UK ONR Cyber Security and Information Assurance (CSIA) for Nuclear Facilities
SyDP 7.1 Effective cyber and information risk management – UK ONR Cyber Security and Information Assurance (CSIA) for Nuclear Facilities

UK ONR Cyber Security and Information Assurance (CSIA) for Nuclear Facilities 7.1-PREP: Prepare the organisation for CS&IA risk management

Senior leadership defines and approves a strategy for CS&IA risk that identifies legal, regulatory and business obligations, sets scope (including suppliers, partners and customers) and formally decides tolerance for disruption. A documented risk management methodology, aligned to relevant good practice such as the NIST Risk Management Framework or ISO/IEC 27005 and to enterprise risk management where it exists, drives policy and standards. Roles, ownership and governance are defined, resourced with suitably qualified and experienced personnel (SQEP) and given authority; the framework's output directs the security programme and investment. Inspectors look for business (not only technology) ownership of cyber risk, lines of defence, executive participation, and recognition of conflicting objectives such as cost control.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

Other controls in SyDP 7.1 Effective cyber and information risk management – UK ONR Cyber Security and Information Assurance (CSIA) for Nuclear Facilities

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll UK ONR Cyber Security and Information Assurance (CSIA) for Nuclear Facilities controls