[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-csf\u002Fgv":3},{"item":4,"lessons":16,"controls":26,"related":27},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nist-csf","gv","GV","Govern (GV)",2,"US National Institute of Standards and Technology (NIST)","**What it asks for.** The Govern function, new in CSF 2.0, asks organisations to establish, communicate and monitor their cybersecurity risk management strategy, expectations and policy. It provides the context and direction for the other five functions and connects cybersecurity to enterprise risk management.\n\n**In practice.** Doing this well means understanding the organisational context and legal obligations, setting risk appetite and tolerance, assigning roles and authorities, approving policy, overseeing results and managing supply chain risk. Cybersecurity risk is reported to leadership in business terms, and strategy is reviewed and adjusted based on performance and changes in the threat landscape. Evidence includes an approved strategy, a risk register with owners, risk appetite statements, policy documents, supplier risk processes and leadership meeting records.\n\n**Common gaps.** Common gaps are governance that exists on paper only, risk appetite that is never defined, and supply chain risk handled separately from the main programme. Leadership often receives technical metrics rather than risk information they can act on.",null,"https:\u002F\u002Fwww.nist.gov\u002Fcyberframework","Open the Cybersecurity Framework at NIST","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[18,22],{"slug":19,"title":20,"published_at":21},"ai-cyber-defense-act-targets-critical-infrastructure-gaps-after-water-facility-attacks","AI-Cyber Defense Act Targets Critical Infrastructure Gaps After Water Facility Attacks","2026-09-22T22:20:50.106+00:00",{"slug":23,"title":24,"published_at":25},"eu-warns-of-ai-powered-cyber-threats-and-moves-to-regulate-social-media-risks","EU Warns of AI-Powered Cyber Threats and Moves to Regulate Social Media Risks","2026-09-16T16:20:36.656+00:00",[],[28,33,38,42,47,52,57,61],{"family":29,"item":30,"code":31,"title":32,"together":9},"cis","17","Control 17","Incident Response Management",{"family":29,"item":34,"code":35,"title":36,"together":37},"14","Control 14","Security Awareness and Skills Training",1,{"family":29,"item":39,"code":40,"title":41,"together":37},"7","Control 7","Continuous Vulnerability Management",{"family":43,"item":44,"code":45,"title":46,"together":37},"cisa","cpg","CPGs","Cross-Sector Cybersecurity Performance Goals (CPGs)",{"family":48,"item":49,"code":50,"title":51,"together":37},"eu-ai-act","overview","AI Act","Artificial Intelligence Act (Regulation (EU) 2024\u002F1689)",{"family":53,"item":54,"code":55,"title":56,"together":37},"gdpr","5","Article 5(1)(f)","Principles relating to processing of personal data",{"family":53,"item":58,"code":59,"title":60,"together":37},"8","Article 8","Conditions applicable to child's consent in relation to information society services",{"family":62,"item":63,"code":64,"title":65,"together":37},"iso","42001","ISO\u002FIEC 42001","ISO\u002FIEC 42001: Artificial intelligence management system"]