[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-csf\u002Fgv-oc":3},{"item":4,"lessons":16,"controls":66,"related":93},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nist-csf","gv-oc","GV.OC","Organizational Context",21,"US National Institute of Standards and Technology (NIST)","**What it asks for.** This Govern category asks the organisation to understand the circumstances that shape its cybersecurity risk decisions: its mission, stakeholders and their expectations, legal, regulatory and contractual requirements, critical objectives and capabilities, and the services it depends on and provides.\n\n**In practice.** This means documenting the mission and critical services, identifying internal and external stakeholders, and maintaining a register of applicable obligations such as NIS2, DORA or GDPR. Dependencies on suppliers and the outcomes others rely on from the organisation are recorded. Evidence includes a business impact analysis, a regulatory obligations register and documented risk appetite context approved by leadership.\n\n**Common gaps.** Context is often captured once during a certification project and not updated as the business changes. Many organisations have no maintained list of legal and contractual security obligations, which leads to missed requirements.",null,"https:\u002F\u002Fwww.nist.gov\u002Fcyberframework","Open the Cybersecurity Framework at NIST","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"federal-agencies-issue-cybersecurity-guidance-for-frontier-ai-systems","Federal Agencies Issue Cybersecurity Guidance for Frontier AI Systems","2026-10-17T02:20:17.238+00:00",{"slug":23,"title":24,"published_at":25},"federal-ot-systems-lack-baseline-security-standards-and-visibility","Federal OT Systems Lack Baseline Security Standards and Visibility","2026-10-06T12:21:17.687+00:00",{"slug":27,"title":28,"published_at":29},"fedramp-high-authorization-highlights-federal-app-api-security-imperatives","FedRAMP High Authorization Highlights Federal App & API Security Imperatives","2026-10-05T18:20:36.079+00:00",{"slug":31,"title":32,"published_at":33},"ai-in-critical-infrastructure-demands-rigorous-oversight-and-visibility","AI in Critical Infrastructure Demands Rigorous Oversight and Visibility","2026-09-29T20:20:24.121+00:00",{"slug":35,"title":36,"published_at":37},"autonomous-ai-hacking-exposes-legal-and-governance-gaps","Autonomous AI Hacking Exposes Legal and Governance Gaps","2026-09-24T22:21:14.466+00:00",{"slug":39,"title":40,"published_at":41},"biotech-sector-lacks-formal-cyber-protections-under-critical-infrastructure-framework","Biotech Sector Lacks Formal Cyber Protections Under Critical Infrastructure Framework","2026-09-24T22:20:24.544+00:00",{"slug":43,"title":44,"published_at":45},"salt-typhoon-breach-spurs-senate-action-on-telecom-cybersecurity","Salt Typhoon Breach Spurs Senate Action on Telecom Cybersecurity","2026-09-24T21:21:28.177+00:00",{"slug":47,"title":48,"published_at":49},"fbi-cjis-v61-raises-the-bar-on-encryption-and-vulnerability-scanning","FBI CJIS v6.1 Raises the Bar on Encryption and Vulnerability Scanning","2026-09-21T16:21:54.052+00:00",{"slug":51,"title":52,"published_at":53},"us-china-ai-incident-notification-talks-highlight-need-for-global-ai-governance-frameworks","US-China AI Incident Notification Talks Highlight Need for Global AI Governance Frameworks","2026-09-21T12:21:10.295+00:00",{"slug":55,"title":56,"published_at":57},"eu-cra-mandates-24-hour-vulnerability-disclosure-and-sboms-for-software-vendors","EU CRA Mandates 24-Hour Vulnerability Disclosure and SBOMs for Software Vendors","2026-09-08T22:22:14.449+00:00",{"slug":59,"title":60,"published_at":61},"ai-powered-threat-detection-opportunity-and-risk-in-security-platforms","AI-Powered Threat Detection: Opportunity and Risk in Security Platforms","2026-09-07T12:21:37.773+00:00",{"slug":63,"title":64,"published_at":65},"should-ai-be-designated-critical-infrastructure","Should AI Be Designated Critical Infrastructure?","2026-08-20T14:20:19.41+00:00",[67,72,77,81,85,89],{"slug":68,"name":69,"problem":70,"stories":71},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",3,{"slug":73,"name":74,"problem":75,"stories":76},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",2,{"slug":78,"name":79,"problem":80,"stories":76},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",{"slug":82,"name":83,"problem":84,"stories":76},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",{"slug":86,"name":87,"problem":88,"stories":76},"deception","Deception and honeypots","An attacker who gets in quietly can explore the network for weeks before any alarm goes off.",{"slug":90,"name":91,"problem":92,"stories":76},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[94,99,105,110,115,120,125,129],{"family":95,"item":96,"code":97,"title":97,"together":98},"itil","overview","ITIL",11,{"family":100,"item":101,"code":102,"title":103,"together":104},"cis","17","Control 17","Incident Response Management",7,{"family":106,"item":96,"code":107,"title":108,"together":109},"nist-ai-rmf","AI RMF 1.0","AI Risk Management Framework (AI RMF 1.0)",6,{"family":100,"item":111,"code":112,"title":113,"together":114},"16","Control 16","Application Software Security",5,{"family":116,"item":117,"code":118,"title":119,"together":114},"gdpr","32","Article 32","Security of processing",{"family":100,"item":121,"code":122,"title":123,"together":124},"13","Control 13","Network Monitoring and Defense",4,{"family":100,"item":126,"code":127,"title":128,"together":124},"3","Control 3","Data Protection",{"family":100,"item":130,"code":131,"title":132,"together":124},"1","Control 1","Inventory and Control of Enterprise Assets"]