Has the organization formally documented and shared its mission statement to provide a basis for identifying risks that may impede that mission?

A clearly articulated mission statement helps stakeholders understand the organization's purpose and priorities, which is essential for identifying relevant security risks that could impact core business objectives. When mission statements are properly communicated throughout the organization, security teams can better align their risk assessments with business goals, ensuring that security controls protect what matters most to the organization.

Evidence could include: published mission/vision statements on company websites or internal portals, risk assessment documentation that references the mission statement when prioritizing risks, or internal communications that connect security initiatives to the organization's mission.