Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated

frameworkNIST Cybersecurity Framework 2.0 sectionGovern (GV) topicsBusiness Environment, Business Continuity frameworks5 3 5

gap from NIST CSF 2.0 → gap to NIST CSF 2.0 →

Wrong or missing mapping? Report it

Equivalents of GV.OC-04 in other frameworks
Framework	Requirement	Title	Link	Source / reason
ISO 27001	A.5.29 A.5.30 A.8.14 Clause 4.1 Clause 4.2	Information security during disruption; ICT readiness for business continuity…	Crosswalk	Same topic: Business Continuity, Business Environment 2 loosely related (not mappings) A.5.20 Addressing information security within supplier agreements Loosely related Only shares CSF GV.OC-04: related, not a mapping A.5.31 Legal, statutory, regulatory and contractual requirements Loosely related Only shares CSF GV.OC-04: related, not a mapping
CIS v8.1	—	No requirement	No mapping in our data	No mapping in our data (most CIS links are editorial: CIS's published crosswalk covers 49 of 153 safeguards).
SOC 2	A1.1 A1.2 CC3.1 CC9.1	Capacity management to meet availability commitments; Environmental protections, backups and recovery infrastructure…	Editorial	Same topic: Business Continuity, Business Environment (editorial pick)
PCI DSS	12.5.2 12.10.1	PCI DSS scope confirmed annually and on change; Incident response plan ready to activate	Crosswalk	Same topic: Business Environment, Business Continuity 1 loosely related (not mappings) 12.5.1 Inventory of in-scope system components Loosely related Only shares CSF GV.OC-04: related, not a mapping
CMMC	—	No requirement	No mapping in our data	No mapping in our data.
800-53	CP-2(8)PM-11 RA-9 CP-7	Identify Critical Assets; Mission and Business Process Definition…	Crosswalk	Same topic: Business Continuity, Business Environment 2 loosely related (not mappings) PM-8 Critical Infrastructure Plan Loosely related Only shares CSF GV.OC-04: related, not a mapping PM-30 Supply Chain Risk Management Strategy Loosely related Only shares CSF GV.OC-04: related, not a mapping
HIPAA	§164.308(a)(7)(ii)(C)	Emergency Mode Operation Plan	Crosswalk	Same topic: Business Continuity 6 loosely related (not mappings) §164.308(a)(7) Contingency Plan Loosely related Only shares CSF GV.OC-04: related, not a mapping §164.308(a)(7)(ii)(B) Disaster Recovery Plan Loosely related Only shares CSF GV.OC-04: related, not a mapping §164.308(a)(7)(ii)(D) Testing and Revision Procedure Loosely related Only shares CSF GV.OC-04: related, not a mapping §164.308(a)(7)(ii)(E) Applications and Data Criticality Analysis Loosely related Only shares CSF GV.OC-04: related, not a mapping §164.310(a)(2)(i) Contingency Operations Loosely related Only shares CSF GV.OC-04: related, not a mapping §164.312(a)(2)(ii) Emergency Access Procedure Loosely related Only shares CSF GV.OC-04: related, not a mapping
GDPR	Art.32(1)(b)	Security of processing	Editorial	Same topic: Business Continuity (editorial pick)
NIS2	4.1 4.3	Business continuity and disaster recovery plan; Crisis management	Crosswalk	Same topic: Business Continuity
Essential Eight	—	No requirement	No mapping in our data	No mapping in our data (Essential Eight links are editorial only).
DORA	Art.8(1)Art.11(1)Art.11(4)Art.11(5)Art.11(6)	Identification; Response and recovery…	Editorial	Same topic: Business Environment, Business Continuity (editorial pick)
CPS 234	—	No requirement	No mapping in our data	No mapping in our data (CPS 234 is principles-based and its links are editorial).
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.