‹ CRA-5.8.1 CRA-5.8.1B › CRA-5.8.1A Licensees must have a robust cyber security risk management framework that encompasses, at a minimum, the following components: (a) Cyber security strategy; (b) Cyber security policy; and (c) Cyber security risk management approach, tools and methodology and, an organization-wide security awareness program. Added: April 2023 ‹ CRA-5.8.1 CRA-5.8.1B ›