GRCLibrary.ai

Cybersecurity and operational resilience

Could we take the hit and keep operating?

4 leadership pages, 30 governing documents. Can we withstand what hits us?

Preventing every incident is not a plausible plan; withstanding one is. The exposure leadership owns is the gap between the controls that exist on paper and the organization's tested ability to absorb an identity-provider compromise, a compromised release-signing key, or the loss of a critical service, and keep operating.

Note

Adopting a page here decides nothing for you. The leadership pages linked here are explanatory and advisory; they establish no requirement and prove nothing about your organization. Every claim in them resolves to the governing reference documents in the corpus, and it is those documents that govern.

Leadership

The leadership pages

Pages from the executive layer mapped to this concern, generated from the narrative registry. They explain and advise; the documents below govern.

Documents

The governing documents

The evidence shelf: the corpus documents the pages above resolve to, joined to the library's registries at build time. These are the documents that govern, and the evidence to ask for starts here.

Frameworks

Frameworks touched

The external frameworks the shelf above maps, from the corpus registry. The documents' framework spellings are normalized against the crosswalk's committed alias maps: every spelling that names a crosswalk instrument, whole or by a clause, appears once as the instrument's short label and links its instrument page; a cited text that names no instrument is shown as plain text.

  • Bank of England / PRA SS1/21
  • Basel Committee Corporate Governance Principles
  • Basel Committee Operational Resilience Principles
  • CA/Browser Forum Baseline Requirements
  • CER Directive (EU) 2022/2557 of 14 December 2022 Article 15 (critical entities)
  • China Cybersecurity Law Article 27
  • China Cybersecurity Law Articles 27 and 44 para. 2
  • China Data Security Law Article 29 (data security incidents; unofficial DigiChina English translation of the law in force 1 September 2021)
  • CIS
  • COBIT
  • Commission Delegated Regulation (EU) 2025/301 of 23 October 2024 Article 5 (time limits for DORA major-incident reports)
  • COSO ERM 2017
  • CSA AI Model Risk Management Framework (2024)
  • CSA CCM
  • DORA
  • DORA (DevOps Research and Assessment) accelerate metrics
  • EBA Guidelines on outsourcing arrangements
  • EDPB Guidelines 07/2020 on the concepts of controller and processor in the GDPR, Version 2.1 (adopted 7 July 2021)
  • ENISA Guidelines
  • ETSI EN 304 223 V2.1.1
  • ETSI EN 319 411
  • ETSI TR 104 128 V1.1.1 (2025-05)
  • EU AI Act
  • EU Data Act (Regulation (EU) 2023/2854), Chapter VI: Switching between data processing services
  • EU GPAI Code of Practice (Safety and Security Chapter, July 2025)
  • FRC UK Corporate Governance Code
  • FSB Cyber Lexicon and Third-Party Risk Toolkit
  • G7 Hiroshima Process International Code of Conduct (2023)
  • GDPR
  • Google SRE
  • ISO 22301:2019
  • ISO 28000:2022
  • ISO 31000
  • ISO 9001:2015
  • ISO/IEC 20000-1:2018
  • ISO/IEC 23894:2023
  • ISO/IEC 27001
  • ISO/IEC 27002
  • ISO/IEC 27005:2022
  • ISO/IEC 27018:2025 A.10.1 (notification of a data breach involving PII)
  • ISO/IEC 27031:2025 (Information and communication technology readiness for business continuity)
  • ISO/IEC 27035-1:2023
  • ISO/IEC 27035-1:2023, ISO/IEC 27035-2:2023
  • ISO/IEC 27035-2:2023
  • ISO/IEC 27035-3:2020
  • ISO/IEC 27035-4:2024 (Part 4: Coordination)
  • ISO/IEC 27036-2:2022
  • ISO/IEC 27701
  • ISO/IEC 38507:2022
  • ISO/IEC 42001
  • ISO/IEC 5338:2023
  • ISO/IEC TR 27563:2023
  • ITIL 4
  • LGPD
  • MITRE ATLAS
  • NIS 2
  • NIST
  • NIST AI 100-2e2025
  • NIST AI 600-1 (Generative AI Profile)
  • NIST AI RMF
  • NIST CSF
  • NIST FIPS 140-3
  • NIST FIPS 180-4
  • NIST FIPS 186-5
  • NIST FIPS 197-upd1
  • NIST FIPS 203 / 204
  • NIST IR 8011 Vol. 2 (Hardware Asset Management)
  • NIST IR 8286C Rev. 1
  • NIST IR 8286D-upd1 (Using Business Impact Analysis to Inform Risk Prioritization and Response)
  • NIST IR 8374 Rev. 1 (Ransomware Risk Management: A Cybersecurity Framework 2.0 Community Profile, June 2026)
  • NIST SP 800-130
  • NIST SP 800-131A Rev. 2
  • NIST SP 800-152
  • NIST SP 800-161 Rev. 1
  • NIST SP 800-184 (Guide for Cybersecurity Event Recovery)
  • NIST SP 800-208
  • NIST SP 800-218 Version 1.1
  • NIST SP 800-34r1
  • NIST SP 800-38F
  • NIST SP 800-53
  • NIST SP 800-57
  • NIST SP 800-57 Part 1 Rev. 5
  • NIST SP 800-57 Part 2 Rev. 1
  • NIST SP 800-57 Part 3 Rev. 1
  • NIST SP 800-61 Rev. 3
  • NIST SP 800-84
  • NIST SP 800-88 Rev. 2
  • NIST SP 800-90B
  • NIST SSDF
  • OECD AI Principles
  • OECD G20 Principles of Corporate Governance
  • OECD Recommendation on Critical Information Infrastructure Protection
  • OWASP AI Exchange
  • OWASP LLM Top 10
  • OWASP SAMM
  • PCI DSS v4.0.1
  • PIPL
  • RFC 5280
  • S/MIME Baseline Requirements
  • SANS CAISG v1.4
  • SANS Critical AI Security Guidelines v1.4 (March 2026), Incident Response and Forensics for AI Systems
  • SLSA v1.2 Build
  • TIBER-EU
  • WCO SAFE

Go deeper

The domains behind it