context Controls

The organizational mission is understood and informs cybersecurity risk management

Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered

Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated

Outcomes, capabilities, and services that the organization depends on are understood and communicated