治理政策
制定并维护网络安全治理政策和程序。
治理政策由以下 NIST CSF 2.0 成果定义：GV.PO-01 (Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced); GV.PO-02 (Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission)。 对照映射 通过 ISO 27001, PCI DSS, 800-53, HIPAA 和 NIS2 中已发布的对照表完成映射。 编辑说明 在 SOC 2, GDPR, DORA 和 CPS 234 中经编辑映射。 本站数据中无映射 本站数据中 CIS v8.1, CMMC, Essential Eight 和 Cyber Essentials 无映射。
| 框架 | 要求 | 标题 | 链接 | 来源 / 原因 |
|---|---|---|---|---|
| NIST CSF 2.0 | GV.PO-01GV.PO-02 | Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced; Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission | 主题定义 | GV.PO-01 GV.PO-02 |
| ISO 27001 | A.5.1A.5.37Clause 5.2 | Policies for information security; Documented operating procedures; Policy | 对照映射 | A.5.1: via GV.PO-01; GV.PO-02; NIST 800-53 map: PL-1, PM-1 A.5.37: via GV.PO-01; NIST 800-53 map: PL-1 Clause 5.2: via GV.PO-01; GV.PO-02; NIST 800-53 map: PL-1, PM-1 |
| CIS v8.1 | — | 无要求 | 本站数据中无映射 | 本站数据中没有 CIS v8.1 要求映射到此主题。 |
| SOC 2 | CC5.3CC1.1 | Control activities deployed through policies and procedures; Commitment to integrity and ethical values | 编辑说明 | AICPA's TSC mappings are not openly licensed; ControlMapping editorial mapping (criterion summaries are ours, not AICPA text). |
| PCI DSS | 12.1.112.1.2 | Information security policy established and published; Security policy reviewed at least annually | 对照映射 | 12.1.1: via GV.PO-01 12.1.2: via GV.PO-01; GV.PO-02 |
| CMMC | — | 无要求 | 本站数据中无映射 | 本站数据中没有 CMMC 要求映射到此主题。 |
| 800-53 | PM-1PL-1 | Information Security Program Plan; Policy and Procedures | 对照映射 | PM-1: via GV.PO-01; GV.PO-02 PL-1: via GV.PO-01; GV.PO-02 |
| HIPAA | §164.316(a)§164.316(b)(2)(iii) | Policies and Procedures; Updates | 对照映射 | §164.316(a): via NIST HIPAA map: PL-1 §164.316(b)(2)(iii): via NIST HIPAA map: PL-1, PM-1 |
| GDPR | Art.24(2) | Responsibility of the controller | 编辑说明 | Art.24(2): No official crosswalk exists for GDPR; ControlMapping editorial mapping. |
| NIS2 | 1.1 | Policy on the security of network and information systems | 对照映射 | 1.1: via GV.PO-01; GV.PO-02; ENISA ISO map: Clause 5.2, A.5.1 |
| Essential Eight | — | 无要求 | 本站数据中无映射 | 本站数据中没有 Essential Eight 要求映射到此主题。 |
| DORA | Art.5(2)(b)Art.9(4)(a)Art.6(5) | Governance and organisation; Protection and prevention; ICT risk management framework | 编辑说明 | Art.5(2)(b): The management body puts in place policies for the availability, authenticity, integrity and confidentiality of data. Art.9(4)(a): Develop and document an information security policy. Art.6(5): The ICT risk management framework is documented and reviewed at least once a year. |
| CPS 234 | Para 18Para 19 | Maintain an information security policy framework; Policies direct everyone with security obligations | 编辑说明 | Para 18: Maintain an information security policy framework commensurate with exposures to vulnerabilities and threats. Para 19: The policy framework directs everyone with an obligation to maintain information security. |
| Cyber Essentials | — | 无要求 | 本站数据中无映射 | 本站数据中没有 Cyber Essentials 要求映射到此主题。 |
主题定义 定义本主题的 CSF 2.0 结果 · 对照映射 至少一项选择有已发布对照表作为依据 · 编辑说明 ControlMapping 的判断及理由 · 未映射，仅与该主题的 CSF 成果相同 · 本站数据中无映射 我们的数据中未映射任何内容；通常为新工作，但请查看覆盖范围说明. 方法说明.
要求编号和标题均按各框架官方发布的英文原文显示。
映射有误或缺失？ 报告
关于治理政策
网络安全治理政策是组织安全计划的基础，用于界定网络安全风险管理的规则、标准和预期。有效的治理包括明确责任归属、定义可接受使用政策，以及建立一个将安全目标与业务目标保持一致的决策框架。框架通常要求政策定期审查，并在发生重大变更后进行审查；例如，PCI DSS 要求每年审查一次安全政策（12.1.2）。