[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-csf\u002Fid-gv":3},{"item":4,"lessons":16,"controls":38,"related":39},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nist-csf","id-gv","ID.GV-2","Governance (CSF 1.1)",5,"US National Institute of Standards and Technology (NIST)","**What it asks for.** In CSF 1.1 this Identify category covered the policies, procedures and processes for managing cybersecurity risk and regulatory requirements, including coordinating security roles and responsibilities with internal and external stakeholders. CSF 2.0 expanded it into a separate Govern function, with roles now under GV.RR and policy under GV.PO.\n\n**In practice.** An approved security policy exists, security roles are defined and coordinated with HR, legal, IT, business owners and external partners, and legal and regulatory requirements are understood and managed. Governance and risk management processes address cybersecurity. Evidence includes policy documents, a RACI or similar responsibility matrix, committee minutes and a compliance obligations register.\n\n**Common gaps.** Roles are often defined within the security team but not agreed with business units or suppliers. Policies may exist without a process to review them or to check compliance.",null,"https:\u002F\u002Fwww.nist.gov\u002Fcyberframework","Open the Cybersecurity Framework at NIST","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[18,22,26,30,34],{"slug":19,"title":20,"published_at":21},"cryptomus-sanctioned-for-enabling-ransomware-and-cybercrime-payments","Cryptomus Sanctioned for Enabling Ransomware and Cybercrime Payments","2026-10-14T16:20:46.489+00:00",{"slug":23,"title":24,"published_at":25},"new-cui-regulations-tighten-cybersecurity-rules-for-federal-contractors","New CUI Regulations Tighten Cybersecurity Rules for Federal Contractors","2026-10-07T20:20:19.528+00:00",{"slug":27,"title":28,"published_at":29},"defense-contractors-overestimate-cmmc-readiness-as-evidence-gaps-widen","Defense Contractors Overestimate CMMC Readiness as Evidence Gaps Widen","2026-08-21T10:21:29.511+00:00",{"slug":31,"title":32,"published_at":33},"dhs-rebuilds-critical-infrastructure-cybersecurity-council-after-cipac-disbandment","DHS Rebuilds Critical Infrastructure Cybersecurity Council After CIPAC Disbandment","2026-06-30T16:20:55.709+00:00",{"slug":35,"title":36,"published_at":37},"cryptocurrency-money-laundering-service-dismantled-after-processing-380m-in-illicit-funds","Cryptocurrency Money Laundering Service Dismantled After Processing $380M in Illicit Funds","2026-06-11T16:20:26.804+00:00",[],[40,46,51,54,59,63,69,73],{"family":41,"item":42,"code":43,"title":44,"together":45},"nist-sp","800-171","SP 800-171","SP 800-171 Rev. 3: Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations",2,{"family":47,"item":48,"code":49,"title":50,"together":45},"cmmc","overview","CMMC","Cybersecurity Maturity Model Certification (CMMC)",{"family":52,"item":48,"code":53,"title":53,"together":45},"itil","ITIL",{"family":55,"item":56,"code":57,"title":58,"together":45},"cis","17","Control 17","Incident Response Management",{"family":55,"item":60,"code":61,"title":62,"together":45},"3","Control 3","Data Protection",{"family":64,"item":65,"code":66,"title":67,"together":68},"cisa","cpg","CPGs","Cross-Sector Cybersecurity Performance Goals (CPGs)",1,{"family":55,"item":70,"code":71,"title":72,"together":68},"18","Control 18","Penetration Testing",{"family":74,"item":75,"code":76,"title":77,"together":68},"gdpr","25","Article 25","Data protection by design and by default"]