Governance, Risk, and Compliance
Domain 4 tests whether you can connect CSF Govern to enterprise risk management and NIST authorization practice.
Govern and risk mechanics
CSF 2.0 Govern categories: Organizational Context (GV.OC), Risk Management Strategy (GV.RM), Roles and Responsibilities (GV.RR), Policy (GV.PO), Oversight (GV.OV), and Cybersecurity Supply Chain Risk Management (GV.SC). Risk appetite is the amount of risk leadership will accept; tolerance is the acceptable variance around it. NIST SP 800-39 describes risk at three tiers: organization, mission/business process, and information system. The RMF (SP 800-37 Rev. 2) runs Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor. SP 800-30 assessments combine threat, vulnerability, likelihood, and impact. Authorization produces an ATO with a POA&M; continuous monitoring supports ongoing authorization. Informative references map CSF to 800-53 but do not prove compliance.
Worked example
A new HR system is categorized moderate under FIPS 199. The team selects the 800-53 moderate baseline, inherits IaaS controls, assesses, and the authorizing official accepts residual risk with two POA&M items. Monitoring is monthly. Reasoning: categorization drives baseline selection; residual risk is explicitly accepted by the accountable executive, not the implementer.
Traps
Treating an ATO as permanent; running risk assessment once; equating compliance with security; leaving supply-chain risk out of Govern; maintaining a risk register with no owner or treatment date.