Frameworks / NIST Cybersecurity Framework 2.0 / NIST-CSF-GV.OC-05 NIST Cybersecurity Framework 2.0
GV - Govern
NIST Cybersecurity Framework 2.0 NIST-CSF-GV.OC-05: Outcomes, capabilities, and services that the organization depends on are understood and communicated Outcomes, capabilities, and services that the organization depends on are understood and communicated
Maintained by Gerard Blokdyk · Verified against the published standard 31 May 2026 · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 53 controls across 21 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
5.21 Managing information security in the information and communication technology (ICT) supply chain 5.22 Monitoring, review and change management of supplier services 5.29 Information security during disruption 5.9 Inventory of information and other associated assets 8.14 Redundancy of information processing facilities 8.32 Change management SOC2-A1.1 A1.1 Managing processing capacity SOC2-A1.3 A1.3 Testing recovery plan procedures SOC2-CC2.1 CC2.1 Relevant, quality information to support internal control (COSO principle 13) SOC2-CC3.2 CC3.2 Identifying and analysing risks to objectives (COSO principle 7) SOC2-CC9.1 CC9.1 Mitigating risks of business disruption 4.3.2 Scope of the business continuity management system 6.2.2 Determining business continuity objectives 8.2 Business impact analysis and risk assessment 8.2.2 Business impact analysis 4.1 Understanding the organization and its context 6.1.2 AI risk assessment 8.2 AI risk assessment A.5 Assessing impacts of AI systems CPS230-19 Tolerance Levels for Each Critical Operation CPS230-39 Register of Material Service Providers CPS230-P27 Comprehensive Assessment of the Operational Risk Profile ISM-0734 CISO contribution to continuity and recovery planning ISM-1631 Identifying suppliers for systems C5-BCM-02 Business impact analysis policies and instructions C5-OIS-03 Interfaces and Dependencies CFTC-SS-27 Coordination of the Recovery Plan with Members and Market Participants CFTC-SS-29 Recovery Plan Accounts for Essential Service Providers CP-2(8) Contingency Plan | Identify Critical Assets (CP-2(8)) RA-9 Criticality Analysis (RA-9) CP-2(8) Contingency Plan | Identify Critical Assets (CP-2(8)) RA-9 Criticality Analysis (RA-9) ID.BE-1 ID.BE-1: The organization's role in the supply chain is identified and communicated ID.BE-4 ID.BE-4: Dependencies and critical functions for delivery of critical services are established ID.BE-1 ID.BE-1: The organization's role in the supply chain is identified and communicated ID.BE-4 ID.BE-4: Dependencies and critical functions for delivery of critical services are established 5.30 ICT readiness for business continuity Art.21.1 Take proportionate all-hazards measures calibrated to the entity's own risk exposure GV.OC-05 GV.OC-05 The organization's own dependencies on external resources inform response priorities Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Other controls in GV - Govern NIST-CSF-GV.OC-01 The organizational mission is understood and informs cybersecurity risk management NIST-CSF-GV.OC-02 Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered NIST-CSF-GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed NIST-CSF-GV.OC-04 Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated NIST-CSF-GV.PO-01 Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced NIST-CSF-GV.PO-02 Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission NIST-CSF-GV.RM-01 Risk management objectives are established and agreed to by organizational stakeholders NIST-CSF-GV.RM-02 Risk appetite and risk tolerance statements are established, communicated, and maintained You are reading one control. How much of NIST Cybersecurity Framework 2.0 have you already done? NIST Cybersecurity Framework 2.0 NIST-CSF-GV.OC-05 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of NIST Cybersecurity Framework 2.0 your existing evidence covers. Hold ISO 27001:2022 and 73 of 106 NIST Cybersecurity Framework 2.0 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 174 were rejected on the ISO 27001:2022 pair alone.
Query this from an agent The graph holds this control, the 53 it maps to, and the evidence behind each claim, over MCP and REST.