Business context explains an asset’s organizational purpose, operational importance, and surrounding circumstances so cybersecurity decisions reflect business needs rather than raw technical data. section 6.1
Use business context to:
- Identify which assets require heightened protection and why. section 6.1
- Assess how threats could affect organizational activities and overall risk. section 6.1
- Prioritize activities, allocate resources, and design security measures for specific needs. section 6.1
- Add human judgment when automated findings may conflict with legitimate business activity, legal requirements, or ethical considerations. section 13.10
Interpreting an automated alert
An intrusion detection system may flag an unusual activity spike, but the spike could result from a legitimate system update rather than a breach. Similarly, automated behavior analysis might recommend revoking access from a legitimate user. Reviewers must interpret these findings against operational circumstances before changing access or beginning incident response. section 13.10
