Establish cybersecurity governance and policy structures appropriate to retail industry characteristics per the NRF Cybersecurity and Data Privacy Framework guidance and supporting NIST CSF alignment. Governance must (a) name accountable executives (CISO + Chief Privacy Officer + Chief Risk Officer + Chief Operating Officer + Chief Marketing Officer + Chief Digital Officer where applicable) with documented decision authority, (b) maintain cyber and privacy policies covering acceptable use + access control + data classification + incident response + breach notification + third-party risk + PCI DSS scope + e-commerce + mobile + in-store technology + supply chain + retail-specific peak-season operations + fraud prevention, (c) align to NIST Cybersecurity Framework 2.0 functions (Govern + Identify + Protect + Detect + Respond + Recover) with retail-specific implementation tier targets, (d) regulatory change management covering PCI DSS + state breach notification laws (50 states + territories + jurisdictions) + state and federal privacy laws (CCPA + CPRA + VCDPA + CTDPA + UCPA + TIPA + similar) + sectoral obligations (CAN-SPAM + TCPA + COPPA + FCRA + FACTA + Sarbanes-Oxley for public retailers + SEC cyber disclosure + FTC Act 5(a) unfair/deceptive + DOJ + Treasury sanctions where applicable + international (GDPR + UK GDPR + LGPD + PIPEDA + Australian Privacy Act + Japan APPI + similar)). Review the programme annually + after material change to retail operations (new store formats + e-commerce launches + acquisitions + brand extensions + payment innovations).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.