| name | GV.PO-01_gvpo-01 |
| description | Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and |
| category | configuration |
| version | 2.0 |
| author | cyberstrike-official |
| tags | ["nist","csf","v2.0","gv-po-01","gv","subcategory"] |
| tech_stack | ["any"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | ["Policy (GV.PO)"] |
| severity_boost | {} |
GV.PO-01 GV.PO-01
Subcategory of: Policy (GV.PO)
High-Level Description
Function: GOVERN (GV)
Framework: NIST Cybersecurity Framework v2.0
Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
What to Check
How to Test
Step 1: Identify Current Profile
Determine the organization's current and target CSF profile tier for GV.PO-01.
Step 2: Assess Outcome Achievement
# Review organizational policies and procedures
# Check for evidence that GV.PO-01 outcome is met
# Interview stakeholders responsible for GOVERN
Step 3: Map to Technical Controls
Identify which SP 800-53 controls implement this CSF outcome and verify their operating effectiveness.
Tools
| Tool | Purpose | Usage |
|---|
| cloud-audit-mcp | Assess cloud security posture | cloud_audit_* tools |
| Manual Review | Policy and procedure review | Interviews and documentation |
Remediation Guide
Achieve the GV.PO-01 GV.PO-01 outcome:
Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
Risk Assessment
| Finding | Severity | Impact |
|---|
| GV.PO-01 GV.PO-01 outcome not achieved | Medium | GOVERN Function Gap |
CWE Categories
| CWE ID | Title |
|---|
| N/A | No direct CWE mapping |
