GV.OCOrganisatorischer Kontext (Organizational Context)
Mission, Erwartungen der Stakeholder, Abhängigkeiten sowie rechtliche, regulatorische und vertragliche Anforderungen rund um die Risikoentscheidungen werden verstanden.
GV.OC-01Die Mission der Organisation wird verstanden und fließt in das Cybersicherheits-Risikomanagement ein.
Eigenrisiko NIST-Originalwortlaut: The organizational mission is understood and informs cybersecurity risk management
Umsetzungsbeispiele (1)
- Share the organization's mission (e.g., through vision and mission statements, marketing, and service strategies) to provide a basis for identifying risks that may impede that mission
GV.OC-02Interne und externe Stakeholder werden verstanden; ihre Bedürfnisse und Erwartungen an das Cybersicherheits-Risikomanagement werden berücksichtigt.
EigenrisikoDrittrisiko NIST-Originalwortlaut: Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered
Umsetzungsbeispiele (2)
- Identify relevant internal stakeholders and their cybersecurity-related expectations (e.g., performance and risk expectations of officers, directors, and advisors; cultural expectations of employees)
- Identify relevant external stakeholders and their cybersecurity-related expectations (e.g., privacy expectations of customers, business expectations of partnerships, compliance expectations of regulators, ethics expectations of society)
GV.OC-03Rechtliche, regulatorische und vertragliche Anforderungen – einschließlich Datenschutz und Bürgerrechte – werden verstanden und gesteuert.
EigenrisikoDrittrisiko NIST-Originalwortlaut: Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
Umsetzungsbeispiele (3)
- Determine a process to track and manage legal and regulatory requirements regarding protection of individuals' information (e.g., Health Insurance Portability and Accountability Act, California Consumer Privacy Act, General Data Protection Regulation)
- Determine a process to track and manage contractual requirements for cybersecurity management of supplier, customer, and partner information
- Align the organization's cybersecurity strategy with legal, regulatory, and contractual requirements
GV.OC-04Kritische Ziele, Fähigkeiten und Dienste, die externe Stakeholder von der Organisation erwarten, werden verstanden und kommuniziert.
EigenrisikoDrittrisiko NIST-Originalwortlaut: Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated
Umsetzungsbeispiele (3)
- Establish criteria for determining the criticality of capabilities and services as viewed by internal and external stakeholders
- Determine (e.g., from a business impact analysis) assets and business operations that are vital to achieving mission objectives and the potential impact of a loss (or partial loss) of such operations
- Establish and communicate resilience objectives (e.g., recovery time objectives) for delivering critical capabilities and services in various operating states (e.g., under attack, during recovery, normal operation)
GV.OC-05Ergebnisse, Fähigkeiten und Dienste, von denen die Organisation abhängt, werden verstanden und kommuniziert.
Drittrisiko NIST-Originalwortlaut: Outcomes, capabilities, and services that the organization depends on are understood and communicated
Umsetzungsbeispiele (2)
- Create an inventory of the organization's dependencies on external resources (e.g., facilities, cloud-based hosting providers) and their relationships to organizational assets and business functions
- Identify and document external dependencies that are potential points of failure for the organization's critical capabilities and services, and share that information with appropriate personnel
GV.RMRisikomanagementstrategie (Risk Management Strategy)
Prioritäten, Einschränkungen, Risikobereitschaft und -toleranz sowie Annahmen werden festgelegt, kommuniziert und für operative Risikoentscheidungen genutzt.
GV.RM-01Ziele des Risikomanagements werden festgelegt und von den Stakeholdern vereinbart.
Eigenrisiko NIST-Originalwortlaut: Risk management objectives are established and agreed to by organizational stakeholders
Umsetzungsbeispiele (3)
- Update near-term and long-term cybersecurity risk management objectives as part of annual strategic planning and when major changes occur
- Establish measurable objectives for cybersecurity risk management (e.g., manage the quality of user training, ensure adequate risk protection for industrial control systems)
- Senior leaders agree about cybersecurity objectives and use them for measuring and managing risk and performance
GV.RM-02Aussagen zu Risikobereitschaft und Risikotoleranz werden festgelegt, kommuniziert und gepflegt.
EigenrisikoDrittrisiko NIST-Originalwortlaut: Risk appetite and risk tolerance statements are established, communicated, and maintained
Umsetzungsbeispiele (3)
- Determine and communicate risk appetite statements that convey expectations about the appropriate level of risk for the organization
- Translate risk appetite statements into specific, measurable, and broadly understandable risk tolerance statements
- Refine organizational objectives and risk appetite periodically based on known risk exposure and residual risk
GV.RM-03Aktivitäten und Ergebnisse des Cybersicherheits-Risikomanagements sind in das unternehmensweite Risikomanagement eingebunden.
Eigenrisiko NIST-Originalwortlaut: Cybersecurity risk management activities and outcomes are included in enterprise risk management processes
Umsetzungsbeispiele (3)
- Aggregate and manage cybersecurity risks alongside other enterprise risks (e.g., compliance, financial, operational, regulatory, reputational, safety)
- Include cybersecurity risk managers in enterprise risk management planning
- Establish criteria for escalating cybersecurity risks within enterprise risk management
GV.RM-04Eine strategische Ausrichtung mit geeigneten Optionen zur Risikobehandlung wird festgelegt und kommuniziert.
Eigenrisiko NIST-Originalwortlaut: Strategic direction that describes appropriate risk response options is established and communicated
Umsetzungsbeispiele (3)
- Specify criteria for accepting and avoiding cybersecurity risk for various classifications of data
- Determine whether to purchase cybersecurity insurance
- Document conditions under which shared responsibility models are acceptable (e.g., outsourcing certain cybersecurity functions, having a third party perform financial transactions on behalf of the organization, using public cloud-based services)
GV.RM-05Kommunikationswege für Cybersicherheitsrisiken – auch von Lieferanten und Dritten – werden organisationsweit etabliert.
EigenrisikoDrittrisiko NIST-Originalwortlaut: Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties
Umsetzungsbeispiele (2)
- Determine how to update senior executives, directors, and management on the organization's cybersecurity posture at agreed-upon intervals
- Identify how all departments across the organization - such as management, operations, internal auditors, legal, acquisition, physical security, and HR - will communicate with each other about cybersecurity risks
GV.RM-06Eine standardisierte Methode zur Berechnung, Dokumentation, Kategorisierung und Priorisierung von Risiken wird festgelegt und kommuniziert.
Eigenrisiko NIST-Originalwortlaut: A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated
Umsetzungsbeispiele (4)
- Establish criteria for using a quantitative approach to cybersecurity risk analysis, and specify probability and exposure formulas
- Create and use templates (e.g., a risk register) to document cybersecurity risk information (e.g., risk description, exposure, treatment, and ownership)
- Establish criteria for risk prioritization at the appropriate levels within the enterprise
- Use a consistent list of risk categories to support integrating, aggregating, and comparing cybersecurity risks
GV.RM-07Strategische Chancen (positive Risiken) werden charakterisiert und in die Risikodiskussion einbezogen.
Eigenrisiko NIST-Originalwortlaut: Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions
Umsetzungsbeispiele (3)
- Define and communicate guidance and methods for identifying opportunities and including them in risk discussions (e.g., strengths, weaknesses, opportunities, and threats [SWOT] analysis)
- Identify stretch goals and document them
- Calculate, document, and prioritize positive risks alongside negative risks
GV.RRRollen, Verantwortlichkeiten und Befugnisse (Roles, Responsibilities, and Authorities)
Cybersicherheitsrollen, -verantwortlichkeiten und -befugnisse werden zur Förderung von Rechenschaft und kontinuierlicher Verbesserung festgelegt und kommuniziert.
GV.RR-01Die Führung trägt Verantwortung für Cybersicherheitsrisiken und fördert eine risikobewusste, ethische und sich stetig verbessernde Kultur.
Eigenrisiko NIST-Originalwortlaut: Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving
Umsetzungsbeispiele (4)
- Leaders (e.g., directors) agree on their roles and responsibilities in developing, implementing, and assessing the organization's cybersecurity strategy
- Share leaders' expectations regarding a secure and ethical culture, especially when current events present the opportunity to highlight positive or negative examples of cybersecurity risk management
- Leaders direct the CISO to maintain a comprehensive cybersecurity risk strategy and review and update it at least annually and after major events
- Conduct reviews to ensure adequate authority and coordination among those responsible for managing cybersecurity risk
GV.RR-02Rollen, Verantwortlichkeiten und Befugnisse im Risikomanagement werden festgelegt, kommuniziert, verstanden und durchgesetzt.
Eigenrisiko NIST-Originalwortlaut: Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced
Umsetzungsbeispiele (5)
- Document risk management roles and responsibilities in policy
- Document who is responsible and accountable for cybersecurity risk management activities and how those teams and individuals are to be consulted and informed
- Include cybersecurity responsibilities and performance requirements in personnel descriptions
- Document performance goals for personnel with cybersecurity risk management responsibilities, and periodically measure performance to identify areas for improvement
- Clearly articulate cybersecurity responsibilities within operations, risk functions, and internal audit functions
GV.RR-03Angemessene Ressourcen werden entsprechend Strategie, Rollen, Verantwortlichkeiten und Richtlinien bereitgestellt.
EigenrisikoDrittrisiko NIST-Originalwortlaut: Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies
Umsetzungsbeispiele (3)
- Conduct periodic management reviews to ensure that those given cybersecurity risk management responsibilities have the necessary authority
- Identify resource allocation and investment in line with risk tolerance and response
- Provide adequate and sufficient people, process, and technical resources to support the cybersecurity strategy
GV.RR-04Cybersicherheit ist Bestandteil der Personalpraktiken.
Eigenrisiko NIST-Originalwortlaut: Cybersecurity is included in human resources practices
Umsetzungsbeispiele (4)
- Integrate cybersecurity risk management considerations into human resources processes (e.g., personnel screening, onboarding, change notification, offboarding)
- Consider cybersecurity knowledge to be a positive factor in hiring, training, and retention decisions
- Conduct background checks prior to onboarding new personnel for sensitive roles, and periodically repeat background checks for personnel with such roles
- Define and enforce obligations for personnel to be aware of, adhere to, and uphold security policies as they relate to their roles
GV.PORichtlinien (Policy)
Die Cybersicherheitsrichtlinie der Organisation wird festgelegt, kommuniziert und durchgesetzt.
GV.PO-01Eine Richtlinie zum Management von Cybersicherheitsrisiken wird auf Basis von Kontext, Strategie und Prioritäten festgelegt, kommuniziert und durchgesetzt.
Eigenrisiko NIST-Originalwortlaut: Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
Umsetzungsbeispiele (5)
- Create, disseminate, and maintain an understandable, usable risk management policy with statements of management intent, expectations, and direction
- Periodically review policy and supporting processes and procedures to ensure that they align with risk management strategy objectives and priorities, as well as the high-level direction of the cybersecurity policy
- Require approval from senior management on policy
- Communicate cybersecurity risk management policy and supporting processes and procedures across the organization
- Require personnel to acknowledge receipt of policy when first hired, annually, and whenever policy is updated
GV.PO-02Die Richtlinie wird überprüft, aktualisiert, kommuniziert und durchgesetzt, um Änderungen von Anforderungen, Bedrohungen, Technologie und Mission abzubilden.
Eigenrisiko NIST-Originalwortlaut: Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission
Umsetzungsbeispiele (4)
- Update policy based on periodic reviews of cybersecurity risk management results to ensure that policy and supporting processes and procedures adequately maintain risk at an acceptable level
- Provide a timeline for reviewing changes to the organization's risk environment (e.g., changes in risk or in the organization's mission objectives), and communicate recommended policy updates
- Update policy to reflect changes in legal and regulatory requirements
- Update policy to reflect changes in technology (e.g., adoption of artificial intelligence) and changes to the business (e.g., acquisition of a new business, new contract requirements)
GV.OVAufsicht (Oversight)
Ergebnisse und Leistung des organisationsweiten Risikomanagements werden genutzt, um die Strategie zu informieren, zu verbessern und anzupassen.
GV.OV-01Ergebnisse der Risikomanagementstrategie werden überprüft, um Strategie und Ausrichtung anzupassen.
Eigenrisiko NIST-Originalwortlaut: Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction
Umsetzungsbeispiele (2)
- Measure how well the risk management strategy and risk results have helped leaders make decisions and achieve organizational objectives
- Examine whether cybersecurity risk strategies that impede operations or innovation should be adjusted
GV.OV-02Die Risikomanagementstrategie wird überprüft und angepasst, um Abdeckung der Anforderungen und Risiken sicherzustellen.
Eigenrisiko NIST-Originalwortlaut: The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks
Umsetzungsbeispiele (3)
- Review audit findings to confirm whether the existing cybersecurity strategy has ensured compliance with internal and external requirements
- Review the performance oversight of those in cybersecurity-related roles to determine whether policy changes are necessary
- Review strategy in light of cybersecurity incidents
GV.OV-03Die Leistung des Cybersicherheits-Risikomanagements wird bewertet und auf notwendige Anpassungen überprüft.
Eigenrisiko NIST-Originalwortlaut: Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed
Umsetzungsbeispiele (3)
- Review key performance indicators (KPIs) to ensure that organization-wide policies and procedures achieve objectives
- Review key risk indicators (KRIs) to identify risks the organization faces, including likelihood and potential impact
- Collect and communicate metrics on cybersecurity risk management with senior leadership
GV.SCRisikomanagement der Cyber-Lieferkette (Cybersecurity Supply Chain Risk Management)
Risikomanagementprozesse für die Cyber-Lieferkette werden identifiziert, etabliert, gesteuert, überwacht und verbessert.
GV.SC-01Ein Programm, eine Strategie, Ziele, Richtlinien und Prozesse für das Lieferketten-Risikomanagement werden festgelegt und vereinbart.
Drittrisiko NIST-Originalwortlaut: A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders
Umsetzungsbeispiele (4)
- Establish a strategy that expresses the objectives of the cybersecurity supply chain risk management program
- Develop the cybersecurity supply chain risk management program, including a plan (with milestones), policies, and procedures that guide implementation and improvement of the program, and share the policies and procedures with the organizational stakeholders
- Develop and implement program processes based on the strategy, objectives, policies, and procedures that are agreed upon and performed by the organizational stakeholders
- Establish a cross-organizational mechanism that ensures alignment between functions that contribute to cybersecurity supply chain risk management, such as cybersecurity, IT, operations, legal, human resources, and engineering
GV.SC-02Cybersicherheitsrollen und -verantwortlichkeiten für Lieferanten, Kunden und Partner werden festgelegt, kommuniziert und abgestimmt.
Drittrisiko NIST-Originalwortlaut: Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally
Umsetzungsbeispiele (8)
- Identify one or more specific roles or positions that will be responsible and accountable for planning, resourcing, and executing cybersecurity supply chain risk management activities
- Document cybersecurity supply chain risk management roles and responsibilities in policy
- Create responsibility matrixes to document who will be responsible and accountable for cybersecurity supply chain risk management activities and how those teams and individuals will be consulted and informed
- Include cybersecurity supply chain risk management responsibilities and performance requirements in personnel descriptions to ensure clarity and improve accountability
- Document performance goals for personnel with cybersecurity risk management-specific responsibilities, and periodically measure them to demonstrate and improve performance
- Develop roles and responsibilities for suppliers, customers, and business partners to address shared responsibilities for applicable cybersecurity risks, and integrate them into organizational policies and applicable third-party agreements
- Internally communicate cybersecurity supply chain risk management roles and responsibilities for third parties
- Establish rules and protocols for information sharing and reporting processes between the organization and its suppliers
GV.SC-03Das Lieferketten-Risikomanagement ist in Cybersicherheits- und Unternehmensrisikomanagement, Risikobewertung und Verbesserung integriert.
Drittrisiko NIST-Originalwortlaut: Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes
Umsetzungsbeispiele (4)
- Identify areas of alignment and overlap with cybersecurity and enterprise risk management
- Establish integrated control sets for cybersecurity risk management and cybersecurity supply chain risk management
- Integrate cybersecurity supply chain risk management into improvement processes
- Escalate material cybersecurity risks in supply chains to senior management, and address them at the enterprise risk management level
GV.SC-04Lieferanten sind bekannt und werden nach Kritikalität priorisiert.
Drittrisiko NIST-Originalwortlaut: Suppliers are known and prioritized by criticality
Umsetzungsbeispiele (2)
- Develop criteria for supplier criticality based on, for example, the sensitivity of data processed or possessed by suppliers, the degree of access to the organization's systems, and the importance of the products or services to the organization's mission
- Keep a record of all suppliers, and prioritize suppliers based on the criticality criteria
GV.SC-05Anforderungen zur Behandlung von Lieferkettenrisiken werden festgelegt, priorisiert und in Verträge mit Lieferanten und Dritten integriert.
Drittrisiko NIST-Originalwortlaut: Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
Umsetzungsbeispiele (10)
- Establish security requirements for suppliers, products, and services commensurate with their criticality level and potential impact if compromised
- Include all cybersecurity and supply chain requirements that third parties must follow and how compliance with the requirements may be verified in default contractual language
- Define the rules and protocols for information sharing between the organization and its suppliers and sub-tier suppliers in agreements
- Manage risk by including security requirements in agreements based on their criticality and potential impact if compromised
- Define security requirements in service-level agreements (SLAs) for monitoring suppliers for acceptable security performance throughout the supplier relationship lifecycle
- Contractually require suppliers to disclose cybersecurity features, functions, and vulnerabilities of their products and services for the life of the product or the term of service
- Contractually require suppliers to provide and maintain a current component inventory (e.g., software or hardware bill of materials) for critical products
- Contractually require suppliers to vet their employees and guard against insider threats
- Contractually require suppliers to provide evidence of performing acceptable security practices through, for example, self-attestation, conformance to known standards, certifications, or inspections
- Specify in contracts and other agreements the rights and responsibilities of the organization, its suppliers, and their supply chains, with respect to potential cybersecurity risks
GV.SC-06Planung und Due Diligence werden durchgeführt, um Risiken vor Eingehen formaler Lieferanten- oder Drittbeziehungen zu reduzieren.
Drittrisiko NIST-Originalwortlaut: Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships
Umsetzungsbeispiele (4)
- Perform thorough due diligence on prospective suppliers that is consistent with procurement planning and commensurate with the level of risk, criticality, and complexity of each supplier relationship
- Assess the suitability of the technology and cybersecurity capabilities and the risk management practices of prospective suppliers
- Conduct supplier risk assessments against business and applicable cybersecurity requirements
- Assess the authenticity, integrity, and security of critical products prior to acquisition and use
GV.SC-07Risiken durch Lieferanten, deren Produkte/Dienste und Dritte werden über die Beziehung hinweg verstanden, erfasst, priorisiert, bewertet, behandelt und überwacht.
Drittrisiko NIST-Originalwortlaut: The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship
Umsetzungsbeispiele (5)
- Adjust assessment formats and frequencies based on the third party's reputation and the criticality of the products or services they provide
- Evaluate third parties' evidence of compliance with contractual cybersecurity requirements, such as self-attestations, warranties, certifications, and other artifacts
- Monitor critical suppliers to ensure that they are fulfilling their security obligations throughout the supplier relationship lifecycle using a variety of methods and techniques, such as inspections, audits, tests, or other forms of evaluation
- Monitor critical suppliers, services, and products for changes to their risk profiles, and reevaluate supplier criticality and risk impact accordingly
- Plan for unexpected supplier and supply chain-related interruptions to ensure business continuity
GV.SC-08Relevante Lieferanten und Dritte werden in Vorfallplanung, -reaktion und -wiederherstellung einbezogen.
Drittrisiko NIST-Originalwortlaut: Relevant suppliers and other third parties are included in incident planning, response, and recovery activities
Umsetzungsbeispiele (5)
- Define and use rules and protocols for reporting incident response and recovery activities and the status between the organization and its suppliers
- Identify and document the roles and responsibilities of the organization and its suppliers for incident response
- Include critical suppliers in incident response exercises and simulations
- Define and coordinate crisis communication methods and protocols between the organization and its critical suppliers
- Conduct collaborative lessons learned sessions with critical suppliers
GV.SC-09Sicherheitspraktiken der Lieferkette sind in die Programme integriert; ihre Leistung wird über den gesamten Lebenszyklus überwacht.
Drittrisiko NIST-Originalwortlaut: Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle
Umsetzungsbeispiele (5)
- Policies and procedures require provenance records for all acquired technology products and services
- Periodically provide risk reporting to leaders about how acquired components are proven to be untampered and authentic
- Communicate regularly among cybersecurity risk managers and operations personnel about the need to acquire software patches, updates, and upgrades only from authenticated and trustworthy software providers
- Review policies to ensure that they require approved supplier personnel to perform maintenance on supplier products
- Policies and procedure require checking upgrades to critical hardware for unauthorized changes
GV.SC-10Pläne für das Lieferketten-Risikomanagement enthalten Regelungen für Aktivitäten nach Ende einer Partnerschaft oder Dienstvereinbarung.
Drittrisiko NIST-Originalwortlaut: Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement
Umsetzungsbeispiele (7)
- Establish processes for terminating critical relationships under both normal and adverse circumstances
- Define and implement plans for component end-of-life maintenance support and obsolescence
- Verify that supplier access to organization resources is deactivated promptly when it is no longer needed
- Verify that assets containing the organization's data are returned or properly disposed of in a timely, controlled, and safe manner
- Develop and execute a plan for terminating or transitioning supplier relationships that takes supply chain security risk and resiliency into account
- Mitigate risks to data and systems created by supplier termination
- Manage data leakage risks associated with supplier termination