NIST CSF 2.0 GV.RR-03: Fund Cyber Risk Work

GV.RR-03 says adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities and policies. If the strategy demands seven day patching and nobody has time to patch, the strategy is fiction. This outcome asks leaders to match money, people and tools to what they have said matters.

What good looks like

Budget and headcount for security trace back to risk priorities and tolerances. Management periodically checks that people with security duties have the authority and time to do them. Gaps are written down with a decision: fund, delay or accept the risk.

How to implement it

1. List the activities your strategy requires and estimate the effort for each, in people time and tools.
2. Compare to what is allocated. Identify shortfalls and rank them by risk.
3. Take the shortfalls to leadership with the risk each one leaves open. Leaders decide to fund or accept.
4. Review authority. Can the security lead block a release or approve a purchase? If not, who can?
5. Repeat at annual planning and when major changes occur.

Evidence to collect

• The resource plan with costs and owners.
• Budget decisions linked to risk entries.
• Management review notes on authority and capacity.
• Documented risk acceptances where funding was declined.

Common gaps

• The budget is set as a percentage of revenue with no link to risk.
• Responsibilities are assigned but no time is freed to do them.
• Tool purchases happen without checking the team can operate them.

Quick check

Sources

• NIST Cybersecurity Framework 2.0 Reference Tool, subcategory GV.RR-03: https://csrc.nist.gov/projects/cybersecurity-framework/filters
• NIST Cybersecurity Framework overview: https://www.nist.gov/cyberframework

The CSF is voluntary guidance. There is no CSF certification, so this post describes how to work toward the outcome, not how to pass an audit.