GV.PO-01 — Cybersecurity policy is established and communicated

high policy-governance

Requirement

Policy for managing cybersecurity risks is established based on organisational context, cybersecurity strategy and priorities, and is communicated and enforced.

What the engine looks for

Every group below must be satisfied — by an affirmative statement, not a plan, a hedge or a denial — for the control to count as covered. A term ending in … matches any word it begins. Supporting terms do not change the verdict — they raise confidence and distinguish a policy that names a mechanism from one that gestures at a category.

Required element 1 — any one of

policy

Required element 2 — any one of

approvedcommunicatedenforcedpublished

Supporting terms — specificity signals

reviewed annuallyownerversionacknowledgeexception process

Contradiction markers

Finding any of these outranks coverage — a policy that admits the gap is worse than silence.

no policy policy is out of date

Equivalent controls elsewhere

Matched on shared topics. Satisfying this control usually moves these too.

Framework	Control	Title	Shared topics
GDPR	Art.24	Responsibility of the controller	policy-governance
GDPR	Art.31	Cooperation with the supervisory authority	policy-governance
SOC 2	CC5.1	Selection and development of control activities	policy-governance
SOC 2	CC5.3	Deployment through policies and procedures	policy-governance
ISO 27001	A.5.1	Policies for information security	policy-governance
ISO 27001	A.6.4	Disciplinary process	policy-governance
PCI DSS 4.0.1	12.1	Information security policy	policy-governance
HIPAA	164.308(a)(1)(ii)(C)	Sanction policy (R)	policy-governance