organization-defined frequency

A structured placeholder — specifically an **assignment-operation control parameter** — embedded in a security or privacy control statement to mark the temporal cadence of a recurring activity as a value that each implementing organization must determine and document for itself during the control-tailoring process. It is formally defined in NIST SP 800-53 as "a control parameter that allows an organization to assign a specific, organization-defined value to the control or control enhancement," with frequency of testing cited as the canonical example of such an assignment. More broadly, NIST defines the class to which it belongs — the organization-defined control parameter — as "the variable part of a control or control enhancement that can be instantiated by an organization during the tailoring process by either assigning an organization-defined value or selecting a value from a pre-defined list." In practice, the expression functions as a deliberate blank in a control's text — appearing in brackets as `[Assignment: organization-defined frequency]` — which the implementing organization fills with a concrete interval (e.g., annually, quarterly, after each major change) that reflects its own risk management strategy, since the entity is expected to select a value appropriate for the organization.

Advisory only. A term this product ships is defined by an authority document, not by a search result.