organization-defined frequency
An *organization-defined frequency* is an instance of an **organization-defined control parameter** — the variable part of a security or privacy control that an organization fills in during the tailoring process by assigning a concrete value. As a frequency parameter specifically, it is a placeholder in a control statement that requires the implementing organization to decide *how often* a required activity — such as a review, update, assessment, or report — must recur, calibrating the cadence to the organization's own risk environment, mission, and operational tempo rather than prescribing a universal interval. The rationale is that circumstances such as organizational missions, business functions, environments of operation, technologies, or threat change over time, making periodic repetition of certain activities necessary and the appropriate interval something each organization must judge for itself. In practice, it appears throughout NIST control catalogs as an *Assignment* notation — e.g., `[Assignment: organization-defined frequency]` — wherever a control mandates a recurring action and leaves the interval open for the organization to specify, with implementers then documenti
Senses
No definition is given in NIST SP 800-171r3. The term is attested in use at 24 citations in that document; a definition is pending curation.
A structured placeholder — specifically an **assignment-operation control parameter** — embedded in a security or privacy control statement to mark the temporal cadence of a recurring activity as a value that each implementing organization must determine and document for itself during the control-tailoring process. It is formally defined in NIST SP 800-53 as "a control parameter that allows an organization to assign a specific, organization-defined value to the control or control enhancement," with frequency of testing cited as the canonical example of such an assignment. More broadly, NIST defines the class to which it belongs — the organization-defined control parameter — as "the variable part of a control or control enhancement that can be instantiated by an organization during the tailoring process by either assigning an organization-defined value or selecting a value from a pre-defined list." In practice, the expression functions as a deliberate blank in a control's text — appearing in brackets as `[Assignment: organization-defined frequency]` — which the implementing organization fills with a concrete interval (e.g., annually, quarterly, after each major change) that reflects its own risk management strategy, since the entity is expected to select a value appropriate for the organization.
Classifications
Entity Type
Sensitivity
Information Class
Variants
- plural
- organization-defined frequencies
- possessive
- organization-defined frequency's
- pluralpossessive
- organization-defined frequencies'