[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-csf\u002Fgv-rm":3},{"item":4,"lessons":16,"controls":50,"related":77},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nist-csf","gv-rm","GV.RM","Risk Management Strategy",8,"US National Institute of Standards and Technology (NIST)","**What it asks for.** This Govern category requires the organisation to establish, communicate and use its priorities, constraints, risk tolerance and appetite statements and assumptions to support operational risk decisions. Cybersecurity risk should be part of enterprise risk management.\n\n**In practice.** Good practice is a documented cybersecurity risk management strategy approved by senior leadership, with clear risk appetite statements, consistent methods for assessing and prioritising risk, and defined criteria for accepting, mitigating, transferring or avoiding it. Cyber risks appear in the enterprise risk register with owners. Evidence includes the strategy, appetite statements, risk register entries and decisions on risk acceptance.\n\n**Common gaps.** Risk appetite is often stated in vague terms that cannot guide decisions. Cyber risk is commonly managed in a separate silo from enterprise risk, so the board sees technical findings rather than business exposure.",null,"https:\u002F\u002Fwww.nist.gov\u002Fcyberframework","Open the Cybersecurity Framework at NIST","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46],{"slug":19,"title":20,"published_at":21},"enterprises-unprepared-for-ai-and-quantum-cyber-threats","Enterprises Unprepared for AI and Quantum Cyber Threats","2026-10-01T16:21:09.7+00:00",{"slug":23,"title":24,"published_at":25},"russias-hybrid-cyber-physical-attacks-target-european-nations-supporting-ukraine","Russia's Hybrid Cyber-Physical Attacks Target European Nations Supporting Ukraine","2026-09-25T08:20:21.965+00:00",{"slug":27,"title":28,"published_at":29},"underfunded-water-systems-left-exposed-to-nation-state-cyber-threats","Underfunded Water Systems Left Exposed to Nation-State Cyber Threats","2026-09-24T12:22:01.222+00:00",{"slug":31,"title":32,"published_at":33},"us-cyber-strategy-leaves-military-linked-civil-infrastructure-exposed","US Cyber Strategy Leaves Military-Linked Civil Infrastructure Exposed","2026-09-17T12:20:38.607+00:00",{"slug":35,"title":36,"published_at":37},"openais-astra-ai-model-flagged-as-critical-cyberattack-risk","OpenAI's Astra AI Model Flagged as Critical Cyberattack Risk","2026-08-10T18:22:34.261+00:00",{"slug":39,"title":40,"published_at":41},"ai-assisted-cryptanalysis-exposes-weaknesses-in-aes-variants-and-post-quantum-schemes","AI-Assisted Cryptanalysis Exposes Weaknesses in AES Variants and Post-Quantum Schemes","2026-07-28T20:20:37.736+00:00",{"slug":43,"title":44,"published_at":45},"ai-powered-cybersecurity-tools-demand-governance-frameworks-to-prevent-dual-use-misuse","AI-Powered Cybersecurity Tools Demand Governance Frameworks to Prevent Dual-Use Misuse","2026-06-29T08:20:19.13+00:00",{"slug":47,"title":48,"published_at":49},"federal-agencies-face-2030-deadline-to-adopt-post-quantum-cryptography","Federal Agencies Face 2030 Deadline to Adopt Post-Quantum Cryptography","2026-06-23T18:21:51.796+00:00",[51,56,60,64,68,72],{"slug":52,"name":53,"problem":54,"stories":55},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",2,{"slug":57,"name":58,"problem":59,"stories":55},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",{"slug":61,"name":62,"problem":63,"stories":55},"ot-security","OT and industrial control system security","Factory, building and utility control systems get visibility and protection.",{"slug":65,"name":66,"problem":67,"stories":55},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",{"slug":69,"name":70,"problem":71,"stories":55},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":73,"name":74,"problem":75,"stories":76},"patch-management","Automated patch management","Known holes get closed in days, not months.",1,[78,84,89,95,100,105,108,112],{"family":79,"item":80,"code":81,"title":82,"together":83},"cis","16","Control 16","Application Software Security",5,{"family":79,"item":85,"code":86,"title":87,"together":88},"3","Control 3","Data Protection",4,{"family":90,"item":91,"code":92,"title":93,"together":94},"gdpr","32","Article 32","Security of processing",3,{"family":96,"item":97,"code":98,"title":99,"together":94},"nist-sp","800-82","SP 800-82","SP 800-82 Rev. 3: Guide to Operational Technology (OT) Security",{"family":101,"item":102,"code":103,"title":104,"together":94},"nist-ai-rmf","overview","AI RMF 1.0","AI Risk Management Framework (AI RMF 1.0)",{"family":106,"item":102,"code":107,"title":107,"together":94},"itil","ITIL",{"family":79,"item":109,"code":110,"title":111,"together":55},"18","Control 18","Penetration Testing",{"family":113,"item":114,"code":115,"title":116,"together":55},"cisa","cpg","CPGs","Cross-Sector Cybersecurity Performance Goals (CPGs)"]