NIST Cybersecurity Framework 2.0
GV - Govern

NIST Cybersecurity Framework 2.0 NIST-CSF-GV.OC-01: The organizational mission is understood and informs cybersecurity risk management

The organizational mission is understood and informs cybersecurity risk management

What else in your programme already covers this

This control maps to 58 controls across 29 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

ISO 22301:2019 · 6 controls

  • 4.1 Understanding the organization and its context
  • 4.2 Understanding the needs and expectations of interested parties
  • 4.3 Determining the scope of the business continuity management system
  • 4.3.2 Scope of the business continuity management system
  • 5.1 Leadership and commitment
  • 6.1.1 Determining risks and opportunities

ISO 27701:2019 · 5 controls

  • 5.2 Context of the organization
  • 5.2.1 Understanding the organization and its context
  • 5.2.2 Understanding the needs and expectations of interested parties
  • 5.2.3 Determining the scope of the information security management system
  • 8.2.2 Organization’s purposes

NIST SP 800-53 Rev 5 · 5 controls

  • NIST800-PL-7 Concept of Operations. Develop a Concept of Operations (CONOPS) for the system describing how the organization intends to operate the system from the perspective of information security and privacy; and Review and update the
  • NIST800-PM-11 Mission and Business Process Definition. Define organizational mission and business processes with consideration for information security and privacy and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation; and
  • NIST800-PM-28 Risk Framing. Identify and document: Assumptions affecting risk assessments, risk responses, and risk monitoring; Constraints affecting risk assessments, risk responses, and risk monitoring; Priorities and trade-offs considered by the organization for managing risk; and
  • NIST800-PM-9 Risk Management Strategy. Develops a comprehensive strategy to manage: Security risk to organizational operations and assets, individuals, other organizations, and the Nation associated with the operation and use of organizational systems; and Privacy risk
  • NIST800-RA-3 Risk assessment

APRA CPS 220 Risk Management · 4 controls

  • CPS220-P21 Consistency of the Framework with the Business Plan
  • CPS220-P22 Framework Structure for Managing Each Material Risk
  • CPS220-P31 Maintenance of a Business Plan
  • CPS220-P33 Risks Arising from Strategic Objectives and the Business Plan

ISO 27002:2022 · 4 controls

  • 5.1 Policies for information security
  • 5.2 Information security roles and responsibilities
  • 5.31 Legal, statutory, regulatory and contractual requirements
  • 5.7 Threat intelligence

ISO/IEC 42001:2023 · 4 controls

  • 4.1 Understanding the organization and its context
  • 4.3 Determining the scope of the management system
  • A.2.3 Alignment with other organizational policies
  • A.5 Assessing impacts of AI systems

SOC 2 · 4 controls

  • SOC2-CC1.2 COSO principle 2: Board exercises oversight responsibility
  • SOC2-CC1.3 COSO principle 3: Management establishes structures, reporting lines, and authorities
  • SOC2-CC2.1 COSO principle 13: Obtains and generates relevant, quality information
  • SOC2-CC3.1 COSO principle 6: Specifies objectives to identify and assess risks

ISO 27001:2022 · 3 controls

  • 5.1 Policies for information security
  • 5.2 Information security roles and responsibilities
  • 5.31 Legal, statutory, regulatory and contractual requirements

APRA SPS 220 Risk Management (Superannuation) · 2 controls

  • SPS220-P13 Contagion Risk from Non Superannuation Business
  • SPS220-P18 Risks Arising from Strategic Objectives and the Business Plan

NIS2 Directive · 2 controls

  • Art.21.1 Take proportionate all-hazards measures calibrated to the entity's own risk exposure
  • Art.26 Establish which Member State has jurisdiction, and designate a Union representative if not established in the Union

APRA CPS 230 Operational Risk Management · 1 control

  • CPS230-P26 Assessment of Business and Strategic Decisions on the Risk Profile

ASEAN Data Management Framework · 1 control

  • ADMF-2.2 Define objectives, scope and considerations (what and why)

ASIC Cyber Resilience Good Practices · 1 control

AWS Well-Architected Security Pillar · 1 control

  • SEC01-BP03 Identify and validate control objectives

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association) · 1 control

Australian Energy Sector Cyber Security Framework (AESCSF) · 1 control

Australian Information Security Manual · 1 control

  • ISM-1999 The board of directors or executive committee ensures the cyber security strategy for thei

Belgium CyberFundamentals · 1 control

C5 (Germany) · 1 control

  • C5-OIS-01 Information Security Management System (ISMS)

CCSDS 350.0-G-3 - Space Communications Security (Consultative Committee for Space Data Systems) · 1 control

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 1 control

FedRAMP High · 1 control

  • PL-2 System Security and Privacy Plans

FedRAMP Moderate · 1 control

  • PL-2 System Security and Privacy Plans

HIPAA Security Rule · 1 control

NIST SP 800-161 Rev 1 · 1 control

NIST SP 800-53 Rev 5 LOW · 1 control

  • PL-2 System Security and Privacy Plans

NIST SP 800-53 Rev 5 MODERATE · 1 control

  • PL-2 System Security and Privacy Plans

NIST SP 800-53 Revision 5.1 HIGH · 1 control

  • PL-2 System Security and Privacy Plans

NIST SP 800-66 Rev 2 · 1 control

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in GV - Govern

You are reading one control. How much of NIST Cybersecurity Framework 2.0 have you already done?

NIST Cybersecurity Framework 2.0 NIST-CSF-GV.OC-01 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of NIST Cybersecurity Framework 2.0 your existing evidence covers. Hold ISO 27001:2022 and 73 of 106 NIST Cybersecurity Framework 2.0 controls already carry evidence.

If you hold ISO 27001:202268.9% covered · 33 gapsIf you hold NIST SP 800-53 Rev 567.9% covered · 34 gapsIf you hold C5 (Germany)67% covered · 35 gapsIf you hold FedRAMP Moderate63.2% covered · 39 gapsIf you hold ISO 27002:202258.5% covered · 44 gapsIf you hold CIS Controls v853.8% covered · 49 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 174 were rejected on the ISO 27001:2022 pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 58 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll NIST Cybersecurity Framework 2.0 controls