GV.RM-07 says strategic opportunities, meaning positive risks, are characterized and included in organizational cybersecurity risk discussions. Risk includes upside as well as loss. A new market, a faster delivery pipeline or a strong security posture that wins deals are all outcomes worth planning for alongside the threats.
What good looks like
Risk meetings include a short section on opportunities. Leaders use a method such as a strengths, weaknesses, opportunities and threats review. Stretch goals are written down. Where it helps, positive risks are scored and prioritized next to negative ones.
How to implement it
- Add one question to your risk review: what could go better than planned, and what would we need to be ready?
- Use a SWOT grid once a year as NIST suggests, and keep the output next to the risk register.
- Record two or three stretch goals, such as shortening security questionnaire turnaround so sales cycles speed up.
- Where a goal depends on a security capability, give it an owner and a measure.
Evidence to collect
- The opportunity list or SWOT output with dates.
- Meeting notes where opportunities were discussed with risks.
- Documented stretch goals with owners.
Common gaps
- The risk process only ever lists threats.
- Opportunities are discussed in sales meetings and never connect to security.
- Stretch goals exist but nobody tracks them.
Quick check
What is an example of a positive cyber risk?
A customer segment that requires strong security evidence. If you invest early, you may win deals competitors cannot, so readiness is the opportunity and failing to prepare is the risk.
Sources
- NIST Cybersecurity Framework 2.0 Reference Tool, subcategory GV.RM-07: https://csrc.nist.gov/projects/cybersecurity-framework/filters
- NIST Cybersecurity Framework overview: https://www.nist.gov/cyberframework
The CSF is voluntary guidance. There is no CSF certification, so this post describes how to work toward the outcome, not how to pass an audit.
