Cyberattack governance is discussed and analyzed from incident identification and investigation viewpoints. The RGFE cybersecurity governance is presented from the fusion model of NIST CSF and ISO/IEC 27043:2015. That day-to-day business activity model has demonstrated due diligence and good corporate governance. It also can promote the evidence of court acceptance and reduce the expenses and time of an internal investigation. That will enhance the financial CISO mindset capacity of incident response trade-off from the following benefits :

1. Early detection and repair of potential risks.
2. Deploy information security protection software against potential threats.
3. Continuous monitoring of vulnerabilities and threats.
4. Quickly determine the scope of damage and respond.