NIST Cybersecurity Framework 2.0
GV - Govern

NIST Cybersecurity Framework 2.0 NIST-CSF-GV.RR-03: Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies

Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 42 controls across 21 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

NIST SP 800-53 Rev 5 · 8 controls

ISO/IEC 42001:2023 · 6 controls

  • 5.1 Leadership and commitment
  • 7.1 Resources
  • A.4 Resources for AI systems
  • A.4.2 Resource documentation
  • A.4.5 System and computing resources
  • A.4.6 Human resources

APRA CPS 220 Risk Management · 3 controls

  • CPS220-02 Board Responsibility for the Risk Management Framework
  • CPS220-10 Designated Risk Management Function
  • CPS220-P47 Minimum Assessment Required by the Framework Review

ISO 22301:2019 · 3 controls

  • 5.1 Leadership and commitment
  • 7.1 Resources
  • 8.3.4 Resource requirements

ISO 27701:2019 · 3 controls

  • 5.3.1 Leadership and commitment
  • 5.5 Support
  • 5.5.1 Resources

APRA SPS 220 Risk Management (Superannuation) · 2 controls

  • SPS220-16 Designated Risk Management Function
  • SPS220-P8 Board Responsibility for Solvency and Adequate Resources

Australian Information Security Manual · 2 controls

  • ISM-0732 Dedicated cyber security budget
  • ISM-2020 CISO oversight of cyber security workforce

NIST SP 800-161 Rev 1 · 2 controls

APRA CPS 230 Operational Risk Management · 1 control

  • CPS230-P41 BCP Execution Capability and Tolerance Breach Reporting

APRA CPS 234 · 1 control

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 1 control

  • CFTC-SS-23 Resources Sufficient to Fulfil Obligations

DORA · 1 control

FedRAMP High · 1 control

  • SA-2 Allocation of Resources

FedRAMP Moderate · 1 control

  • SA-2 Allocation of Resources

ISO 27001:2022 · 1 control

  • 5.4 Management responsibilities

ISO 27002:2022 · 1 control

  • 5.4 Management responsibilities

NIS2 Directive · 1 control

  • Art.20.1 Management body approves the cybersecurity risk-management measures and oversees their implementation

NIST Cybersecurity Framework 1.0 · 1 control

  • ID.RM-1 ID.RM-1: Risk management processes are established, managed, and agreed to by organizational stakeholders

NIST Cybersecurity Framework 1.1 · 1 control

  • ID.RM-1 ID.RM-1: Risk management processes are established, managed, and agreed to by organizational stakeholders

NIST SP 800-181 · 1 control

SOC 2 · 1 control

  • SOC2-CC1.4 CC1.4 Attracting, developing and retaining competent people (COSO principle 4)

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in GV - Govern

You are reading one control. How much of NIST Cybersecurity Framework 2.0 have you already done?

NIST Cybersecurity Framework 2.0 NIST-CSF-GV.RR-03 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of NIST Cybersecurity Framework 2.0 your existing evidence covers. Hold ISO 27001:2022 and 73 of 106 NIST Cybersecurity Framework 2.0 controls already carry evidence.

If you hold ISO 27001:202268.9% covered · 33 gapsIf you hold NIST SP 800-53 Rev 567.9% covered · 34 gapsIf you hold C5 (Germany)67% covered · 35 gapsIf you hold FedRAMP Moderate63.2% covered · 39 gapsIf you hold ISO 27002:202258.5% covered · 44 gapsIf you hold CIS Controls v853.8% covered · 49 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 174 were rejected on the ISO 27001:2022 pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 42 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll NIST Cybersecurity Framework 2.0 controls