---

id: "GV.RM-01" title: "Risk Management Strategy" function: "GV" function_name: "Govern" category: "GV.RM" category_name: "Risk Management Strategy" description: "Risk management objectives are established and documented." controls: - PM-1 - PM-11 - PM-3 - PM-8 - PM-9 - RA-3

---

GV.RM-01: Risk Management Strategy

Description

Risk management objectives are established and documented.

Category Context

Function: GV — Govern Category: GV.RM — Risk Management Strategy

The organization's cybersecurity risk management strategy is established, communicated, and reviewed.

Mapped SP 800-53 Controls

• PM-1 (Program Management) — View Control
• PM-11 (Program Management) — View Control
• PM-3 (Program Management) — View Control
• PM-8 (Program Management) — View Control
• PM-9 (Program Management) — View Control
• RA-3 (Risk Assessment) — View Control