CGROM Open Edition v2.0: Cyber Governance and Risk Operating Model

Version 2.0 expands the Open Edition from six to ten governance mechanisms, adding policy architecture and exception management, control evidence and audit readiness, incident governance and materiality determination, and artificial intelligence governance. It adds a risk assessment method with published impact and likelihood anchors, a catalogue of twenty four key risk indicators and ten performance indicators with formulas and data sources, a section on third party and supply chain risk, an operational resilience method with a testing ladder and scenario library, a consolidated inventory of United States incident reporting obligations, an artificial intelligence governance overlay, four adoption paths and an artifact library.

Regulatory crosswalks are extended from four to nineteen references. The self assessment retains the fifteen core statements of version 1.0 for comparability and adds a fifteen statement extended module.</p><p dir="ltr">This edition builds on CGROM Open Edition version 1.0, published September 2026, <a href="doi.org/10.6084/m9.figshare.33963217" target="_blank">doi.org/10.6084/m9.figshare.33963217</a>. Version 1.0 remains available and citable.