Organizational mixer board – requirements model
OMB Requirement Catalog (ORC)
A requirements model helps the organization translate strategy and mission into clear expectations regarding structure, roles, working methods, competencies, and support. As part of the organizational mix board, the model enables the organization to describe what the business needs to function well, both today and in the next phase of development. The requirements can be used to analyze the current situation, identify gaps, and prioritize changes without losing the overall perspective. For a Chief of Staff, the working method creates a common basis for dialogue between management, managers, and teams. It becomes easier to distinguish between real needs, desired solutions, and temporary symptoms. The article shows how the requirements model can be built, used, and monitored, as well as how it is linked to the other controls in the organizational mix board. With clear requirements, the organization can make more consistent decisions, allocate resources better, and create an organization that is efficient, adaptable, and ready to deliver over time. The model supports collaborative learning, responsibility, and continuous improvement throughout the entire organization in a sustainable way.
OMB 1–10 Governance and corporate governance
OMB-ID Requirements Primary source Type Responsibility Security 1 Board responsibility Companies Act (2005:551) Chapter 8. Team Chairman of the Board A 2 CEO instruction Companies Act (2005:551) Chapter 8, Section 29 Team Board of Directors A 3 Rules of Procedure for the Board Companies Act (2005:551), Chapter 8, Section 46 Team Board of Directors A 4 Delegation arrangement Companies Act (2005:551), internal governance and control Team/Governance CEO B 5 Internal control COSO Internal Control Framework Standard/Governance CFO C 6 Risk management ISO 31000:2018 Risk Management Standard Management team C 7 Compliance function Swedish code for corporate governance, GRC practices Governance Compliance Officer C 8 Code of Conduct Swedish code for corporate governance Governance HR/Legal C 9 Whistle blowing system Act (2021:890) on the protection of persons who report misconduct Team Compliance/Legal A 10 Disagreements and conflicts of interest Companies Act (2005:551), Chapter 8, Swedish Code of Corporate Governance Team/Governance Board of Directors B
Comment on the level of security
Code Meaning A Direct statutory requirement or statutory obligation B Legal support combined with established practice C Standard, governance or accepted best practice D Organizational-specific requirements
OMB 11–20 Accounting and financial reporting
OMB 21–30 Tax and VAT
OMB 31–40 Labour Law
OMB-ID Requirements Primary source Type Responsibility Security 31 Employment protection Law (1982:80) on employment protection https://www.riksdagen.se/sv/dokument-lagar/dokument/svensk-forfattningssamling/lag-198280-om-anstallningsskydd_sfs-1982-80 Team HR A 32 Co-determination Act (1976:580) on employee participation Team HR A 33 Working hours Working hours law (1982:673) Team HR A 34 Vacation Holiday team (1977:480) Team HR A 35 Discrimination Anti-discrimination Act (2008:567) Team HR A 36 Parental leave Parental leave law (1995:584) Team HR A 37 Collective agreements Collective agreements Contracts HR A 38 Recruitment process Not verified Governance HR D 39 Competence development Not verified Governance HR D 40 Rehabilitation Labour law + Social Security Act Team HR B
OMB 41–50 Occupational safety and health
OMB-ID Requirements Primary source Type Responsibility Security 41 Systematic occupational health and safety work (SAM) Regulations of the Swedish Working Environment Authority AFS 2001:1 Regulations HR/HSE A 42 Risk assessment AFS 2001:1 Regulations HSE A 43 Safety representative Workplace safety law (1977:1160) Team HR A 44 Security patrols AFS 2001:1 Regulations HSE A 45 Ergonomics Regulations of the Swedish Working Environment Authority Regulations HSE B 46 Noise Regulations of the Swedish Working Environment Authority Regulations HSE B 47 Chemical workplace hazards Regulations of the Swedish Working Environment Authority Regulations HSE B 48 Organizational and social work environment (OSA) AFS 2015:4 Regulations HR A 49 Discriminatory special treatment AFS 2015:4 Regulations HR A 50 Accident reporting Workplace safety law (1977:1160) Team HSE A
OMB 51–60 Data protection and GDPR
OMB-ID Requirements Primary source Type Responsibility Security 51 GDPR compliance GDPR (EU 2016/679) https://eur-lex.europa.eu/eli/reg/2016/679/oj EU regulation DPO A 52 Register list GDPR Article 30 EU regulation DPO A 53 Legal basis GDPR Article 6 EU regulation DPO/Legal Department A 54 Registration extract GDPR Article 15 EU regulation DPO A 55 Right to deletion GDPR Article 17 EU regulation DPO A 56 Personal Data Processing Agreement GDPR Article 28 EU regulation Law A 57 Data protection officer GDPR Article 37 EU regulation DPO A 58 DPIA GDPR Article 35 EU regulation DPO A 59 Incident reporting GDPR Article 33 EU regulation DPO/CISO A 60 Third-country transfers GDPR Chapter V EU regulation DPO A
Important uncertainty marker
This OMB catalog is still:
A = High security : verified against the law/regulation.
B = Reasonably verified : rule/regulation but simplified mapping.
C = Standard/Governance .
D = Not verified or organization-specific .
The following groups will be evaluated according to the following principle:
Legal requirements = law, EU regulation, regulatory order or other normative requirement.
Standard/governance requirements ISO, COSO, COBIT, NIST, GRC practice or any other established governance principle.
Not verified = where no clear primary source can be directly linked to the requirement.
OMB 61–70 Occupational safety and health
OMB-ID Requirements Primary source Type Responsibility Security 61 Ergonomics The Working Environment Act (1977:1160), the regulations of the Working Environment Agency Legal requirements HSE/HR A 62 Load-bearing ergonomics Regulations of the Swedish Working Environment Authority Legal requirements HSE A 63 Bull exposure Regulations of the Swedish Working Environment Authority Legal requirements HSE A 64 Chemical workplace hazards Regulations of the Swedish Working Environment Authority Legal requirements HSE A 65 Protective equipment The Swedish Work Environment Authority Legal requirements HSE A 66 Collaboration The Swedish Work Environment Authority Legal requirements HSE B 67 Security training Labour law Legal requirements HSE B 68 Crisis support after an accident The Swedish Work Environment Authority Legal requirements HR B 69 First aid Regulations of the Swedish Working Environment Authority Legal requirements HSE A 70 Corporate health care Workplace regulations Legal requirements HR B
OMB 71–80 Data protection
OMB-ID Requirements Primary source Type Responsibility Security 71 Consent management GDPR Legal requirements DPO A 72 Data processing agent GDPR Article 28 Legal requirements Law A 73 Registration extract GDPR Article 15 Legal requirements DPO A 74 Data portability GDPR Article 20 Legal requirements DPO A 75 Correction of data GDPR Article 16 Legal requirements DPO A 76 Deletion GDPR Article 17 Legal requirements DPO A 77 Data minimization GDPR Article 5 Legal requirements DPO A 78 Privacy by Design GDPR Article 25 Legal requirements DPO/CIO A 79 DPIA GDPR Article 35 Legal requirements DPO A 80 Data protection officer GDPR Article 37 Legal requirements DPO A
OMB 81–90 Information security
OMB-ID Requirements Primary source Type Responsibility Security 81 Information classification ISO 27001 Standard/governance requirements CISO C 82 Authority control ISO 27001 Standard/governance requirements CISO C 83 Identity & Access Management ISO 27001 Standard/governance requirements CISO C 84 Log management ISO 27001 / NIS2 Standard/legal depending on sector CISO B 85 Encryption ISO 27001 Standard/governance requirements CISO C 86 Backup ISO 27001 Standard/governance requirements CIO C 87 Multifactor authentication NIS2 recommended practice Standard/governance requirements CISO C 88 Security incidents NIS2 / ISO 27035 Legal requirements in extensive operations CISO B 89 Vulnerability scanning ISO 27001 Standard/governance requirements CISO C 90 Penetration test ISO 27001/NIST Standard/governance requirements CISO C
OMB 91–100 Information security continues.
OMB-ID Requirements Primary source Type Responsibility Security 91 Supplier security ISO 27001 Annex A Standard/governance requirements Purchasing/CISO C 92 Cloud security ISO 27017 Standard/governance requirements CIO C 93 Security architecture TOGAF / ISO 27001 Standard/governance requirements CIO D 94 Hot analysis NIST CSF Standard/governance requirements CISO C 95 Security training ISO 27001 Standard/governance requirements HR/CISO C 96 Continuity IT ISO 22301 Standard/governance requirements CIO C 97 Disaster Recovery ISO 22301 Standard/governance requirements CIO C 98 Security Operations NIST CSF Standard/governance requirements CISO D 99 Threat Intelligence NIST Standard/governance requirements CISO D 100 AI security EU AI Act (under implementation) Legal requirements are under development CIO/CISO B
OMB 101–110 Contracts and Law
OMB-ID Requirements Primary source Type Responsibility Security 101 Contract archive The Contracts Act (1915:218) Legal requirements/practice Law B 102 Contract follow-up Not verified Governance requirements Law D 103 Customer agreements The Contracts Act Legal requirements Law A 104 Supplier agreements The Contracts Act Legal requirements Purchasing/Legal A 105 NDA The Contracts Act Legal requirements Law A 106 Power of Attorney The Contracts Act Legal requirements Law A 107 Warranty conditions The Buying Act Legal requirements Law A 108 Limitation of liability Contract law Legal requirements Law B 109 Dispute resolution The Code of Judicial Procedure/Contracts Legal requirements Law A 110 Legal Watch Not verified Governance requirements Chief Legal Officer D
OMB 111–120 Business ethics
OMB-ID Requirements Primary source Type Responsibility Security 111 Anti-corruption program Criminal Code Legal requirements Compliance A 112 Mutor Criminal Code Chapter 10 Legal requirements Compliance A 113 Representation Skatteverket + BrB Legal requirements Compliance/CFO B 114 Gifts Criminal Code Legal requirements Compliance B 115 Conflicts of interest Code for corporate governance Governance requirements Board of Directors C 116 Agent management OECD/GRC Governance requirements Compliance C 117 Sponsorship Governance Compliance D 118 Donations Governance Compliance D 119 Third-party due diligence ISO 37301 Standard requirements Compliance C 120 Whistleblowing Act (2021:890) Legal requirements Compliance A
OMB 121–130 ESG, sustainability and the environment
OMB-ID Requirements Primary source Type Responsibility Security 121 CSRD reporting EU Directive 2022/2464 (CSRD) https://eur-lex.europa.eu Legal requirements CFO / ESG Manager A 122 ESRS European Sustainability Reporting Standards https://www.efrag.org Legal requirements CFO / ESG Manager A 123 Climate reporting CSRD/ESRS Legal requirements ESG Chief A 124 Scope 1 emissions GHG Protocol https://ghgprotocol.org Standard/governance requirements ESG Chief B 125 Scope 2 emissions GHG Protocol Standard/governance requirements ESG Chief B 126 Scope 3 emissions GHG Protocol Standard/governance requirements ESG Chief B 127 Environmental policy ISO 14001 https://www.iso.org Standard/governance requirements Sustainability Manager C 128 Waste management Environmental Act (1998:808) https://www.riksdagen.se Legal requirements Operations Manager A 129 Chemical management REACH regulation https://eur-lex.europa.eu Legal requirements HSE A 130 Energy mapping Act (2014:266) on energy mapping in large companies https://www.riksdagen.se Legal requirements (affected companies) Property manager A
OMB 131–140 ESG continuation
OMB-ID Requirements Primary source Type Responsibility Security 131 Supplier audit ESG CSRD/CSDDD Legal requirements are under development Purchasing Manager B 132 Human rights OECD Guidelines https://www.oecd.org Standard/governance requirements ESG Chief C 133 Child labor in the supplier chain OECD/ILO conventions Standard/governance requirements Purchasing Manager C 134 Water use ISO 14001 Standard/governance requirements Operations Manager C 135 Biological diversity ESRS E4 Legal requirements for reporting obligations ESG Chief B 136 Sustainable financing SFDR regulation https://eur-lex.europa.eu Legal requirements for financial actors CFO B 137 EU taxonomy EU Taxonomy Regulation https://eur-lex.europa.eu Legal requirements CFO / ESG A 138 Climate analysis TCFD/ESRS Standard/governance requirements Risk manager C 139 ESG follow-up ESRS Legal requirements (reporting companies) ESG Chief B 140 Sustainability management Requires verification Governance requirements Management team D
OMB 141–150 Quality management
OMB-ID Requirements Primary source Type Responsibility Security 141 Quality policy ISO 9001 https://www.iso.org Standard/governance requirements Quality manager C 142 Quality goals ISO 9001 Standard/governance requirements Quality manager C 143 Process mapping ISO 9001 Standard/governance requirements COO C 144 Process ownership ISO 9001 Standard/governance requirements COO C 145 Deviation management ISO 9001 Standard/governance requirements Quality manager C 146 Rotary drill analysis ISO 9001 Standard/governance requirements Quality manager C 147 Improvement management ISO 9001 Standard/governance requirements COO C 148 Customer complaints ISO 9001 Standard/governance requirements Customer Service Manager C 149 Delivery quality ISO 9001 Standard/governance requirements COO C 150 Internal audit quality ISO 19011 https://www.iso.org Standard/governance requirements Internal audit C
OMB 151–160 Operational management
OMB-ID Requirements Primary source Type Responsibility Security 151 Management review ISO 9001 Standard/governance requirements CEO C 152 KPI management Requires verification Governance requirements COO D 153 Competency management ISO 9001 Standard/governance requirements Human Resources Manager C 154 Certification management ISO standards Standard/governance requirements Quality manager C 155 Continuous improvement (PDCA) ISO 9001 Standard/governance requirements COO C 156 Change management ITIL / ISO 9001 Standard/governance requirements CIO C 157 Configuration management ITIL Standard/governance requirements CIO C 158 Release management ITIL Standard/governance requirements CIO C 159 Document management ISO 9001 Standard/governance requirements Quality manager C 160 Version management Requires verification Governance requirements CIO D
OMB 161–170 Strategy and business development
OMB-ID Requirements Primary source Type Responsibility Security 161 Process follow-up ISO 9001 Standard/governance requirements COO C 162 Service quality ISO 9001 Standard/governance requirements COO C 163 Lean Management Requires verification Governance requirements COO D 164 Six Sigma Requires verification Governance requirements COO D 165 Business architecture TOGAF (not a public standard) Standard/governance requirements CIO D 166 Goal management Requires verification Governance requirements Management team D 167 Strategy monitoring Requires verification Governance requirements CEO D 168 Balanced Scorecard Requires verification Governance requirements CFO D 169 Capacity planning Requires verification Governance requirements COO D 170 Performance management Requires verification Governance requirements Management team D
OMB 171–180 Supplier management and purchasing
OMB-ID Requirements Primary source Type Responsibility Security 171 Purchasing policy Requires verification Governance requirements Purchasing Manager D 172 Supplier approval ISO 9001 Standard/governance requirements Purchasing Manager C 173 Supplier evaluation ISO 9001 Standard/governance requirements Purchasing Manager C 174 Supplier risk analysis ISO 31000 https://www.iso.org Standard/governance requirements Risk manager C 175 Single Source Risk Requires verification Governance requirements Purchasing Manager D 176 Outsourcing management Requires verification Governance requirements CIO / Purchasing D 177 SLA control Requires verification Governance requirements Delivery Manager D 178 Supplier audit ISO 9001 Standard/governance requirements Purchasing Manager C 179 Stockpile readiness Requires verification Governance requirements Supply Chain D 180 Geopolitical risk analysis Requires verification Governance requirements Risk manager D
OMB 181–190 Physical security
OMB-ID Requirements Primary source Type Responsibility Security 181 Systematic fire protection work (SBA) Act (2003:778) on protection against accidents https://www.riksdagen.se Legal requirements Security Manager A 182 Evacuation plans Act (2003:778) on protection against accidents Legal requirements Security Manager A 183 Fire drills LSO/MSB guidance https://www.msb.se Legal requirements/practice Security Manager B 184 Pass system Requires verification Governance requirements Security Manager D 185 Physical entitlement management Requires verification Governance requirements Security Manager D 186 Visitor management Requires verification Governance requirements Security Manager D 187 Burglar alarm Requires verification Governance requirements Security Manager D 188 Rock protection Requires verification Governance requirements Security Manager D 189 Property maintenance Planning and Construction Act (2010:900) https://www.riksdagen.se Legal requirements Property manager B 190 Critical infrastructure Security Protection Act (2018:585) https://www.riksdagen.se Legal requirements for the affected businesses Security Manager B
OMB 191–200 Continuity and resilience
OMB-ID Requirements Primary source Type Responsibility Security 191 Continuity plan ISO 22301 Standard/governance requirements COO C 192 Disaster Recovery ISO 22301 Standard/governance requirements CIO C 193 Crisis management organization MSB guidelines Governance requirements CEO C 194 Crisis communication MSB guidelines Governance requirements Communications Manager C 195 Incident management ISO 22301 Standard requirements COO C 196 Surveillance of the external environment Governance requirements Management team D 197 Resilience analysis ISO 22301 Standard requirements Risk Manager C 198 Scenario planning ISO 31000 / Governance Governance requirements Management C 199 Critical dependencies ISO 22301 Standard requirements COO C 200 Riskaptit COSO ERM / ISO 31000 Governance requirements Board of Directors C
OMB 191–200 Continuity and resilience
OMB-ID Requirements Primary source Type Responsibility Security 191 Continuity plan ISO 22301 Standard/governance requirements COO C 192 Disaster Recovery ISO 22301 Standard/governance requirements CIO C 193 Crisis management organization MSB guidelines Governance requirements CEO C 194 Crisis communication MSB guidelines Governance requirements Communications Manager C 195 Incident management ISO 22301 Standard requirements COO C 196 Surveillance of the external environment Governance requirements Management team D 197 Resilience analysis ISO 22301 Standard requirements Risk Manager C 198 Scenario planning ISO 31000 / Governance Governance requirements Management C 199 Critical dependencies ISO 22301 Standard requirements COO C 200 Riskaptit COSO ERM / ISO 31000 Governance requirements Board of Directors C
Important final note
The OMB catalog should be seen as a Preliminary reference model . Approximately:
35–40 % of the lines are clear legal requirements.
20–30 % are regulatory or prescriptive requirements.
30–40 % is the standard, governance or best-practice requirement.
Go to the summary page->
Read more about the requirements model->
Rolf Olsson is one of the founders of
Chief of Staff Platform and specialist in business transformation, strategy implementation, and management support. Rolf has worked more than 40,000 hours as a consultant and writes about how the Chief of Staff role, modern governance, AI, and change management can help organizations increase their execution capabilities and create sustainable business results. Rolf has a degree in civil engineering, a master's degree in IT Management, and a PhD in Computer Science. Comments or remarks on this article can be emailed to: glossary@chiefofstaff.se