[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-csf\u002Fgv-po":3},{"item":4,"lessons":16,"controls":35,"related":36},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nist-csf","gv-po","GV.PO-01","GV.PO: Policy",1,"US National Institute of Standards and Technology (NIST)","**What it asks for.** This category asks organisations to establish, communicate and enforce a cybersecurity policy. The policy should be based on organisational context, strategy and priorities, and should be reviewed, updated and communicated to reflect changes in requirements, threats, technology and mission.\n\n**In practice.** A top-level policy approved by leadership sets direction and is supported by topic-specific policies and standards. Policies have owners, version control and review dates, and are communicated to staff and relevant third parties with acknowledgement tracked. Exceptions are recorded, risk-assessed and time-limited. Evidence includes approved policy documents, review history, communication and attestation records, and an exception register.\n\n**Common gaps.** Common gaps are policies copied from templates that do not match actual practice, missed review cycles and no mechanism for enforcement. Exceptions are often granted informally and never revisited.",null,"https:\u002F\u002Fwww.nist.gov\u002Fcyberframework","Open the Cybersecurity Framework at NIST","2026-10-18T15:18:43.664+00:00",{"total":17,"list":18},4,[19,23,27,31],{"slug":20,"title":21,"published_at":22},"germany-expands-spy-agency-cyber-powers-what-organizations-must-understand","Germany Expands Spy Agency Cyber Powers: What Organizations Must Understand","2026-11-13T17:20:22.404+00:00",{"slug":24,"title":25,"published_at":26},"facial-recognition-misuse-highlights-governance-gaps-and-training-failures-in-uk-policing","Facial Recognition Misuse Highlights Governance Gaps and Training Failures in UK Policing","2026-11-13T11:21:16.575+00:00",{"slug":28,"title":29,"published_at":30},"italian-ministry-of-justice-fined-for-excessive-public-disclosure-of-candidate-data","Italian Ministry of Justice Fined for Excessive Public Disclosure of Candidate Data","2026-11-10T17:22:06.561+00:00",{"slug":32,"title":33,"published_at":34},"government-vetting-of-advanced-ai-models-highlights-emerging-regulatory-oversight","Government Vetting of Advanced AI Models Highlights Emerging Regulatory Oversight","2026-06-29T12:21:07.59+00:00",[],[37,43,48,53,58,62,66,68],{"family":38,"item":39,"code":40,"title":41,"together":42},"gdpr","5","Article 5(1)(f)","Principles relating to processing of personal data",2,{"family":44,"item":45,"code":46,"title":47,"together":42},"nis2","21-2-a","Article 21(2)(a)","Policies on risk analysis and information system security (Article 21(2)(a))",{"family":49,"item":50,"code":51,"title":52,"together":42},"nist-800-53","ac-3","AC-3","Access Enforcement",{"family":54,"item":55,"code":56,"title":57,"together":9},"eu-ai-act","9","Article 9","Risk management system",{"family":38,"item":59,"code":60,"title":61,"together":9},"35","Article 35","Data protection impact assessment",{"family":38,"item":63,"code":64,"title":65,"together":9},"6","Article 6","Lawfulness of processing",{"family":38,"item":55,"code":56,"title":67,"together":9},"Processing of special categories of personal data",{"family":38,"item":69,"code":70,"title":71,"together":9},"25","Article 25","Data protection by design and by default"]