GV.OC-02:

Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered

Implementation Examples

Ex1:

Identify relevant internal stakeholders and their cybersecurity-related expectations (e.g., performance and risk expectations of officers, directors, and advisors; cultural expectations of employees)

Ex2:

Identify relevant external stakeholders and their cybersecurity-related expectations (e.g., privacy expectations of customers, business expectations of partnerships, compliance expectations of regulators, ethics expectations of society)