GV.OV-02 says the cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks. Where GV.OV-01 asks whether the strategy works, this one asks whether it still covers what you actually face: new obligations, new threats, new products, new incidents.
What good looks like
The strategy has a named owner and a review calendar. Each review compares it against current requirements and the current risk register and records any gap. Audit findings, incident lessons and changes in who does what all feed in. Gaps become dated actions, not vague notes.
How to implement it
- List the inputs NIST points to: audit findings, performance oversight of people in security roles, and recent incidents.
- Compare the strategy to your obligations register and top risks. Mark anything uncovered.
- Check whether roles are performing. If a policy keeps being missed, the issue may be the policy.
- Record changes and assign owners.
- Re-issue the strategy and tell the people it affects.
Evidence to collect
- Review records with the gap list.
- Audit or assessment findings and how each was addressed.
- A post incident review that led to a strategy change.
Common gaps
- The strategy is reviewed on schedule but never compared with the obligations register.
- Incident lessons stay in the postmortem and do not reach policy.
- Changes are made without telling the people affected.
Quick check
What counts as a strategy review?
Any dated session where the strategy is compared with current requirements and risks, with decisions recorded. A standing agenda item in a leadership meeting can qualify if it produces written outcomes.
Sources
- NIST Cybersecurity Framework 2.0 Reference Tool, subcategory GV.OV-02: https://csrc.nist.gov/projects/cybersecurity-framework/filters
- NIST Cybersecurity Framework overview: https://www.nist.gov/cyberframework
The CSF is voluntary guidance. There is no CSF certification, so this post describes how to work toward the outcome, not how to pass an audit.
