GV.RM-05 says lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties. The outcome is about channels and rhythm: who tells whom, how often, and through what route.
What good looks like
Leaders get a scheduled update on cybersecurity posture. Departments such as operations, legal, HR, procurement, internal audit and physical security know how to raise and receive cyber risk information. There is a path for supplier incidents to reach the right internal team quickly.
How to implement it
- Agree an update rhythm with executives and directors. Quarterly works for most small companies, with immediate escalation for serious events.
- Create a simple routing map. For each type of risk, such as a supplier breach, a policy violation or a vulnerability in a customer facing product, name the first contact and the groups to be informed.
- Add a standing agenda item or a shared channel where departments swap risk information.
- Include third party risk. Tell suppliers how to reach you, and tell procurement and legal how to reach security.
- Test the line once a year with a tabletop where a supplier reports an incident.
Evidence to collect
- The communication plan or routing map with names and rhythms.
- Dated posture updates sent to leadership.
- Records of a cross department risk discussion, and of the supplier contact test.
Common gaps
- Communication depends on one person who knows everyone.
- HR and legal hear about security risks only after something goes wrong.
- There is no inbound path for suppliers, so their notices land in a general inbox.
Quick check
What goes in a leadership posture update?
Top risks with trend, major incidents, progress on objectives, and any decisions needed. One page is enough.
Sources
- NIST Cybersecurity Framework 2.0 Reference Tool, subcategory GV.RM-05: https://csrc.nist.gov/projects/cybersecurity-framework/filters
- NIST Cybersecurity Framework overview: https://www.nist.gov/cyberframework
The CSF is voluntary guidance. There is no CSF certification, so this post describes how to work toward the outcome, not how to pass an audit.
