[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fpm-9":3},{"item":4,"lessons":18,"controls":40,"related":63},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","pm-9","PM-9","Risk Management Strategy",5,"US National Institute of Standards and Technology (NIST)","**What it asks for.** The organisation must develop a comprehensive strategy to manage security and privacy risks, including risk tolerance, acceptable mitigation strategies and how risk is assessed and monitored, implement it consistently and review and update it periodically.\n\n**In practice.** This means a board or executive-approved risk management framework that states risk appetite, links cyber risk to enterprise risk management and defines how risks are escalated and accepted. Auditors expect the approved strategy, evidence it is applied in decisions and review records. NIS2 places explicit accountability for cyber risk management on management bodies, and ISO\u002FIEC 27001 and ISO 31000 offer similar structures.\n\n**Common gaps.** Risk appetite statements are often too vague to guide decisions. Cyber risk is sometimes managed separately from enterprise risk, so executives see an incomplete picture.","a. Develops a comprehensive strategy to manage:\n    1. Security risk to organizational operations and assets, individuals, other organizations, and the Nation associated with the operation and use of organizational systems; and\n    2. Privacy risk to individuals resulting from the authorized processing of personally identifiable information;\n  b. Implement the risk management strategy consistently across the organization; and\n  c. Review and update the risk management strategy [Assignment: organization-defined frequency] or as required, to address organizational changes.\nDiscussion: An organization-wide risk management strategy includes an expression of the security and privacy risk tolerance for the organization, security and privacy risk mitigation strategies, acceptable risk assessment methodologies, a process for evaluating security and privacy risk across the organization with respect to the organization’s risk tolerance, and approaches for monitoring risk over time. The senior accountable official for risk management (agency head or designated official) aligns information security management processes with strategic, operational, and budgetary planning processes. The risk executive function, led by the senior accountable official for risk management, can facilitate consistent application of the risk management strategy organization-wide. The risk management strategy can be informed by security and privacy risk-related inputs from other sources, both internal and external to the organization, to ensure that the strategy is broad-based and comprehensive. The supply chain risk management strategy described in [PM-30](#pm-30) can also provide useful inputs to the organization-wide risk management strategy.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36],{"slug":21,"title":22,"published_at":23},"edpb-calls-for-legal-basis-to-enable-cross-regulatory-information-sharing","EDPB Calls for Legal Basis to Enable Cross-Regulatory Information Sharing","2026-07-20T16:21:28.691+00:00",{"slug":25,"title":26,"published_at":27},"googles-41b-fine-upheld-a-costly-lesson-in-platform-compliance","Google's €4.1B Fine Upheld: A Costly Lesson in Platform Compliance","2026-07-02T16:21:13.769+00:00",{"slug":29,"title":30,"published_at":31},"ai-adoption-outpaces-governance-exposing-enterprises-to-major-compliance-risk","AI Adoption Outpaces Governance, Exposing Enterprises to Major Compliance Risk","2026-07-01T22:20:56.197+00:00",{"slug":33,"title":34,"published_at":35},"cjeu-rules-dpas-must-handle-complaints-regardless-of-parallel-court-proceedings","CJEU Rules DPAs Must Handle Complaints Regardless of Parallel Court Proceedings","2026-06-22T08:20:39.126+00:00",{"slug":37,"title":38,"published_at":39},"executive-overconfidence-creates-blind-spots-in-ai-risk-management","Executive Overconfidence Creates Blind Spots in AI Risk Management","2026-06-17T14:21:05.119+00:00",[41,46,51,55,59],{"slug":42,"name":43,"problem":44,"stories":45},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",2,{"slug":47,"name":48,"problem":49,"stories":50},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",1,{"slug":52,"name":53,"problem":54,"stories":50},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",{"slug":56,"name":57,"problem":58,"stories":50},"saas-security-posture","SaaS security posture management (SSPM)","Business apps like Microsoft 365 and Salesforce stop leaking through risky settings and connected apps.",{"slug":60,"name":61,"problem":62,"stories":50},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[64,69,74,79,83,87,91,96],{"family":65,"item":66,"code":67,"title":67,"together":68},"itil","overview","ITIL",4,{"family":70,"item":71,"code":72,"title":73,"together":45},"cis","18","Control 18","Penetration Testing",{"family":75,"item":76,"code":77,"title":78,"together":45},"iso","27701","ISO\u002FIEC 27701","ISO\u002FIEC 27701: Privacy information management systems",{"family":70,"item":80,"code":81,"title":82,"together":45},"14","Control 14","Security Awareness and Skills Training",{"family":75,"item":84,"code":85,"title":86,"together":45},"42001","ISO\u002FIEC 42001","ISO\u002FIEC 42001: Artificial intelligence management system",{"family":88,"item":66,"code":89,"title":90,"together":45},"nist-ai-rmf","AI RMF 1.0","AI Risk Management Framework (AI RMF 1.0)",{"family":92,"item":93,"code":94,"title":95,"together":50},"gdpr","5","Article 5(1)(f)","Principles relating to processing of personal data",{"family":92,"item":97,"code":98,"title":99,"together":50},"32","Article 32","Security of processing"]