GV.OV-03 Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed
Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed.
6
artefacts
1
held by a system
2
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Performance metrics catalog with targets and actuals · Policy repository / GRC workspace
periodic reviewEvidence produced at each review
- Internal audit reports on cyber program performance · Policy repository / GRC workspace
- Maturity assessment results (e.g., CSF tier ratings) · Policy repository / GRC workspace
governing documentDocuments that govern the control
- Continuous improvement backlog with prioritized items · Policy repository / GRC workspace
- Lessons learned from incidents driving performance adjustments · Policy repository / GRC workspace
- Executive scorecard tracking program performance over time · Policy repository / GRC workspace
First move
Mostly documents and reviews. Pull the 1 system-held artefact from your Policy repository / GRC workspace on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.
Common gaps auditors find
- Metrics measure activity (patches applied) rather than outcomes (risk reduced)
- Internal audit cycles too infrequent to influence direction
- Improvement backlog grows but nothing closes
- Maturity assessments performed but never compared year-over-year
- No formal channel from lessons learned to strategy
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetGV.OV-02 The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks · GV.PO-01 Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced