GV.OC: Organizational Context
Category is new to this version of the framework and incorporates the following item from the previous version: ID.BE: Business Environment.
Description
The circumstances – mission, stakeholder expectations, dependencies, and legal, regulatory, and contractual requirements – surrounding the organization's cybersecurity risk management decisions are understood
Framework Subcategories
GV.OC-01: The organizational mission is understood and informs cybersecurity risk management
[csf.tools Note: Subcategories do not have detailed descriptions.]
GV.OC-02: Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered
[csf.tools Note: Subcategories do not have detailed descriptions.]
GV.OC-03: Legal, regulatory, and contractual requirements regarding cybersecurity – including privacy and civil liberties obligations – are understood and managed
[csf.tools Note: Subcategories do not have detailed descriptions.]
GV.OC-04: Critical objectives, capabilities, and services that stakeholders depend on or expect from the organization are understood and communicated
[csf.tools Note: Subcategories do not have detailed descriptions.]
GV.OC-05: Outcomes, capabilities, and services that the organization depends on are understood and communicated
[csf.tools Note: Subcategories do not have detailed descriptions.]