\cleardoublepage \part{Govern} \setbookpart{Govern}

Part II: Govern

The Govern Function of CSF 2.0 establishes and monitors the organisation's cybersecurity risk-management strategy and policy, and each of its Categories gains an AI dimension when AI is asset, tool and threat at once.

Chapter 5 sets the organisational context and risk strategy, including the risk appetite for security AI (GV.OC, GV.RM). Chapter 6 defines the roles of red, blue, purple and white teams and the five autonomy levels, from Level 0 Advisory to Level 4 Autonomous, that run through the book (GV.RR). Chapter 7 covers the legal duties that require testing, threat-led testing under DORA and TIBER-EU, and rules of engagement as code (GV.PO). Chapter 8 covers oversight by the management body and AI supply-chain risk (GV.OV, GV.SC).

What you will learn in this part:

• How autonomy levels keep people in command
• How rules of engagement make offensive work lawful and safe
• How the management body oversees security AI and its supply chain