organization-defined frequency
163571·updated Sep 1, 2026An *organization-defined frequency* is an instance of an **organization-defined control parameter** — the variable part of a security or privacy control that an organization fills in during the tailoring process by assigning a concrete value. As a frequency parameter specifically, it is a placeholder in a control statement that requires the implementing organization to decide *how often* a required activity — such as a review, update, assessment, or report — must recur, calibrating the cadence to the organization's own risk environment, mission, and operational tempo rather than prescribing a universal interval. The rationale is that circumstances such as organizational missions, business functions, environments of operation, technologies, or threat change over time, making periodic repetition of certain activities necessary and the appropriate interval something each organization must judge for itself. In practice, it appears throughout NIST control catalogs as an *Assignment* notation — e.g., `[Assignment: organization-defined frequency]` — wherever a control mandates a recurring action and leaves the interval open for the organization to specify, with implementers then documenti
Source
Review the privileges assigned to roles or classes of users [ Assignment: organization-defined frequency ] to validate the need for such privileges.the sentence this term was read in
generalized from a web lookup of the quoted expression at proposal time Verdict: term of art.
- assignment operation - Glossary | CSRC
- organization defined control parameter
- PS006 2019 Announcement MinimumSecurity 2019 1204
A definition generalized from search results is a draft to react to, not provenance. Confirm it against an authority document before this term is verified.
A web lookup ran when this term was proposed
A structured placeholder — specifically an **assignment-operation control parameter** — embedded in a security or privacy control statement to mark the temporal cadence of a recurring activity as a value that each implementing organization must determine and document for itself during the control-tailoring process. It is formally defined in NIST SP 800-53 as "a control parameter that allows an organization to assign a specific, organization-defined value to the control or control enhancement," with frequency of testing cited as the canonical example of such an assignment. More broadly, NIST defines the class to which it belongs — the organization-defined control parameter — as "the variable part of a control or control enhancement that can be instantiated by an organization during the tailoring process by either assigning an organization-defined value or selecting a value from a pre-defined list." In practice, the expression functions as a deliberate blank in a control's text — appearing in brackets as `[Assignment: organization-defined frequency]` — which the implementing organization fills with a concrete interval (e.g., annually, quarterly, after each major change) that reflects its own risk management strategy, since the entity is expected to select a value appropriate for the organization.
Advisory only. A term this product ships is defined by an authority document, not by a search result.
Proposed during multiword review of this document in the CKI mapping queue.
Attested in
Classifications
Entity Type
Sensitivity
Information Class
Variants
- plural
- organization-defined frequencies
- possessive
- organization-defined frequency's
- pluralpossessive
- organization-defined frequencies'
Framework definitions
- §1 · attested_usage_reviewer_confirmed
- No definition is given in NIST SP 800-171r3. The term is attested in use at 24 citations in that document; a definition is pending curation.Increment 2: attested in 800-171r3 without a glossary definition.
- §1 · web_lookup_draft
- An *organization-defined frequency* is an instance of an **organization-defined control parameter** — the variable part of a security or privacy control that an organization fills in during the tailoring process by assigning a concrete value. As a frequency parameter specifically, it is a placeholder in a control statement that requires the implementing organization to decide *how often* a required activity — such as a review, update, assessment, or report — must recur, calibrating the cadence to the organization's own risk environment, mission, and operational tempo rather than prescribing a universal interval. The rationale is that circumstances such as organizational missions, business functions, environments of operation, technologies, or threat change over time, making periodic repetition of certain activities necessary and the appropriate interval something each organization must judge for itself. In practice, it appears throughout NIST control catalogs as an *Assignment* notation — e.g., `[Assignment: organization-defined frequency]` — wherever a control mandates a recurring action and leaves the interval open for the organization to specify, with implementers then documentiDR-088 backfill from the noun definition column
- §1 · web_lookup_draft
- A structured placeholder — specifically an **assignment-operation control parameter** — embedded in a security or privacy control statement to mark the temporal cadence of a recurring activity as a value that each implementing organization must determine and document for itself during the control-tailoring process. It is formally defined in NIST SP 800-53 as "a control parameter that allows an organization to assign a specific, organization-defined value to the control or control enhancement," with frequency of testing cited as the canonical example of such an assignment. More broadly, NIST defines the class to which it belongs — the organization-defined control parameter — as "the variable part of a control or control enhancement that can be instantiated by an organization during the tailoring process by either assigning an organization-defined value or selecting a value from a pre-defined list." In practice, the expression functions as a deliberate blank in a control's text — appearing in brackets as `[Assignment: organization-defined frequency]` — which the implementing organization fills with a concrete interval (e.g., annually, quarterly, after each major change) that reflects its own risk management strategy, since the entity is expected to select a value appropriate for the organization.Drafted by the propose-term web lookup (PD-018); a curator confirms or replaces it.