[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-csf\u002Fgv-po":3},{"item":4,"lessons":16,"controls":22,"related":23},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nist-csf","gv-po","GV.PO-01","GV.PO: Policy",1,"US National Institute of Standards and Technology (NIST)","**What it asks for.** This category asks organisations to establish, communicate and enforce a cybersecurity policy. The policy should be based on organisational context, strategy and priorities, and should be reviewed, updated and communicated to reflect changes in requirements, threats, technology and mission.\n\n**In practice.** A top-level policy approved by leadership sets direction and is supported by topic-specific policies and standards. Policies have owners, version control and review dates, and are communicated to staff and relevant third parties with acknowledgement tracked. Exceptions are recorded, risk-assessed and time-limited. Evidence includes approved policy documents, review history, communication and attestation records, and an exception register.\n\n**Common gaps.** Common gaps are policies copied from templates that do not match actual practice, missed review cycles and no mechanism for enforcement. Exceptions are often granted informally and never revisited.",null,"https:\u002F\u002Fwww.nist.gov\u002Fcyberframework","Open the Cybersecurity Framework at NIST","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[18],{"slug":19,"title":20,"published_at":21},"government-vetting-of-advanced-ai-models-highlights-emerging-regulatory-oversight","Government Vetting of Advanced AI Models Highlights Emerging Regulatory Oversight","2026-06-29T12:21:07.59+00:00",[],[24,29,33,38,43,48,53,57],{"family":25,"item":26,"code":27,"title":28,"together":9},"cis","3","Control 3","Data Protection",{"family":25,"item":30,"code":31,"title":32,"together":9},"6","Control 6","Access Control Management",{"family":34,"item":35,"code":36,"title":37,"together":9},"eu-ai-act","9","Article 9","Risk management system",{"family":39,"item":40,"code":41,"title":42,"together":9},"gdpr","25","Article 25","Data protection by design and by default",{"family":44,"item":45,"code":46,"title":47,"together":9},"iso","42001","ISO\u002FIEC 42001","ISO\u002FIEC 42001: Artificial intelligence management system",{"family":49,"item":50,"code":51,"title":52,"together":9},"nist-800-53","ac-2","AC-2","Account Management",{"family":49,"item":54,"code":55,"title":56,"together":9},"ac-3","AC-3","Access Enforcement",{"family":49,"item":58,"code":59,"title":60,"together":9},"ra-3","RA-3","Risk Assessment"]