org.cispec.organization

core key required: any CI

org.cispec.organization records which organisation owns a Change Item — the entity accountable for it. This is distinct from org.cispec.owner, which records a specific person or role within that organisation. organization answers “which company or agency?”; owner answers “who specifically within it?”

organization and orgunit are two separate keys because the owning organisation and the unit within it are two separate facts — knowing that an asset belongs to daplanet doesn’t tell you whether it belongs to the security team or the finance team, and vice versa.

Value format

A lower-case slug: alphanumeric characters and hyphens only, no leading or trailing hyphen.

org.cispec.organization=daplanet

The slug should be stable for the lifetime of the organisation it identifies. A rename, merger, or acquisition that changes the organisation’s legal identity is a breaking change for any system consuming these labels — update the slug and treat it as a MAJOR semver event for any label namespace versioned against this one.

Conformance

org.cispec.organization is REQUIRED for Declared conformance on any Change Item, regardless of type.

Attestation

organization is a self-asserted identifier — this specification does not require it to resolve to a registry, a DNS zone, or a certificate. Where independent verification of organisational identity matters (federal contracting, regulated audit), pair organization with org.cispec.duns (verifiable against the D&B registry) or org.cispec.oid (verifiable against the IANA Private Enterprise Number registry).

Resolution and relation

Every Change Item sharing the same organization value forms an edge across your label set — “everything daplanet owns” is a real operational query. How you run that query against your own systems is up to you.

Document identifier

OID: 1.3.6.1.4.1.42387.2.1
GUID: 8ef717a5-d8c0-512d-8cc5-9d62cea811ca