---

id: "GV.OC-02" title: "Organizational Context" function: "GV" function_name: "Govern" category: "GV.OC" category_name: "Organizational Context" description: "Legal, regulatory, and contractual requirements are identified and managed." controls: - PM-1 - PM-11 - PM-2 - PM-8 - PM-9 - RA-3

---

GV.OC-02: Organizational Context

Description

Legal, regulatory, and contractual requirements are identified and managed.

Category Context

Function: GV — Govern Category: GV.OC — Organizational Context

The organization's mission, stakeholder expectations, legal/regulatory requirements, and risk appetite are understood and inform cybersecurity risk management.

Mapped SP 800-53 Controls

• PM-1 (Program Management) — View Control
• PM-11 (Program Management) — View Control
• PM-2 (Program Management) — View Control
• PM-8 (Program Management) — View Control
• PM-9 (Program Management) — View Control
• RA-3 (Risk Assessment) — View Control