Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies

frameworkNIST Cybersecurity Framework 2.0 sectionGovern (GV) topicsRoles & Responsibilities frameworks5 4 4

gap from NIST CSF 2.0 → gap to NIST CSF 2.0 →

Wrong or missing mapping? Report it

Equivalents of GV.RR-03 in other frameworks
Framework	Requirement	Title	Link	Source / reason
ISO 27001	A.5.2 A.5.4	Information security roles and responsibilities; Management responsibilities	Crosswalk	Same topic: Roles & Responsibilities 3 loosely related (not mappings) A.6.6 Confidentiality or non-disclosure agreements Loosely related Only shares CSF GV.RR-03: related, not a mapping Clause 7.1 Resources Loosely related Only shares CSF GV.RR-03: related, not a mapping Clause 7.2 Competence Loosely related Only shares CSF GV.RR-03: related, not a mapping
CIS v8.1	—	No requirement	No mapping in our data	No mapping in our data (most CIS links are editorial: CIS's published crosswalk covers 49 of 153 safeguards).
SOC 2	CC1.2 CC1.3 CC1.5	Board independence and oversight of internal control; Structures, reporting lines, authorities and responsibilities…	Editorial	Same topic: Roles & Responsibilities (editorial pick)
PCI DSS	12.1.3 12.1.4	Security roles and responsibilities defined; Executive responsibility for information security assigned	Crosswalk	Same topic: Roles & Responsibilities 1 loosely related (not mappings) 12.10.3 Incident response staff available around the clock Loosely related Only shares CSF GV.RR-03: related, not a mapping
CMMC	—	No requirement	No mapping in our data	No mapping in our data.
800-53	PM-2 PM-29 PS-9	Information Security Program Leadership Role; Risk Management Program Leadership Roles…	Crosswalk	Same topic: Roles & Responsibilities 1 loosely related (not mappings) PM-3 Information Security and Privacy Resources Loosely related Only shares CSF GV.RR-03: related, not a mapping
HIPAA	§164.308(a)(2)	Assigned Security Responsibility	Crosswalk	Same topic: Roles & Responsibilities
GDPR	Art.37(1)Art.39(1)	Designation of the data protection officer; Tasks of the data protection officer	Editorial	Same topic: Roles & Responsibilities (editorial pick)
NIS2	1.2	Roles, responsibilities and authorities	Crosswalk	Same topic: Roles & Responsibilities 1 loosely related (not mappings) 2.1 Risk management framework Loosely related Only shares CSF GV.RR-03: related, not a mapping
Essential Eight	—	No requirement	No mapping in our data	No mapping in our data (Essential Eight links are editorial only).
DORA	Art.5(2)(c)Art.5(3)Art.6(4)	Governance and organisation; Governance and organisation…	Editorial	Same topic: Roles & Responsibilities (editorial pick)
CPS 234	Para 13 Para 14	Board ultimately responsible for information security; Define information security roles and responsibilities	Editorial	Same topic: Roles & Responsibilities (editorial pick)
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.