Skip to content

GOVERN

"The organization's cybersecurity risk management strategy, expectations, and policy are established, communicated, and monitored." Paraphrased from NIST CSF 2.0, GOVERN function

Objective

Establish the mandate, accountability, and decision-making structures that let the CDC operate with authority. GOVERN was elevated to a standalone function in CSF 2.0 precisely because technical capability without governance fails: budgets erode, escalation paths blur, and management accountability, now legally required under NIS2 Art. 20, is absent.

Core capabilities

StandardOCDFFunction from NIST CSF 2.0; the capability breakdown and IDs are this framework's.

ID Capability Description
GV-1 CDC charter & mandate A signed document defining the CDC's mission, scope covering business units, geographies and asset classes, authority such as the right to isolate systems, and reporting line.
GV-2 Risk management integration The CDC feeds into and consumes from the enterprise risk register; cyber risk appetite is defined by leadership.
GV-3 Policy framework Security policies for acceptable use, logging, access and incident response exist, are approved, versioned, and reviewed at least annually.
GV-4 Roles & accountability RACI covering CISO, CDC director, analysts, IT operations, legal/DPO, communications, and executive management.
GV-5 Budget & resourcing governance Multi-year funding model; staffing plan; sourcing strategy across in-house, hybrid and provider; and the CDC team's own development: training budget, skills mapping per Roles & competences, succession for single points of knowledge.
GV-6 Supply chain risk governance Third-party and supplier cyber risk requirements, contract clauses, and monitoring, per CSF 2.0 GV.SC and NIS2 Art. 21(2)(d).
GV-7 Oversight & reporting Regular reporting to executive management and, where applicable, the board; management approval and training obligations under NIS2 Art. 20.

CIA mapping

OCDFThis framework's mapping of each capability to confidentiality, integrity and availability.

Capability C I A Rationale
GV-1 Charter ● ● ● Governance protects all three objectives by ensuring someone is accountable for each.
GV-2 Risk mgmt ● ● ● Risk appetite statements should be expressed per CIA objective, such as "no tolerance for integrity loss in payment data".
GV-3 Policies ● ● ○ Data classification and access policies primarily serve Confidentiality and Integrity.
GV-4 Roles & accountability ○ ○ ○ An enabler: it serves all three only through the owners it names. Its test is whether each crown jewel's C, I and A has a named owner.
GV-5 Budget & resourcing ○ ○ ● Under-resourcing shows first as lost coverage hours and slow restores, which are Availability failures.
GV-6 Supply chain ● ● ● Suppliers can compromise any objective; availability of outsourced services is a distinct risk.
GV-7 Oversight & reporting ○ ○ ○ An enabler: reporting protects nothing itself, but it is how management sees which objective is drifting from its appetite.

● primary, ○ secondary or indirect. Rows where all three are ○ are enablers: they protect nothing themselves, but the others depend on them.

Roles & staffing

PractitionerTypical roles from practice. Staffing figures and their arithmetic are under staffing and cost in Operating models.

  • Executive sponsor — a board member or C-level executive who owns cyber risk acceptance.
  • CISO or Head of Security — owns the policy framework.
  • CDC Director or SOC Manager — owns execution of the charter and reports maturity.
  • GRC, Legal and DPO — own regulatory interpretation for GDPR Art. 33 breach notification and NIS2 reporting.

Maturity criteria

OCDFThis framework's criteria. Not a certification standard.

The criteria that score GOVERN are kept in one place for all six functions: the maturity self-assessment, GOVERN, with the same text in the interactive tool. Its Level 2 criteria include the minimum form of NIS2 Art. 20 and Art. 21(2)(a), (d) and (f), marked there; see the NIS2 Article 21 crosswalk. How levels are scored is in the maturity model.

EU regulatory hooks

LawParaphrased from the legal texts. Check the article itself and your national law; not legal advice.

  • NIS2 Art. 20 — management bodies must approve cybersecurity risk-management measures, oversee their implementation, and follow training; managers can be held liable.
  • NIS2 Art. 21(1) — requires an "all-hazards" risk-based approach proportionate to the entity's exposure.
  • DORA Art. 5 — for financial entities, the management body bears final responsibility for ICT risk management.
  • GDPR Art. 24 & 32 — controller accountability and "appropriate technical and organisational measures".
  • ENISA NCSS & sectoral guidance — national cybersecurity strategy alignment for public bodies.

External dependencies

PractitionerTypical dependencies from experience; yours will differ.

Dependency Party Type Agree up front
Cyber risk acceptance and charter sign-off Executive sponsor / board [GATE] Who signs, who deputises, review cadence
Regulatory interpretation of NIS2, GDPR and DORA applicability Legal / DPO [GATE] Turnaround time for applicability questions
Multi-year budget and headcount Finance / executive management [HARD] Budget cycle timing; who defends the case
Security clauses in supplier contracts Procurement / legal [HARD] Standard clause set; CDC review step in tenders
Role definitions and hiring support HR [SOFT] Use of ECSF-based job descriptions, Roles & competences

Sources

Open CDC Framework, licensed CC BY 4.0. Credits: References & credits.