GV.RM-04 says strategic direction that describes appropriate risk response options is established and communicated. Leaders decide in advance which responses are allowed for which kinds of risk: accept it, avoid it, reduce it or transfer it. That spares every team from reinventing the answer each time.
What good looks like
A short guide that says, by data class or system tier, when a risk can be accepted and by whom, when it must be avoided, and when sharing it with a provider is fine. Insurance has been considered and the decision recorded. People making day to day calls can find the guidance and use it.
How to implement it
- Classify your data and systems into a few tiers, such as public, internal, customer confidential and regulated.
- For each tier, write the acceptance criteria. For example, risks to regulated data cannot be accepted below the executive level, while risks to internal tools can be accepted by the team lead with an expiry date.
- Decide whether to buy cyber insurance. NIST lists this as a direct example. Record the decision and the reasons, and review it yearly.
- Document when shared responsibility models are acceptable: outsourcing a security function, letting a third party handle payments, or using public cloud services. State the conditions, such as a completed supplier review and a contract with security terms.
- Publish the guidance next to your risk register template.
Evidence to collect
- The risk response guidance with approval and date.
- The insurance decision record, whether you bought cover or not.
- Risk register entries showing a response chosen under the guidance.
Common gaps
- Every risk is treated as "mitigate", so nothing is ever formally accepted or avoided.
- Acceptance is informal, with no named approver or expiry.
- Insurance is purchased without checking what the policy actually excludes.
- Shared responsibility is assumed. Nobody wrote down which controls remain yours.
Example guidance table
Customer confidential data: accept only with executive approval and a time limit; shared responsibility allowed only with a completed supplier review and contract terms. Internal systems: team lead may accept low risks for up to six months. Public marketing systems: team lead may accept. Anything touching regulated data: avoid unless a named control is in place. A table like this fits on one page and removes most debate about who may accept what.
Insurance in context
Insurance transfers part of the financial impact. It does not remove the incident, the downtime or the customer trust damage, and insurers ask for specific controls before covering you. Treat the decision as part of risk response, read the exclusions with counsel, and record why you chose to buy or not buy.
Quick check
Is accepting a risk a failure?
No. Informed acceptance within your stated tolerance is a legitimate response. What fails the outcome is acceptance that nobody approved or recorded.
Sources
- NIST Cybersecurity Framework 2.0 Reference Tool, subcategory GV.RM-04: https://csrc.nist.gov/projects/cybersecurity-framework/filters
- NIST Cybersecurity Framework overview: https://www.nist.gov/cyberframework
The CSF is voluntary guidance. There is no CSF certification, so this post describes how to work toward the outcome, not how to pass an audit.
