NIST CSF 2.0 GV.PO-01: Establish Risk Policy

GV.PO-01 says policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy and priorities, and is communicated and enforced. A written policy is the start. The outcome is met when people know it exists, follow it, and leaders back it up.

What good looks like

One short, readable policy approved by senior management that states intent, expectations and direction. Supporting standards and procedures sit underneath it and trace back to it. New hires acknowledge it, existing staff acknowledge it each year and when it changes. When someone breaks it, there is a known consequence and a person who acts.

NIST's examples name each of these: a usable policy with statements of management intent, periodic review against strategy, senior management approval, communication across the organization, and acknowledgment at hire, annually and on update.

How to implement it

1. Start from your context: mission, obligations, top risks. A policy that ignores them reads like a template, because it is one.
2. Write plainly. Aim for a few pages. Use short sentences and avoid jargon that only the security team understands.
3. State who is accountable, what is required and what happens on exceptions. Add an exception process with expiry dates.
4. Get explicit senior management approval and record it.
5. Publish it where staff actually look, such as the handbook or intranet, and run an acknowledgment campaign.
6. Enforce it. Track exceptions, review violations, and act consistently.
7. Link each procedure to the policy statement it supports.

Evidence to collect

• The approved policy with version, date and approver.
• Acknowledgment records for new hires and annual cycles.
• The exceptions log with owners and expiry dates.
• Examples of enforcement, such as a corrective action after a violation.

Common gaps

• The policy is copied from a template and does not match how the company works.
• Acknowledgments are collected once and never renewed.
• Exceptions pile up without expiry.
• Procedures exist but cannot be traced to a policy statement.

Policy, standard, procedure

Keep the three layers apart. The policy states intent and rules at a high level and rarely changes. Standards set specific requirements, such as the minimum password manager settings or the required approval before production changes. Procedures describe the steps for a task. Separating them means you can update a procedure after a tooling change without sending the whole policy back to the board.

Making enforcement real

Enforcement is the part auditors and customers probe. Decide in advance what happens for a missed acknowledgment, a skipped training and a serious violation, and apply it the same way for senior people as for new ones. Keep a simple log of exceptions with an expiry date, an approver and the compensating control. An exception log with real entries is better evidence than a policy with none, because it shows the process is being used.

Quick check

Sources

• NIST Cybersecurity Framework 2.0 Reference Tool, subcategory GV.PO-01: https://csrc.nist.gov/projects/cybersecurity-framework/filters
• NIST Cybersecurity Framework overview: https://www.nist.gov/cyberframework

The CSF is voluntary guidance. There is no CSF certification, so this post describes how to work toward the outcome, not how to pass an audit.