Ex1

Apply the vulnerability management plan's criteria for deciding whether to accept, transfer, mitigate, or avoid risk


Ex2

Apply the vulnerability management plan's criteria for selecting compensating controls to mitigate risk


Ex3

Track the progress of risk response implementation (e.g., plan of action and milestones [POA&M], risk register, risk detail report)


Ex4

Use risk assessment findings to inform risk response decisions and actions


Ex5

Communicate planned risk responses to affected stakeholders in priority order


Ex1

Implement and follow procedures for the formal documentation, review, testing, and approval of proposed changes and requested exceptions


Ex2

Document the possible risks of making or not making each proposed change, and provide guidance on rolling back changes


Ex3

Document the risks related to each requested exception and the plan for responding to those risks


Ex4

Periodically review risks that were accepted based upon planned future actions or milestones


Ex1

Conduct vulnerability information sharing between the organization and its suppliers following the rules and protocols defined in contracts


Ex2

Assign responsibilities and verify the execution of procedures for processing, analyzing the impact of, and responding to cybersecurity threat, vulnerability, or incident disclosures by suppliers, customers, partners, and government cybersecurity organizations


Ex1

Assess the authenticity and cybersecurity of critical technology products and services prior to acquisition and use


Ex1

Conduct supplier risk assessments against business and applicable cybersecurity requirements, including the supply chain


Ex1

Perform self-assessments of critical services that take current threats and TTPs into consideration


Ex2

Invest in third-party assessments or independent audits of the effectiveness of the organization's cybersecurity program to identify areas that need improvement


Ex3

Constantly evaluate compliance with selected cybersecurity requirements through automated means


Ex1

Identify improvements for future incident response activities based on findings from incident response assessments (e.g., tabletop exercises and simulations, tests, internal reviews, independent audits)


Ex2

Identify improvements for future business continuity, disaster recovery, and incident response activities based on exercises performed in coordination with critical service providers and product suppliers


Ex3

Involve internal stakeholders (e.g., senior executives, legal department, HR) in security tests and exercises as appropriate


Ex4

Perform penetration testing to identify opportunities to improve the security posture of selected high-risk systems as approved by leadership


Ex5

Exercise contingency plans for responding to and recovering from the discovery that products or services did not originate with the contracted supplier or partner or were altered before receipt


Ex6

Collect and analyze performance metrics using security tools and services to inform improvements to the cybersecurity program


Ex1

Conduct collaborative lessons learned sessions with suppliers


Ex2

Annually review cybersecurity policies, processes, and procedures to take lessons learned into account


Ex3

Use metrics to assess operational cybersecurity performance over time


Ex1

Establish contingency plans (e.g., incident response, business continuity, disaster recovery) for responding to and recovering from adverse events that can interfere with operations, expose confidential information, or otherwise endanger the organization's mission and viability


Ex2

Include contact and communication information, processes for handling common scenarios, and criteria for prioritization, escalation, and elevation in all contingency plans


Ex3

Create a vulnerability management plan to identify and assess all types of vulnerabilities and to prioritize, test, and implement risk responses


Ex4

Communicate cybersecurity plans (including updates) to those responsible for carrying them out and to affected parties


Ex5

Review and update all cybersecurity plans annually or when a need for significant improvements is identified


Ex1

Initiate requests for new access or additional access for employees, contractors, and others, and track, review, and fulfill the requests, with permission from system or data owners when needed


Ex2

Issue, manage, and revoke cryptographic certificates and identity tokens, cryptographic keys (i.e., key management), and other credentials


Ex3

Select a unique identifier for each device from immutable hardware characteristics or an identifier securely provisioned to the device


Ex4

Physically label authorized hardware with an identifier for inventory and servicing purposes


Ex1

Verify a person's claimed identity at enrollment time using government-issued identity credentials (e.g., passport, visa, driver's license)


Ex2

Issue a different credential for each person (i.e., no credential sharing)


Ex1

Require multifactor authentication


Ex2

Enforce policies for the minimum strength of passwords, PINs, and similar authenticators


Ex3

Periodically reauthenticate users, services, and hardware based on risk (e.g., in zero trust architectures)


Ex4

Ensure that authorized personnel can access accounts essential for protecting safety under emergency conditions


Ex1

Protect identity assertions that are used to convey authentication and user information through single sign-on systems


Ex2

Protect identity assertions that are used to convey authentication and user information between federated systems


Ex3

Implement standards-based approaches for identity assertions in all contexts, and follow all guidance for the generation (e.g., data models, metadata), protection (e.g., digital signing, encryption), and verification (e.g., signature validation) of identity assertions


Ex1

Review logical and physical access privileges periodically and whenever someone changes roles or leaves the organization, and promptly rescind privileges that are no longer needed


Ex2

Take attributes of the requester and the requested resource into account for authorization decisions (e.g., geolocation, day/time, requester endpoint's cyber health)


Ex3

Restrict access and privileges to the minimum necessary (e.g., zero trust architecture)


Ex4

Periodically review the privileges associated with critical business functions to confirm proper separation of duties


Ex1

Use security guards, security cameras, locked entrances, alarm systems, and other physical controls to monitor facilities and restrict access


Ex2

Employ additional physical security controls for areas that contain high-risk assets


Ex3

Escort guests, vendors, and other third parties within areas that contain business-critical assets


Ex1

Provide basic cybersecurity awareness and training to employees, contractors, partners, suppliers, and all other users of the organization's non-public resources


Ex2

Train personnel to recognize social engineering attempts and other common attacks, report attacks and suspicious activity, comply with acceptable use policies, and perform basic cyber hygiene tasks (e.g., patching software, choosing passwords, protecting credentials)


Ex3

Explain the consequences of cybersecurity policy violations, both to individual users and the organization as a whole


Ex4

Periodically assess or test users on their understanding of basic cybersecurity practices


Ex5

Require annual refreshers to reinforce existing practices and introduce new practices


Ex1

Identify the specialized roles within the organization that require additional cybersecurity training, such as physical and cybersecurity personnel, finance personnel, senior leadership, and anyone with access to business-critical data


Ex2

Provide role-based cybersecurity awareness and training to all those in specialized roles, including contractors, partners, suppliers, and other third parties


Ex3

Periodically assess or test users on their understanding of cybersecurity practices for their specialized roles


Ex4


Ex1

Use encryption, digital signatures, and cryptographic hashes to protect the confidentiality and integrity of stored data in files, databases, virtual machine disk images, container images, and other resources


Ex2

Use full disk encryption to protect data stored on user endpoints


Ex3

Confirm the integrity of software by validating signatures


Ex4

Restrict the use of removable media to prevent data exfiltration


Ex5

Physically secure removable media containing unencrypted sensitive information, such as within locked offices or file cabinets


Ex1

Use encryption, digital signatures, and cryptographic hashes to protect the confidentiality and integrity of network communications


Ex2

Automatically encrypt or block outbound emails and other communications that contain sensitive data, depending on the data classification


Ex3

Block access to personal email, file sharing, file storage services, and other personal communications applications and services from organizational systems and networks


Ex4

Prevent reuse of sensitive data from production environments (e.g., customer records) in development, testing, and other non-production environments


Ex1

Remove data that must remain confidential (e.g., from processors and memory) as soon as it is no longer needed


Ex2

Protect data in use from access by other users and processes of the same platform


Ex1

Continuously back up critical data in near-real-time, and back up other data frequently at agreed-upon schedules


Ex2

Test backups and restores for all types of data sources at least annually


Ex3

Securely store some backups offline and offsite so that an incident or disaster will not damage them


Ex4

Enforce geographic separation and geolocation restrictions for data backup storage


Ex1

Establish, test, deploy, and maintain hardened baselines that enforce the organization's cybersecurity policies and provide only essential capabilities (i.e., principle of least functionality)


Ex2

Review all default configuration settings that may potentially impact cybersecurity when installing or upgrading software


Ex3

Monitor implemented software for deviations from approved baselines


Ex1

Perform routine and emergency patching within the timeframes specified in the vulnerability management plan


Ex2

Update container images, and deploy new container instances to replace rather than update existing instances


Ex3

Replace end-of-life software and service versions with supported, maintained versions


Ex4

Uninstall and remove unauthorized software and services that pose undue risks


Ex5

Uninstall and remove any unnecessary software components (e.g., operating system utilities) that attackers might misuse


Ex6

Define and implement plans for software and service end-of-life maintenance support and obsolescence


Ex1

Replace hardware when it lacks needed security capabilities or when it cannot support software with needed security capabilities


Ex2

Define and implement plans for hardware end-of-life maintenance support and obsolescence


Ex3

Perform hardware disposal in a secure, responsible, and auditable manner


Ex1

Configure all operating systems, applications, and services (including cloud-based services) to generate log records


Ex2

Configure log generators to securely share their logs with the organization's logging infrastructure systems and services


Ex3

Configure log generators to record the data needed by zero-trust architectures


Ex1

When risk warrants it, restrict software execution to permitted products only or deny the execution of prohibited and unauthorized software


Ex2

Verify the source of new software and the software's integrity before installing it


Ex3

Configure platforms to use only approved DNS services that block access to known malicious domains


Ex4

Configure platforms to allow the installation of organization-approved software only


Ex1

Protect all components of organization-developed software from tampering and unauthorized access


Ex2

Secure all software produced by the organization, with minimal vulnerabilities in their releases


Ex3

Maintain the software used in production environments, and securely dispose of software once it is no longer needed


Ex1

Logically segment organization networks and cloud-based platforms according to trust boundaries and platform types (e.g., IT, IoT, OT, mobile, guests), and permit required communications only between segments


Ex2

Logically segment organization networks from external networks, and permit only necessary communications to enter the organization's networks from the external networks


Ex3

Implement zero trust architectures to restrict network access to each resource to the minimum necessary


Ex4

Check the cyber health of endpoints before allowing them to access and use production resources


Ex1

Protect organizational equipment from known environmental threats, such as flooding, fire, wind, and excessive heat and humidity


Ex2

Include protection from environmental threats and provisions for adequate operating infrastructure in requirements for service providers that operate systems on the organization's behalf


Ex1

Avoid single points of failure in systems and infrastructure


Ex2

Use load balancing to increase capacity and improve reliability


Ex3

Use high-availability components like redundant storage and power supplies to improve system reliability


Ex1

Monitor usage of storage, power, compute, network bandwidth, and other resources


Ex2

Forecast future needs, and scale resources accordingly


Ex1

Monitor DNS, BGP, and other network services for adverse events


Ex2

Monitor wired and wireless networks for connections from unauthorized endpoints


Ex3

Monitor facilities for unauthorized or rogue wireless networks


Ex4

Compare actual network flows against baselines to detect deviations


Ex5

Monitor network communications to identify changes in security postures for zero trust purposes


Ex1

Monitor logs from physical access control systems (e.g., badge readers) to find unusual access patterns (e.g., deviations from the norm) and failed access attempts


Ex2

Review and monitor physical access records (e.g., from visitor registration, sign-in sheets)


Ex3

Monitor physical access controls (e.g., locks, latches, hinge pins, alarms) for signs of tampering


Ex4

Monitor the physical environment using alarm systems, cameras, and security guards


Ex1

Use behavior analytics software to detect anomalous user activity to mitigate insider threats


Ex2

Monitor logs from logical access control systems to find unusual access patterns and failed access attempts


Ex3

Continuously monitor deception technology, including user accounts, for any usage


Ex1

Monitor remote and onsite administration and maintenance activities that external providers perform on organizational systems


Ex2

Monitor activity from cloud-based services, internet service providers, and other service providers for deviations from expected behavior


Ex1

Monitor email, web, file sharing, collaboration services, and other common attack vectors to detect malware, phishing, data leaks and exfiltration, and other adverse events


Ex2

Monitor authentication attempts to identify attacks against credentials and unauthorized credential reuse


Ex3

Monitor software configurations for deviations from security baselines


Ex4

Monitor hardware and software for signs of tampering


Ex5

Use technologies with a presence on endpoints to detect cyber health issues (e.g., missing patches, malware infections, unauthorized software), and redirect the endpoints to a remediation environment before access is authorized


Ex1

Use security information and event management (SIEM) or other tools to continuously monitor log events for known malicious and suspicious activity


Ex2

Utilize up-to-date cyber threat intelligence in log analysis tools to improve detection accuracy and characterize threat actors, their methods, and indicators of compromise


Ex3

Regularly conduct manual reviews of log events for technologies that cannot be sufficiently monitored through automation


Ex4

Use log analysis tools to generate reports on their findings


Ex1

Constantly transfer log data generated by other sources to a relatively small number of log servers


Ex2

Use event correlation technology (e.g., SIEM) to collect information captured by multiple sources


Ex3

Utilize cyber threat intelligence to help correlate events among log sources


Ex1

Use SIEMs or other tools to estimate impact and scope, and review and refine the estimates


Ex2

A person creates their own estimates of impact and scope


Ex1

Use cybersecurity software to generate alerts and provide them to the security operations center (SOC), incident responders, and incident response tools


Ex2

Incident responders and other authorized personnel can access log analysis findings at all times


Ex3

Automatically create and assign tickets in the organization's ticketing system when certain types of alerts occur


Ex4

Manually create and assign tickets in the organization's ticketing system when technical staff discover indicators of compromise


Ex1

Securely provide cyber threat intelligence feeds to detection technologies, processes, and personnel


Ex2

Securely provide information from asset inventories to detection technologies, processes, and personnel


Ex3

Rapidly acquire and analyze vulnerability disclosures for the organization's technologies from suppliers, vendors, and third-party security advisories


Ex1

Apply incident criteria to known and assumed characteristics of activity in order to determine whether an incident should be declared


Ex2

Take known false positives into account when applying incident criteria


Ex1

Detection technologies automatically report confirmed incidents


Ex2

Request incident response assistance from the organization's incident response outsourcer


Ex3

Designate an incident lead for each incident


Ex4

Initiate execution of additional cybersecurity plans as needed to support incident response (for example, business continuity and disaster recovery)


Ex1

Preliminarily review incident reports to confirm that they are cybersecurity-related and necessitate incident response activities


Ex2

Apply criteria to estimate the severity of an incident


Ex1

Further review and categorize incidents based on the type of incident (e.g., data breach, ransomware, DDoS, account compromise)


Ex2

Prioritize incidents based on their scope, likely impact, and time-critical nature


Ex3

Select incident response strategies for active incidents by balancing the need to quickly recover from an incident with the need to observe the attacker or conduct a more thorough investigation


Ex1

Track and validate the status of all ongoing incidents


Ex2

Coordinate incident escalation or elevation with designated internal and external stakeholders


Ex1

Apply incident recovery criteria to known and assumed characteristics of the incident to determine whether incident recovery processes should be initiated


Ex2

Take the possible operational disruption of incident recovery activities into account


Ex1

Determine the sequence of events that occurred during the incident and which assets and resources were involved in each event


Ex2

Attempt to determine what vulnerabilities, threats, and threat actors were directly or indirectly involved in the incident


Ex3

Analyze the incident to find the underlying, systemic root causes


Ex4

Check any cyber deception technology for additional information on attacker behavior


Ex1

Require each incident responder and others (e.g., system administrators, cybersecurity engineers) who perform incident response tasks to record their actions and make the record immutable


Ex2

Require the incident lead to document the incident in detail and be responsible for preserving the integrity of the documentation and the sources of all information being reported


Ex1

Collect, preserve, and safeguard the integrity of all pertinent incident data and metadata (e.g., data source, date/time of collection) based on evidence preservation and chain-of-custody procedures


Ex1

Review other potential targets of the incident to search for indicators of compromise and evidence of persistence


Ex2

Automatically run tools on targets to look for indicators of compromise and evidence of persistence


Ex1

Follow the organization's breach notification procedures after discovering a data breach incident, including notifying affected customers


Ex2

Notify business partners and customers of incidents in accordance with contractual requirements


Ex3

Notify law enforcement agencies and regulatory bodies of incidents based on criteria in the incident response plan and management approval


Ex1

Securely share information consistent with response plans and information sharing agreements


Ex2

Voluntarily share information about an attacker's observed TTPs, with all sensitive data removed, with an Information Sharing and Analysis Center (ISAC)


Ex3

Notify HR when malicious insider activity occurs


Ex4

Regularly update senior leadership on the status of major incidents


Ex5

Follow the rules and protocols defined in contracts for incident information sharing between the organization and its suppliers


Ex6

Coordinate crisis communication methods between the organization and its critical suppliers


Ex1

Cybersecurity technologies (e.g., antivirus software) and cybersecurity features of other technologies (e.g., operating systems, network infrastructure devices) automatically perform containment actions


Ex2

Allow incident responders to manually select and perform containment actions


Ex3

Allow a third party (e.g., internet service provider, managed security service provider) to perform containment actions on behalf of the organization


Ex4

Automatically transfer compromised endpoints to a remediation virtual local area network (VLAN)


Ex1

Cybersecurity technologies and cybersecurity features of other technologies (e.g., operating systems, network infrastructure devices) automatically perform eradication actions


Ex2

Allow incident responders to manually select and perform eradication actions


Ex3

Allow a third party (e.g., managed security service provider) to perform eradication actions on behalf of the organization


Ex1

Begin recovery procedures during or after incident response processes


Ex2

Make all individuals with recovery responsibilities aware of the plans for recovery and the authorizations required to implement each aspect of the plans


Ex1

Select recovery actions based on the criteria defined in the incident response plan and available resources


Ex2

Change planned recovery actions based on a reassessment of organizational needs and resources


Ex1

Check restoration assets for indicators of compromise, file corruption, and other integrity issues before use


Ex1

Use business impact and system categorization records (including service delivery objectives) to validate that essential services are restored in the appropriate order


Ex2

Work with system owners to confirm the successful restoration of systems and the return to normal operations


Ex3

Monitor the performance of restored systems to verify the adequacy of the restoration


Ex1

Check restored assets for indicators of compromise and remediation of root causes of the incident before production use


Ex2

Verify the correctness and adequacy of the restoration actions taken before putting a restored system online


Ex1

Prepare an after-action report that documents the incident itself, the response and recovery actions taken, and lessons learned


Ex2

Declare the end of incident recovery once the criteria are met


Ex1

Securely share recovery information, including restoration progress, consistent with response plans and information sharing agreements


Ex2

Regularly update senior leadership on recovery status and restoration progress for major incidents


Ex3

Follow the rules and protocols defined in contracts for incident information sharing between the organization and its suppliers


Ex4

Coordinate crisis communication between the organization and its critical suppliers


Ex1

Follow the organization's breach notification procedures for recovering from a data breach incident


Ex2

Explain the steps being taken to recover from the incident and to prevent a recurrence


The organizational mission is understood and informs cybersecurity risk management


Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered


Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed


Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated


Outcomes, capabilities, and services that the organization depends on are understood and communicated


Risk management objectives are established and agreed to by organizational stakeholders


Risk appetite and risk tolerance statements are established, communicated, and maintained


Cybersecurity risk management activities and outcomes are included in enterprise risk management processes


Strategic direction that describes appropriate risk response options is established and communicated


Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties


A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated


Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions


Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving


Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced


Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies


Cybersecurity is included in human resources practices


Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced


Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission


Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction


The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks


Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed


A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders


Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally


Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes


Suppliers are known and prioritized by criticality


Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties


Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships


The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship


Relevant suppliers and other third parties are included in incident planning, response, and recovery activities


Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle


Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement


Inventories of hardware managed by the organization are maintained


Inventories of software, services, and systems managed by the organization are maintained


Representations of the organization's authorized network communication and internal and external network data flows are maintained


Inventories of services provided by suppliers are maintained


Assets are prioritized based on classification, criticality, resources, and impact on the mission


Inventories of data and corresponding metadata for designated data types are maintained


Systems, hardware, software, services, and data are managed throughout their life cycles


Vulnerabilities in assets are identified, validated, and recorded


Cyber threat intelligence is received from information sharing forums and sources


Internal and external threats to the organization are identified and recorded


Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded


Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization


Risk responses are chosen, prioritized, planned, tracked, and communicated


Changes and exceptions are managed, assessed for risk impact, recorded, and tracked


Processes for receiving, analyzing, and responding to vulnerability disclosures are established


The authenticity and integrity of hardware and software are assessed prior to acquisition and use


Critical suppliers are assessed prior to acquisition


Improvements are identified from evaluations


Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties


Improvements are identified from execution of operational processes, procedures, and activities


Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved


Identities and credentials for authorized users, services, and hardware are managed by the organization


Identities are proofed and bound to credentials based on the context of interactions


Users, services, and hardware are authenticated


Identity assertions are protected, conveyed, and verified


Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties


Physical access to assets is managed, monitored, and enforced commensurate with risk


Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind


Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind


The confidentiality, integrity, and availability of data-at-rest are protected


The confidentiality, integrity, and availability of data-in-transit are protected


The confidentiality, integrity, and availability of data-in-use are protected


Backups of data are created, protected, maintained, and tested


Configuration management practices are established and applied


Software is maintained, replaced, and removed commensurate with risk


Hardware is maintained, replaced, and removed commensurate with risk


Log records are generated and made available for continuous monitoring


Installation and execution of unauthorized software are prevented


Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle


Networks and environments are protected from unauthorized logical access and usage


The organization's technology assets are protected from environmental threats


Mechanisms are implemented to achieve resilience requirements in normal and adverse situations


Adequate resource capacity to ensure availability is maintained


Networks and network services are monitored to find potentially adverse events


The physical environment is monitored to find potentially adverse events


Personnel activity and technology usage are monitored to find potentially adverse events


External service provider activities and services are monitored to find potentially adverse events


Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events


Potentially adverse events are analyzed to better understand associated activities


Information is correlated from multiple sources


The estimated impact and scope of adverse events are understood


Information on adverse events is provided to authorized staff and tools


Cyber threat intelligence and other contextual information are integrated into the analysis


Incidents are declared when adverse events meet the defined incident criteria


The incident response plan is executed in coordination with relevant third parties once an incident is declared


Incident reports are triaged and validated


Incidents are categorized and prioritized


Incidents are escalated or elevated as needed


The criteria for initiating incident recovery are applied


Analysis is performed to establish what has taken place during an incident and the root cause of the incident


Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved


Incident data and metadata are collected, and their integrity and provenance are preserved


An incident's magnitude is estimated and validated


Internal and external stakeholders are notified of incidents


Information is shared with designated internal and external stakeholders


Incidents are contained


Incidents are eradicated


The recovery portion of the incident response plan is executed once initiated from the incident response process


Recovery actions are selected, scoped, prioritized, and performed


The integrity of backups and other restoration assets is verified before using them for restoration


Critical mission functions and cybersecurity risk management are considered to establish post-incident operational norms


The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed


The end of incident recovery is declared based on criteria, and incident-related documentation is completed


Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders


Public updates on incident recovery are shared using approved methods and messaging


3rd

3rd Party Risk


1st

1st Party Risk


Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established


Incorporated into GV.RR-02, GV.SC-02


Incorporated into GV.OC


The organization’s role in the supply chain is identified and communicated


Incorporated into GV.OC-05


The organization’s place in critical infrastructure and its industry sector is identified and communicated


Incorporated into GV.OC-01


Priorities for organizational mission, objectives, and activities are established and communicated


Dependencies and critical functions for delivery of critical services are established


Incorporated into GV.OC-04, GV.OC-05


Resilience requirements to support delivery of critical services are established for all operating states (e.g. under duress/attack, during recovery, normal operations)


Incorporated into GV.OC-04


Incorporated into GV


Organizational cybersecurity policy is established and communicated


Incorporated into GV.PO, GV.PO-01, GV.PO-02


Cybersecurity roles and responsibilities are coordinated and aligned with internal roles and external partners


Incorporated into GV.OC-02, GV.RR, GV.RR-02


Legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations, are understood and managed


Moved to GV.OC-03


Governance and risk management processes address cybersecurity risks


Moved to GV.RM-04


Incorporated into GV.RM


Risk management processes are established, managed, and agreed to by organizational stakeholders


Incorporated into GV.RM-01, GV.RM-06, GV.RR-03


Organizational risk tolerance is determined and clearly expressed


Incorporated into GV.RM-02, GV.RM-04


The organization’s determination of risk tolerance is informed by its role in critical infrastructure and sector specific risk analysis


Moved into GV.RM-02


Incorporated into GV.SC


Cyber supply chain risk management processes are identified, established, assessed, managed, and agreed to by organizational stakeholders


Incorporated into GV.RM-05, GV.SC-01, GV.SC-06, GV.SC-09, GV.SC-10


Suppliers and third party partners of information systems, components, and services are identified, prioritized, and assessed using a cyber supply chain risk assessment process


Incorporated into GV.OC-02, GV.SC-03, GV.SC-04, GV.SC-07, ID.RA-10


Contracts with suppliers and third-party partners are used to implement appropriate measures designed to meet the objectives of an organization’s cybersecurity program and Cyber Supply Chain Risk Management Plan.


Moved to GV.SC-05


Suppliers and third-party partners are routinely assessed using audits, test results, or other forms of evaluations to confirm they are meeting their contractual obligations.


Incorporated into GV.SC-07, ID.RA-10


Response and recovery planning and testing are conducted with suppliers and third-party providers


Incorporated into GV.SC-08, ID.IM-02


Moved to PR.AA


Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users and processes


Incorporated into PR.AA-01, PR.AA-05


Physical access to assets is managed and protected


Moved to PR.AA-06


Remote access is managed


Incorporated into PR.AA-03, PR.AA-05, PR.IR-01


Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties


Moved to PR.AA-05


Network integrity is protected (e.g., network segregation, network segmentation)


Incorporated into PR.IR-01


Identities are proofed and bound to credentials and asserted in interactions


Moved to PR.AA-02


Users, devices, and other assets are authenticated (e.g., single-factor, multi-factor) commensurate with the risk of the transaction (e.g., individuals’ security and privacy risks and other organizational risks)


Moved to PR.AA-03


Third-party stakeholders (e.g., suppliers, customers, partners) understand their roles and responsibilities


Incorporated into PR.AT-01, PR.AT-02


Senior executives understand their roles and responsibilities


Incorporated into PR.AT-02


Physical and cybersecurity personnel understand their roles and responsibilities


Assets are formally managed throughout removal, transfers, and disposition


Incorporated into ID.AM-08, PR.PS-03


Adequate capacity to ensure availability is maintained


Moved to PR.IR-04


Protections against data leaks are implemented


Incorporated into PR.DS-01, PR.DS-02, PR.DS-10


Integrity checking mechanisms are used to verify software, firmware, and information integrity


Incorporated into PR.DS-01, DE.CM-09


The development and testing environment(s) are separate from the production environment


Incorporated into PR.IR-01


Integrity checking mechanisms are used to verify hardware integrity


Incorporated into ID.RA-09, DE.CM-09


Incorporated into other Categories and Functions


A baseline configuration of information technology/industrial control systems is created and maintained incorporating security principles (e.g. concept of least functionality)


Incorporated into PR.PS-01


A System Development Life Cycle to manage systems is implemented


Incorporated into ID.AM-08, PR.PS-06


Configuration change control processes are in place


Incorporated into PR.PS-01, ID.RA-07


Backups of information are conducted, maintained, and tested


Moved to PR.DS-11


Policy and regulations regarding the physical operating environment for organizational assets are met


Moved to PR.IR-02


Data is destroyed according to policy


Incorporated into ID.AM-08


Protection processes are improved


Incorporated into ID.IM, ID.IM-03


Effectiveness of protection technologies is shared


Moved to ID.IM-03


Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed


Moved to ID.IM-04


Response and recovery plans are tested


Incorporated into ID.IM-02, ID.IM-04


Cybersecurity is included in human resources practices (e.g., deprovisioning, personnel screening)


Moved to GV.RR-04


A vulnerability management plan is developed and implemented


Incorporated into ID.RA-01, PR.PS-02


Maintenance and repair of organizational assets are performed and logged, with approved and controlled tools


Incorporated into ID.AM-08, PR.PS-03


Remote maintenance of organizational assets is approved, logged, and performed in a manner that prevents unauthorized access


Incorporated into ID.AM-08, PR.PS-02


Incorporated into other Protect Categories


Audit/log records are determined, documented, implemented, and reviewed in accordance with policy


Incorporated into PR.PS-04


Removable media is protected and its use restricted according to policy


Incorporated into PR.DS-01, PR.PS-01


The principle of least functionality is incorporated by configuring systems to provide only essential capabilities


Incorporated into PR.PS-01


Communications and control networks are protected


Incorporated into PR.AA-06, PR.IR-01


Mechanisms (e.g., failsafe, load balancing, hot swap) are implemented to achieve resilience requirements in normal and adverse situations


Moved to PR.IR-03


Malicious code is detected


Incorporated into DE.CM-01, DE.CM-09


Unauthorized mobile code is detected


Monitoring for unauthorized personnel, connections, devices, and software is performed


Incorporated into DE.CM-01, DE.CM-03, DE.CM-06, DE.CM-09


Vulnerability scans are performed


Incorporated into ID.RA-01


A baseline of network operations and expected data flows for users and systems is established and managed


Incorporated into ID.AM-03


Incident alert thresholds are established


Moved to DE.AE-08


Incorporated into other Categories and Functions


Roles and responsibilities for detection are well defined to ensure accountability


Incorporated into GV.RR-02


Detection activities comply with all applicable requirements


Incorporated into DE.AE


Detection processes are tested


Incorporated into ID.IM-02


Event detection information is communicated


Incorporated into DE.AE-06


Detection processes are continuously improved


Incorporated into ID.IM, ID.IM-03


Incorporated into RS.MA


Response plan is executed during or after an incident


Incorporated into RS.MA-01


Notifications from detection systems are investigated


Incorporated into RS.MA-02


The impact of the incident is understood


Incorporated into RS.MA-02, RS.MA-03, RS.MA-04


Incidents are categorized consistent with response plans


Moved to RS.MA-03


Processes are established to receive, analyze and respond to vulnerabilities disclosed to the organization from internal and external sources (e.g. internal testing, security bulletins, or security researchers)


Moved to ID.RA-08


Personnel know their roles and order of operations when a response is needed


Incorporated into PR.AT-01


Coordination with stakeholders occurs consistent with response plans


Incorporated into RS.MA-01, RS.MA-04


Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness


Incorporated into RS.CO-03


Newly identified vulnerabilities are mitigated or documented as accepted risks


Incorporated into ID.RA-06


Incorporated into ID.IM


Response plans incorporate lessons learned


Incorporated into ID.IM-03, ID.IM-04


Response strategies are updated


Incorporated into ID.IM-03


Public relations are managed


Incorporated into RC.CO-04


Reputation is repaired after an incident


Recovery plans incorporate lessons learned


Recovery strategies are updated