [organization-defined] for control effectiveness; Ongoing monitoring
  • NIST800-PM-6 Measures of Performance. Develop, monitor, and report on the results of information security and privacy measures of performance
  • NIST800-PM-9 Risk Management Strategy. Develops a comprehensive strategy to manage: Security risk to organizational operations and assets, individuals, other organizations, and the Nation associated with the operation and use of organizational systems; and Privacy risk
  • NIST800-RA-7 Risk response

PCI DSS 4.0 · 6 controls

  • 10.4.1 Daily log review for critical systems
  • 11.3.1 Internal vulnerability scans quarterly
  • 12.1.2 The information security policy is: • Reviewed at least once every 12 months. • Updated as needed to reflect changes to business objectives or risks to the environment
  • 12.4.2 Quarterly PCI compliance reviews (SP)
  • 12.4.2.1 Documentation of quarterly reviews (SP)
  • 12.6.2 Security awareness program reviewed annually

APRA CPS 220 Risk Management · 5 controls

  • CPS220-11 Annual Audit Review of the Framework
  • CPS220-18 Triennial Comprehensive Review of the Framework
  • CPS220-20 Annual Board Risk Management Declaration
  • CPS220-P47 Minimum Assessment Required by the Framework Review
  • CPS220-P50 Qualification of the Risk Management Declaration

SOC 2 · 5 controls

  • SOC2-CC1.2 COSO principle 2: Board exercises oversight responsibility
  • SOC2-CC3.4 COSO principle 9: Identifies and assesses changes that could impact internal controls
  • SOC2-CC4.1 COSO principle 16: Selects and develops ongoing and separate evaluations
  • SOC2-CC4.2 COSO principle 17: Evaluates and communicates deficiencies in a timely manner
  • SOC2-CC9.1 Identifies, selects and develops risk mitigation activities

ISO 27001:2022 · 4 controls

  • 5.22 Monitoring, review and change management of supplier services
  • 5.27 Learning from information security incidents
  • 5.35 Independent review of information security
  • 5.36 Compliance with policies, rules and standards for information security

ISO 27002:2022 · 4 controls

  • 5.22 Monitoring, review and change management of supplier services
  • 5.27 Learning from information security incidents
  • 5.35 Independent review of information security
  • 5.36 Compliance with policies, rules and standards for information security

ISO/IEC 42001:2023 · 4 controls

  • 10.1 Continual improvement
  • 9.3 Management review
  • 9.3.1 General
  • 9.3.3 Management review results

APRA CPS 230 Operational Risk Management · 3 controls

  • CPS230-66 Review of Operational Risk Management
  • CPS230-8 Board Oversight, Approval of the BCP, Tolerance Levels and Service Provider Policy
  • CPS230-P23 Senior Management Information to the Board on Resilience Decisions

APRA CPS 234 · 3 controls

  • CPS234-13 Board Responsibility for Information Security
  • CPS234-28 Escalation of Unremediated Testing Deficiencies
  • CPS234-P17 Active Maintenance of Capability Against Change

APRA SPS 220 Risk Management (Superannuation) · 3 controls

  • SPS220-28 Annual Board Risk Management Declaration
  • SPS220-44 APRA Notification of Framework Breach within 10 Business Days
  • SPS220-P34 Content of a Qualified Risk Management Declaration

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 3 controls

  • CFTC-SS-1 Program of Risk Analysis and Oversight
  • CFTC-SS-2 Enterprise Risk Management and Governance Category
  • CFTC-SS-36 Internal Reporting and Review by Senior Management and the Board

FedRAMP High · 3 controls

  • CA-2 Control Assessments
  • CA-7 Continuous Monitoring
  • RA-3 Risk Assessment

FedRAMP Moderate · 3 controls

  • CA-2 Control Assessments
  • CA-7 Continuous Monitoring
  • RA-3 Risk Assessment

NIST SP 800-53 Rev 5 LOW · 3 controls

  • CA-2 Control Assessments
  • CA-7 Continuous Monitoring
  • RA-3 Risk Assessment

NIST SP 800-53 Rev 5 MODERATE · 3 controls

  • CA-2 Control Assessments
  • CA-7 Continuous Monitoring
  • RA-3 Risk Assessment

NIST SP 800-53 Revision 5.1 HIGH · 3 controls

  • CA-2 Control Assessments
  • CA-7 Continuous Monitoring
  • RA-3 Risk Assessment

ASIC Cyber Resilience Good Practices · 2 controls

ISO 27701:2019 · 2 controls

  • 5.7.3 Management review
  • 6.15.2 Information security reviews

ASEAN Data Management Framework · 1 control

  • ADMF-6.2 Review controls associated with each category

Australian Information Security Manual · 1 control

  • ISM-2000 The board of directors or executive committee seeks regular briefings or reporting on the

C5 (Germany) · 1 control

  • C5-COM-04 Information on information security performance and management assessment of the ISMS

CIS Controls v8 · 1 control

  • CIS-7.2 Establish and Maintain a Remediation Process

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 1 control

HIPAA Security Rule · 1 control

NIS2 Directive · 1 control

  • Art.20.1 Management body approves the cybersecurity risk-management measures and oversees their implementation

NIST SP 800-161 Rev 1 · 1 control

NIST SP 800-66 Rev 2 · 1 control

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Govern

You are reading one control. How much of NIST Cybersecurity Framework 2.0 have you already done?

NIST Cybersecurity Framework 2.0 NIST-CSF-GV.OV-01 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of NIST Cybersecurity Framework 2.0 your existing evidence covers. Hold ISO 27001:2022 and 73 of 106 NIST Cybersecurity Framework 2.0 controls already carry evidence.

If you hold ISO 27001:202268.9% covered · 33 gapsIf you hold NIST SP 800-53 Rev 567.9% covered · 34 gapsIf you hold C5 (Germany)67% covered · 35 gapsIf you hold FedRAMP Moderate63.2% covered · 39 gapsIf you hold ISO 27002:202258.5% covered · 44 gapsIf you hold CIS Controls v853.8% covered · 49 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 174 were rejected on the ISO 27001:2022 pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 80 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll NIST Cybersecurity Framework 2.0 controls