GV001Program charter and mandate

The instrument that establishes the program, states its authority, names its sponsor, and bounds what it may reach.

Pillar: GV | Governance and mandate
Sources cited: 7
Added: 30 AUGUST 2026
Updated: 5 OCTOBER 2026

Control	Jurisdiction	Source	What it establishes	Prerequisite or recommendation
GV001/HRMandatory	Croatia	Zakon o kibernetičkoj sigurnosti, članci 4, 29, 30, 37, and 38Hrvatski sabor · read 5 Oct 2026	For key and important entities, that the members of the management bodies answer for the risk management measures, approve them, control their implementation, and follow and offer employees suitable training; that the measures include human resources security, access control policies and management of software and hardware assets with a regularly updated inventory, incident handling with monitoring, recording, and reporting, cyber hygiene and training, and multi-factor or continuous authentication; that a significant incident is notified to the competent CSIRT and, where there are grounds to suspect a criminal offence, to the law enforcement bodies; and that the measures and their implementation are set by the Government’s regulation.	For key and important entities, the members of the management bodies answer for the implementation of the risk management measures, approve the measures the entity will apply, and control their implementation.
GV001/GRMandatory	Greece	Νόμος 5160/2024, άρθρα 8, 14, 15, and 16Βουλή των Ελλήνων · read 5 Oct 2026	For essential and important entities, that the Εθνική Αρχή Κυβερνοασφάλειας is the competent authority and single point of contact, that the management bodies approve the risk management measures within three months of the Act’s entry into force, supervise their implementation, and are responsible for breaches, that their members follow training and the entity gives employees similar training at least annually, that the measures include incident handling, cyber hygiene and training, human resources security, access control policies, and asset management, and multi-factor or continuous authentication, that the entity designates a Υπεύθυνος Ασφάλειας Συστημάτων Πληροφορικής και Επικοινωνιών (Υ.Α.Σ.Π.Ε.) whose duties are incompatible with the Data Protection Officer’s, keeps a single cybersecurity policy and an inventory of assets ranked by criticality, and that a significant incident is reported in an early warning within 24 hours, a notification within 72 hours, and a final report within one month.	For essential and important entities, the management bodies approve the cybersecurity risk management measures within three months of the Act’s entry into force, supervise their implementation, and are responsible for breaches of the article.
GV001/HUMandatory	Hungary	2024. évi LXIX. törvény Magyarország kiberbiztonságáról, 6. §, 10. §, 11. §, and 82. §Országgyűlés · read 5 Oct 2026	That the head of the organization establishes and operates a risk management framework, registers the systems, defines roles and responsibilities and appoints the person responsible for the security of the electronic information system, classifies the data, classifies each system into the “alap”, “jelentős”, or “magas” security class, determines and ensures the protective measures of that class, issues an information security policy reviewed at least every two years, evaluates the measures periodically, decides on taking systems into use, and reports threats, near-incidents, and incidents to the competent incident handling centre; and that the classification is reviewed at least every two years.	For organizations in scope, the head of the organization establishes and operates the risk management framework, registers the systems, defines the roles and responsibilities, appoints the person responsible for the security of the electronic information system, issues the information security policy and reviews it at least every two years, and decides on taking systems into use.
GV001/ROMandatory	Romania	Ordonanța de urgență nr. 155/2024, articolele 11 la 15Guvernul României · read 5 Oct 2026	For essential and important entities, that the measures include the logging and traceability of all activities in the networks and information systems, human resources security, access control policies and asset management, and incident handling; that the management bodies approve the measures, supervise them, and answer for breaches, follow accredited training and ensure training of all personnel; that an annual self-assessment of maturity goes to the DNSC; and that a significant incident is notified in an early warning within 24 hours, a notification within 72 hours, and a final report within one month.	For essential and important entities, the management bodies approve the cybersecurity risk management measures, supervise their implementation, and are responsible for breaches; they designate, where applicable, the persons responsible for the security of networks and information systems, who in essential entities other than public administration and small enterprises hold managerial authority.
Recommended	European Unionwhere written	Insider Threat Program Development ManualCoESS, co-financed by the Internal Security Fund of the European Union · read 11 Aug 2026	The structure of an insider risk management program, as the closest thing to doctrine issued under European Union funding, unrevised since 2019.	The Union-funded manual addresses how a program is structured, and states no legal basis for any of it.
Recommended	Irelandwhere written	Guidance on Cyber Governance for Management Board Members in NIS2 entitiesNational Cyber Security Centre · read 5 Oct 2026	That the management body of an essential or important entity approves the risk management measures, supervises their implementation, follows training and offers it to employees, and is accountable for non-compliance; that insider threats are among the threats a board identifies; and that an incident response plan, a classification procedure, a designated team, and external notification procedures are what response readiness holds.	For essential and important entities, the management body approves the cybersecurity risk management measures, supervises their implementation, and is accountable for non-compliance; the guidance restates article 20 of the Directive while the transposing Act is pending.
Recommended	United Kingdomwhere written	Insider Risk Mitigation FrameworkNPSA · read 11 Aug 2026	A structure for an insider risk management program that an organization reviews itself against, with governance and culture as foundations rather than adjuncts.	The charter is written to be reviewed against rather than filed: governance and culture are set out as things a program is measured on, not as preamble to the controls.