[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-csf\u002Fgv-rr":3},{"item":4,"lessons":16,"controls":30,"related":53},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nist-csf","gv-rr","GV.RR","GV.RR: Roles, Responsibilities, and Authorities",3,"US National Institute of Standards and Technology (NIST)","**What it asks for.** This category asks organisations to establish and communicate cybersecurity roles, responsibilities and authorities so that accountability, performance assessment and continuous improvement are possible. Leadership takes responsibility for cybersecurity risk and fosters a risk-aware culture.\n\n**In practice.** Senior leadership formally owns cybersecurity risk, and roles are defined across the business, IT, security, legal and procurement, typically through a RACI model. Adequate resources are allocated in line with the risk strategy, and cybersecurity is built into human resources processes such as hiring, onboarding and role changes. Evidence includes board or executive minutes, documented role descriptions, a named accountable executive, budget decisions and records showing security responsibilities in job descriptions.\n\n**Common gaps.** A frequent gap is cybersecurity being treated as an IT function with no business ownership of risk. Responsibilities for suppliers, cloud services and incident decisions are often unclear, and resourcing is not linked to the risk picture.",null,"https:\u002F\u002Fwww.nist.gov\u002Fcyberframework","Open the Cybersecurity Framework at NIST","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[18,22,26],{"slug":19,"title":20,"published_at":21},"cybersecurity-workforce-shifts-as-ai-roles-surge-and-traditional-postings-decline","Cybersecurity Workforce Shifts as AI Roles Surge and Traditional Postings Decline","2026-10-18T12:20:19.942+00:00",{"slug":23,"title":24,"published_at":25},"ransomware-groups-turn-to-insider-recruitment-as-external-defenses-improve","Ransomware Groups Turn to Insider Recruitment as External Defenses Improve","2026-09-01T22:21:00.92+00:00",{"slug":27,"title":28,"published_at":29},"executive-overconfidence-creates-blind-spots-in-ai-risk-management","Executive Overconfidence Creates Blind Spots in AI Risk Management","2026-06-17T14:21:05.119+00:00",[31,36,41,45,49],{"slug":32,"name":33,"problem":34,"stories":35},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",2,{"slug":37,"name":38,"problem":39,"stories":40},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",1,{"slug":42,"name":43,"problem":44,"stories":40},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",{"slug":46,"name":47,"problem":48,"stories":40},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":50,"name":51,"problem":52,"stories":40},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[54,58,63,68,72,77,82,86],{"family":55,"item":56,"code":57,"title":57,"together":9},"itil","overview","ITIL",{"family":59,"item":60,"code":61,"title":62,"together":35},"gdpr","32","Article 32","Security of processing",{"family":64,"item":65,"code":66,"title":67,"together":35},"cis","14","Control 14","Security Awareness and Skills Training",{"family":64,"item":69,"code":70,"title":71,"together":40},"8","Control 8","Audit Log Management",{"family":73,"item":74,"code":75,"title":76,"together":40},"iso","42001","ISO\u002FIEC 42001","ISO\u002FIEC 42001: Artificial intelligence management system",{"family":78,"item":79,"code":80,"title":81,"together":40},"nist-800-53","ac-2","AC-2","Account Management",{"family":78,"item":83,"code":84,"title":85,"together":40},"ac-6","AC-6","Least Privilege",{"family":78,"item":87,"code":88,"title":89,"together":40},"at-2","AT-2","Literacy Training and Awareness"]