GV.OC-01 says the organizational mission is understood and informs cybersecurity risk management. In plain terms: write down what your company exists to do, then use that to decide which risks matter most. A payments startup and a design agency have different worst days, and your security priorities should show it.
What good looks like
Leaders can state the mission in a sentence and name the two or three services that would hurt customers most if they failed. Risk discussions start from those services, not from a generic list of threats. When someone proposes a control, the first question is which part of the mission it protects.
How to implement it
- Pull the mission and vision statement from your website or strategy deck and put it at the top of your risk register.
- List the services customers pay for. Next to each, write what would stop the mission if it broke: a data leak, an outage, a poisoned dependency, a lost key.
- Share the one page with engineering, product and finance so everyone ranks risk the same way.
- Revisit it when the mission changes: a new market, a new product line, an acquisition.
Evidence to collect
- The mission statement and the dated one page that links it to your top risks.
- Meeting notes or risk register entries that reference the mission when ranking a risk.
- Version history showing the page was reviewed after a business change.
Common gaps
- The mission lives in marketing and never reaches the risk process.
- Risks are ranked by technical severity alone, so a loud but harmless issue beats a quiet one that threatens revenue.
- Nobody owns the page, so it goes stale after the first review.
Quick check
Does GV.OC-01 need a formal mission document?
No. A short, dated page that connects the mission to your top risks is enough. NIST lists mission and vision statements as one way to share the mission, not as a required artifact.
Sources
- NIST Cybersecurity Framework 2.0 Reference Tool, subcategory GV.OC-01: https://csrc.nist.gov/projects/cybersecurity-framework/filters
- NIST Cybersecurity Framework overview: https://www.nist.gov/cyberframework
The CSF is voluntary guidance. There is no CSF certification, so this post describes how to work toward the outcome, not how to pass an audit.
