This cluster consolidates principles, frameworks, and practices for corporate governance, risk management, and assignment of responsibility.
Defines ethical principles, assessment dimensions, reporting criteria, category taxonomies, and assignment logic for governance, risk assessment, and responsibility allocation. Included are definitions, metrics, thresholds, decision principles, classification levels, report formats, and documentation requirements. Excluded are operational security controls, technical implementation details, legal advice, specific audit plans and financial risk analyses.