The organizational mission is understood and informs cybersecurity risk management

frameworkNIST Cybersecurity Framework 2.0 sectionGovern (GV) topicsBusiness Environment frameworks3 2 8

gap from NIST CSF 2.0 → gap to NIST CSF 2.0 →

Wrong or missing mapping? Report it

Equivalents of GV.OC-01 in other frameworks
Framework	Requirement	Title	Link	Source / reason
ISO 27001	Clause 4.1 Clause 4.2	Understanding the organization and its context; Understanding the needs and expectations of interested parties	Crosswalk	Same topic: Business Environment 4 loosely related (not mappings) Clause 6.1 Actions to address risks and opportunities Loosely related Only shares CSF GV.OC-01: related, not a mapping Clause 8.1 Operational planning and control Loosely related Only shares CSF GV.OC-01: related, not a mapping Clause 8.2 Information security risk assessment Loosely related Only shares CSF GV.OC-01: related, not a mapping Clause 8.3 Information security risk treatment Loosely related Only shares CSF GV.OC-01: related, not a mapping
CIS v8.1	—	No requirement	No mapping in our data	No mapping in our data (most CIS links are editorial: CIS's published crosswalk covers 49 of 153 safeguards).
SOC 2	CC3.1	Objectives specified clearly enough to identify risks	Editorial	Same topic: Business Environment (editorial pick)
PCI DSS	12.5.2	PCI DSS scope confirmed annually and on change	Crosswalk	Same topic: Business Environment 1 loosely related (not mappings) 12.1.1 Information security policy established and published Loosely related Only shares CSF GV.OC-01: related, not a mapping
CMMC	—	No requirement	No mapping in our data	No mapping in our data.
800-53	PM-11 RA-9	Mission and Business Process Definition; Criticality Analysis	Crosswalk	Same topic: Business Environment
HIPAA	—	No requirement	No mapping in our data	No mapping in our data.
GDPR	—	No requirement	No mapping in our data	No mapping in our data (only GDPR's security articles are mapped, editorially).
NIS2	—	No requirement	No mapping in our data	No mapping in our data.
Essential Eight	—	No requirement	No mapping in our data	No mapping in our data (Essential Eight links are editorial only).
DORA	Art.8(1)Art.11(5)	Identification; Response and recovery	Editorial	Same topic: Business Environment (editorial pick)
CPS 234	—	No requirement	No mapping in our data	No mapping in our data (CPS 234 is principles-based and its links are editorial).
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.