What it asks for. This category asks that results of organisation-wide cybersecurity risk management activities and performance are used to inform, improve and adjust the risk management strategy. It covers reviewing strategy outcomes, adjusting it to cover requirements and risks, and evaluating risk management performance.
In practice. Leadership regularly reviews meaningful measures of cybersecurity risk and performance, such as progress on risk treatment, control coverage and incident trends. Findings from audits, assessments and incidents lead to documented changes in strategy or priorities. Evidence includes executive or board reporting packs, review minutes with decisions, metrics definitions and records of strategy updates.
Common gaps. A typical gap is reporting that lists activity rather than risk, so leadership cannot judge whether the strategy works. Reviews often happen without decisions or follow-up actions being recorded.