Data Governance
The framework of policies, roles, and controls that decide who can access data, how it's classified, and how long it's kept. Without governance, a strong security stack still can't answer whether this data should exist.
Cybersecurity Infographic Series · Governance, Risk and Privacy
NIST SP 800-53 and the RMF
NIST SP 800-53 Rev. 5 is a catalog of 1,014 active security and privacy controls in 20 families. SP 800-53B picks a baseline by FIPS 199 impact level, SP 800-53A says how to assess, and the SP 800-37 RMF turns them into an authorization decision: the catalog supplies the controls; the RMF supplies the decision.
Downloads
- Infographic (PNG, 2880×7172, 1.6 MB)
- Field reference (PDF, 2 sheets, 509 KB)
- Infographic, light edition (PNG, 1.7 MB)
- Field reference, light edition (PDF, 515 KB)
More in Governance, Risk and Privacy
Third-Party Risk Management
The discipline of vetting, tiering, contracting, and continuously monitoring every vendor, supplier, and partner that touches your data or systems. A signed contract proves obligation — it never proves compliance.
Fourth and Nth-Party Risk
The risk introduced by your vendors' own vendors — and everything downstream of them. Your direct vendor may be secure; the subprocessor two tiers down that you've never heard of is where the actual exposure lives.
Security Metrics, KPIs and Board Reporting
A board doesn't need every alert — it needs to know whether risk is going up or down and what it will cost to change that, translated out of security jargon and into business terms.
GDPR and Global Privacy Regulation
GDPR applies to any organization processing an EU resident's personal data, regardless of where that organization is actually based. Consent is only one of six lawful bases, and defaulting to it for everything often creates more compliance risk, not less.
.png){kind=link}
NIST Cybersecurity Framework 2.0
NIST published Cybersecurity Framework 2.0 on February 26, 2024, its first major update since 2014. It is a taxonomy of high-level cybersecurity outcomes for any organization, not a control set, a checklist or a certification: CSF 2.0 says what good looks like and leaves the how to the standards it maps to.