US Interagency Sound Practices to Strengthen Operational Resilience A-GOV: Cyber governance: risk appetite and tolerance reflect accepted cyber risk, cyber risk management integrated with operational risk, defined roles including a responsible individual, a monitored and improved cybersecurity programme with independent oversight

What does A-GOV require?

Cyber governance practices from Appendix A: the firm's risk appetite and tolerance for disruption state how much cyber risk it will accept or avoid for its core business lines and critical operations; cyber risk management processes for those operations and lines are set up, run and folded into operational risk management, with cybersecurity processes that keep the firm within appetite and tolerance; roles for cyber risk are assigned, including one individual who is responsible for cybersecurity; a cybersecurity programme implements, monitors and updates existing processes and is itself monitored and improved; and independent risk management and internal or external audit oversee the programme.