What it asks for. This Govern category asks the organisation to understand the circumstances that shape its cybersecurity risk decisions: its mission, stakeholders and their expectations, legal, regulatory and contractual requirements, critical objectives and capabilities, and the services it depends on and provides.
In practice. This means documenting the mission and critical services, identifying internal and external stakeholders, and maintaining a register of applicable obligations such as NIS2, DORA or GDPR. Dependencies on suppliers and the outcomes others rely on from the organisation are recorded. Evidence includes a business impact analysis, a regulatory obligations register and documented risk appetite context approved by leadership.
Common gaps. Context is often captured once during a certification project and not updated as the business changes. Many organisations have no maintained list of legal and contractual security obligations, which leads to missed requirements.