# Govern

GV.OC-01: The organizational mission is understood and informs cybersecurity risk management

• Ex1:  Share the organization’s mission (e.g., through vision and mission statements, marketing, and service strategies) to provide a basis for identifying risks that may impede that mission

GV.OC-02: Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered

• Ex1:  Identify relevant internal stakeholders and their cybersecurity-related expectations (e.g., performance and risk expectations of officers, directors, and advisors; cultural expectations of employees)
• Ex2:  Identify relevant external stakeholders and their cybersecurity-related expectations (e.g., privacy expectations of customers, business expectations of partnerships, compliance expectations of regulators, ethics expectations of society)

GV.OC-03: Legal, regulatory, and contractual requirements regarding cybersecurity — including privacy and civil liberties obligations — are understood and managed`

• Ex1:  Determine a process to track and manage legal and regulatory requirements regarding protection of individuals’ information (e.g., Health Insurance Portability and Accountability Act, California Consumer Privacy Act, General Data Protection Regulation)
• Ex2:  Determine a process to track and manage contractual requirements for cybersecurity management of supplier, customer, and partner information
• Ex3:  Align the organization’s cybersecurity strategy with legal, regulatory, and contractual requirements

GV.OC-04: Critical objectives, capabilities, and services that stakeholders depend on or expect from the organization are understood and communicated`

• Ex1:  Establish criteria for determining the criticality of capabilities and services as viewed by internal and external stakeholders
• Ex2:  Determine (e.g., from a business impact analysis) assets and business operations that are vital to achieving mission objectives and the potential impact of a loss (or partial loss) of such operations
• Ex3:  Establish and communicate resilience objectives (e.g., recovery time objectives) for delivering critical capabilities and services in various operating states (e.g., under attack, during recovery, normal operation)

GV.OC-05: Outcomes, capabilities, and services that the organization depends on are understood and communicated

• Ex1:  Create an inventory of the organization’s dependencies on external resources (e.g., facilities, cloud-based hosting providers) and their relationships to organizational assets and business functions
• Ex2:  Identify and document external dependencies that are potential points of failure for the organization’s critical capabilities and services, and share that information with appropriate personnel

• Ex1:  Update near-term and long-term cybersecurity risk management objectives as part of annual strategic planning and when major changes occur
• Ex2:  Establish measurable objectives for cybersecurity risk management (e.g., manage the quality of user training, ensure adequate risk protection for industrial control systems)
• Ex3:  Senior leaders agree about cybersecurity objectives and use them for measuring and managing risk and performance