---

id: "GV.RM-02" title: "Risk Management Strategy" function: "GV" function_name: "Govern" category: "GV.RM" category_name: "Risk Management Strategy" description: "Cybersecurity risk tolerance is determined and communicated." controls: - PM-1 - PM-11 - PM-8 - PM-9

---

GV.RM-02: Risk Management Strategy

Description

Cybersecurity risk tolerance is determined and communicated.

Category Context

Function: GV — Govern Category: GV.RM — Risk Management Strategy

The organization's cybersecurity risk management strategy is established, communicated, and reviewed.

Mapped SP 800-53 Controls

• PM-1 (Program Management) — View Control
• PM-11 (Program Management) — View Control
• PM-8 (Program Management) — View Control
• PM-9 (Program Management) — View Control