COR - Organizational Coherence
Making what's defined in documents a reality
Domain Description
It establishes the foundation for cybersecurity governance, strategy and compliance, ensuring that the documented policies, procedures and controls reflect the strategic and operational reality and the agreements reached with stakeholders. It covers organizational risk management, regulatory compliance mapping, independent risk-based assessment and the mechanisms for continuous improvement and corrective actions.
Its central goal is to align business objectives with the cybersecurity strategy through effective governance structures, defined roles, and periodic review and audit cycles.
COR Controls
COR-1
COR-2
COR-3
COR-4
Common problems in companies
There's no process documentation, and documents are only created or reviewed during audits
Documents don't reflect the reality of the company's strategy or operations. Some scenarios: a certification was implemented because of rushed business needs, for sales or marketing, among others.
There's a perception that processes are slow, but the company's size or growth strategy isn't taken into account.
ROI (Return on Investment)
For companies
Time saved in creation, and a roadmap to achieve process coverage. Improves Business as Usual (BaU).
Focus on real cybersecurity activities.
Getting ahead of controls from different cybersecurity frameworks.
For cybersecurity professionals
Knowledge and tools to identify cybersecurity risks in companies.
Reference methodology for the continuous improvement of enterprise cybersecurity.
Growth in detailed cybersecurity skills.