GV.OC Organizational Context

Statement

The organizational mission is understood and informs cybersecurity risk management

Example

Share the organization's mission (e.g., through vision and mission statements, marketing, and service strategies) to provide a basis for identifying risks that may impede that mission

Statement

Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered

Example

Identify relevant internal stakeholders and their cybersecurity-related expectations (e.g., performance and risk expectations of officers, directors, and advisors; cultural expectations of employees)

Example

Identify relevant external stakeholders and their cybersecurity-related expectations (e.g., privacy expectations of customers, business expectations of partnerships, compliance expectations of regulators, ethics expectations of society)

Statement

Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed

Example

Determine a process to track and manage legal and regulatory requirements regarding protection of individuals' information (e.g., Health Insurance Portability and Accountability Act, California Consumer Privacy Act, General Data Protection Regulation)

Example

Determine a process to track and manage contractual requirements for cybersecurity management of supplier, customer, and partner information

Example

Align the organization's cybersecurity strategy with legal, regulatory, and contractual requirements

Statement

Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated

Example

Establish criteria for determining the criticality of capabilities and services as viewed by internal and external stakeholders

Example

Determine (e.g., from a business impact analysis) assets and business operations that are vital to achieving mission objectives and the potential impact of a loss (or partial loss) of such operations

Example

Establish and communicate resilience objectives (e.g., recovery time objectives) for delivering critical capabilities and services in various operating states (e.g., under attack, during recovery, normal operation)

Statement

Outcomes, capabilities, and services that the organization depends on are understood and communicated

Example

Create an inventory of the organization's dependencies on external resources (e.g., facilities, cloud-based hosting providers) and their relationships to organizational assets and business functions

Example

Identify and document external dependencies that are potential points of failure for the organization's critical capabilities and services, and share that information with appropriate personnel