Organizational Context: the mission, stakeholder expectations, dependencies and legal, regulatory and contractual requirements that frame cybersecurity risk decisions; five Subcategories.
How the organization's mission is documented and used to frame cybersecurity risk decisions; the starting point of Organizational Context, before stakeholder expectations (GV.OC-02) and requirements (GV.OC-03).
Identifying internal and external stakeholders and what they expect from the organization's cybersecurity risk management, from directors and employees to customers, partners, regulators and society.
Tracking and managing the laws, regulations and contract terms that impose cybersecurity, privacy and civil liberties obligations, and aligning strategy with them; the Subcategory that ties the CSF to compliance obligations.
Determining which objectives, capabilities and services customers and other external stakeholders rely on, using business impact analysis and resilience objectives such as recovery time objectives.
The reverse of GV.OC-04: inventorying what the organization itself depends on, such as facilities and cloud hosting providers, and flagging external dependencies that could be single points of failure.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.