[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-csf\u002Fgv-oc":3},{"item":4,"lessons":16,"controls":67,"related":94},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nist-csf","gv-oc","GV.OC","Organizational Context",21,"US National Institute of Standards and Technology (NIST)","**What it asks for.** This Govern category asks the organisation to understand the circumstances that shape its cybersecurity risk decisions: its mission, stakeholders and their expectations, legal, regulatory and contractual requirements, critical objectives and capabilities, and the services it depends on and provides.\n\n**In practice.** This means documenting the mission and critical services, identifying internal and external stakeholders, and maintaining a register of applicable obligations such as NIS2, DORA or GDPR. Dependencies on suppliers and the outcomes others rely on from the organisation are recorded. Evidence includes a business impact analysis, a regulatory obligations register and documented risk appetite context approved by leadership.\n\n**Common gaps.** Context is often captured once during a certification project and not updated as the business changes. Many organisations have no maintained list of legal and contractual security obligations, which leads to missed requirements.",null,"https:\u002F\u002Fwww.nist.gov\u002Fcyberframework","Open the Cybersecurity Framework at NIST","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},25,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"unsecured-ai-agent-exposes-enterprise-to-invoice-fraud-via-email-manipulation","Unsecured AI Agent Exposes Enterprise to Invoice Fraud via Email Manipulation","2026-11-13T16:22:22.358+00:00",{"slug":24,"title":25,"published_at":26},"ai-governance-platforms-rise-as-eu-ai-act-obligations-force-organizations-to-inventory-and-manage-ai","AI Governance Platforms Rise as EU AI Act Obligations Force Organizations to Inventory and Manage AI Risk","2026-11-13T09:21:16.514+00:00",{"slug":28,"title":29,"published_at":30},"ai-powered-security-tools-raise-questions-about-dependency-and-risk","AI-Powered Security Tools Raise Questions About Dependency and Risk","2026-11-12T21:20:37.136+00:00",{"slug":32,"title":33,"published_at":34},"irelands-cyber-unpreparedness-highlights-the-cost-of-delayed-nis2-transposition","Ireland's Cyber Unpreparedness Highlights the Cost of Delayed NIS2 Transposition","2026-11-10T13:21:14.597+00:00",{"slug":36,"title":37,"published_at":38},"federal-agencies-issue-cybersecurity-guidance-for-frontier-ai-systems","Federal Agencies Issue Cybersecurity Guidance for Frontier AI Systems","2026-10-17T02:20:17.238+00:00",{"slug":40,"title":41,"published_at":42},"federal-ot-systems-lack-baseline-security-standards-and-visibility","Federal OT Systems Lack Baseline Security Standards and Visibility","2026-10-06T12:21:17.687+00:00",{"slug":44,"title":45,"published_at":46},"fedramp-high-authorization-highlights-federal-app-api-security-imperatives","FedRAMP High Authorization Highlights Federal App & API Security Imperatives","2026-10-05T18:20:36.079+00:00",{"slug":48,"title":49,"published_at":50},"ai-in-critical-infrastructure-demands-rigorous-oversight-and-visibility","AI in Critical Infrastructure Demands Rigorous Oversight and Visibility","2026-09-29T20:20:24.121+00:00",{"slug":52,"title":53,"published_at":54},"autonomous-ai-hacking-exposes-legal-and-governance-gaps","Autonomous AI Hacking Exposes Legal and Governance Gaps","2026-09-24T22:21:14.466+00:00",{"slug":56,"title":57,"published_at":58},"biotech-sector-lacks-formal-cyber-protections-under-critical-infrastructure-framework","Biotech Sector Lacks Formal Cyber Protections Under Critical Infrastructure Framework","2026-09-24T22:20:24.544+00:00",{"slug":60,"title":61,"published_at":62},"salt-typhoon-breach-spurs-senate-action-on-telecom-cybersecurity","Salt Typhoon Breach Spurs Senate Action on Telecom Cybersecurity","2026-09-24T21:21:28.177+00:00",{"slug":64,"title":65,"published_at":66},"fbi-cjis-v61-raises-the-bar-on-encryption-and-vulnerability-scanning","FBI CJIS v6.1 Raises the Bar on Encryption and Vulnerability Scanning","2026-09-21T16:21:54.052+00:00",[68,73,77,81,85,90],{"slug":69,"name":70,"problem":71,"stories":72},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",3,{"slug":74,"name":75,"problem":76,"stories":72},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",{"slug":78,"name":79,"problem":80,"stories":72},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",{"slug":82,"name":83,"problem":84,"stories":72},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":86,"name":87,"problem":88,"stories":89},"breach-attack-simulation","Breach and attack simulation","You only find out whether your security tools stop an attack when a real attacker tries.",2,{"slug":91,"name":92,"problem":93,"stories":89},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[95,100,106,111,116,121,126,130],{"family":96,"item":97,"code":98,"title":98,"together":99},"itil","overview","ITIL",11,{"family":101,"item":102,"code":103,"title":104,"together":105},"cis","17","Control 17","Incident Response Management",7,{"family":107,"item":97,"code":108,"title":109,"together":110},"nist-ai-rmf","AI RMF 1.0","AI Risk Management Framework (AI RMF 1.0)",6,{"family":101,"item":112,"code":113,"title":114,"together":115},"16","Control 16","Application Software Security",5,{"family":117,"item":118,"code":119,"title":120,"together":115},"gdpr","32","Article 32","Security of processing",{"family":101,"item":122,"code":123,"title":124,"together":125},"13","Control 13","Network Monitoring and Defense",4,{"family":101,"item":127,"code":128,"title":129,"together":125},"3","Control 3","Data Protection",{"family":101,"item":131,"code":132,"title":133,"together":125},"18","Control 18","Penetration Testing"]