The organization's cybersecurity risk management strategy, expectations, and policy are established, communicated, and monitored

GOVERN


The circumstances - mission, stakeholder expectations, dependencies, and legal, regulatory, and contractual requirements - surrounding the organization's cybersecurity risk management decisions are understood

Organizational Context


The organizational mission is understood and informs cybersecurity risk management


1st Party Risk

1st


Share the organization's mission (e.g., through vision and mission statements, marketing, and service strategies) to provide a basis for identifying risks that may impede that mission

Ex1


Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered


3rd Party Risk

3rd


Identify relevant internal stakeholders and their cybersecurity-related expectations (e.g., performance and risk expectations of officers, directors, and advisors; cultural expectations of employees)

Ex1


Identify relevant external stakeholders and their cybersecurity-related expectations (e.g., privacy expectations of customers, business expectations of partnerships, compliance expectations of regulators, ethics expectations of society)

Ex2


Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed


Determine a process to track and manage legal and regulatory requirements regarding protection of individuals' information (e.g., Health Insurance Portability and Accountability Act, California Consumer Privacy Act, General Data Protection Regulation)

Ex1


Determine a process to track and manage contractual requirements for cybersecurity management of supplier, customer, and partner information

Ex2


Align the organization's cybersecurity strategy with legal, regulatory, and contractual requirements

Ex3


Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated


Establish criteria for determining the criticality of capabilities and services as viewed by internal and external stakeholders

Ex1


Determine (e.g., from a business impact analysis) assets and business operations that are vital to achieving mission objectives and the potential impact of a loss (or partial loss) of such operations

Ex2


Establish and communicate resilience objectives (e.g., recovery time objectives) for delivering critical capabilities and services in various operating states (e.g., under attack, during recovery, normal operation)

Ex3


Outcomes, capabilities, and services that the organization depends on are understood and communicated


Create an inventory of the organization's dependencies on external resources (e.g., facilities, cloud-based hosting providers) and their relationships to organizational assets and business functions

Ex1


Identify and document external dependencies that are potential points of failure for the organization's critical capabilities and services, and share that information with appropriate personnel

Ex2


The organization's priorities, constraints, risk tolerance and appetite statements, and assumptions are established, communicated, and used to support operational risk decisions

Risk Management Strategy


Risk management objectives are established and agreed to by organizational stakeholders


1st Party Risk

1st


Update near-term and long-term cybersecurity risk management objectives as part of annual strategic planning and when major changes occur

Ex1


Establish measurable objectives for cybersecurity risk management (e.g., manage the quality of user training, ensure adequate risk protection for industrial control systems)

Ex2


Senior leaders agree about cybersecurity objectives and use them for measuring and managing risk and performance

Ex3


Risk appetite and risk tolerance statements are established, communicated, and maintained


3rd Party Risk

3rd


Determine and communicate risk appetite statements that convey expectations about the appropriate level of risk for the organization

Ex1


Translate risk appetite statements into specific, measurable, and broadly understandable risk tolerance statements

Ex2


Refine organizational objectives and risk appetite periodically based on known risk exposure and residual risk

Ex3


Cybersecurity risk management activities and outcomes are included in enterprise risk management processes


Aggregate and manage cybersecurity risks alongside other enterprise risks (e.g., compliance, financial, operational, regulatory, reputational, safety)

Ex1


Include cybersecurity risk managers in enterprise risk management planning

Ex2


Establish criteria for escalating cybersecurity risks within enterprise risk management

Ex3


Strategic direction that describes appropriate risk response options is established and communicated


Specify criteria for accepting and avoiding cybersecurity risk for various classifications of data

Ex1


Determine whether to purchase cybersecurity insurance

Ex2


Document conditions under which shared responsibility models are acceptable (e.g., outsourcing certain cybersecurity functions, having a third party perform financial transactions on behalf of the organization, using public cloud-based services)

Ex3


Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties


1st Party Risk

1st


Determine how to update senior executives, directors, and management on the organization's cybersecurity posture at agreed-upon intervals

Ex1


Identify how all departments across the organization - such as management, operations, internal auditors, legal, acquisition, physical security, and HR - will communicate with each other about cybersecurity risks

Ex2


A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated


Establish criteria for using a quantitative approach to cybersecurity risk analysis, and specify probability and exposure formulas

Ex1


Create and use templates (e.g., a risk register) to document cybersecurity risk information (e.g., risk description, exposure, treatment, and ownership)

Ex2


Establish criteria for risk prioritization at the appropriate levels within the enterprise

Ex3


Use a consistent list of risk categories to support integrating, aggregating, and comparing cybersecurity risks

Ex4


Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions


Define and communicate guidance and methods for identifying opportunities and including them in risk discussions (e.g., strengths, weaknesses, opportunities, and threats [SWOT] analysis)

Ex1


Identify stretch goals and document them

Ex2


Calculate, document, and prioritize positive risks alongside negative risks

Ex3


Cybersecurity roles, responsibilities, and authorities to foster accountability, performance assessment, and continuous improvement are established and communicated

Roles, Responsibilities, and Authorities


Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving


Leaders (e.g., directors) agree on their roles and responsibilities in developing, implementing, and assessing the organization's cybersecurity strategy

Ex1


Share leaders' expectations regarding a secure and ethical culture, especially when current events present the opportunity to highlight positive or negative examples of cybersecurity risk management

Ex2


Leaders direct the CISO to maintain a comprehensive cybersecurity risk strategy and review and update it at least annually and after major events

Ex3


Conduct reviews to ensure adequate authority and coordination among those responsible for managing cybersecurity risk

Ex4


Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced


1st Party Risk

1st


Document risk management roles and responsibilities in policy

Ex1


Document who is responsible and accountable for cybersecurity risk management activities and how those teams and individuals are to be consulted and informed

Ex2


Include cybersecurity responsibilities and performance requirements in personnel descriptions

Ex3


Document performance goals for personnel with cybersecurity risk management responsibilities, and periodically measure performance to identify areas for improvement

Ex4


Clearly articulate cybersecurity responsibilities within operations, risk functions, and internal audit functions

Ex5


Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies


3rd Party Risk

3rd


Conduct periodic management reviews to ensure that those given cybersecurity risk management responsibilities have the necessary authority

Ex1


Identify resource allocation and investment in line with risk tolerance and response

Ex2


Provide adequate and sufficient people, process, and technical resources to support the cybersecurity strategy

Ex3


Cybersecurity is included in human resources practices


Integrate cybersecurity risk management considerations into human resources processes (e.g., personnel screening, onboarding, change notification, offboarding)

Ex1


Consider cybersecurity knowledge to be a positive factor in hiring, training, and retention decisions

Ex2


Conduct background checks prior to onboarding new personnel for sensitive roles, and periodically repeat background checks for personnel with such roles

Ex3


Define and enforce obligations for personnel to be aware of, adhere to, and uphold security policies as they relate to their roles

Ex4


Organizational cybersecurity policy is established, communicated, and enforced

Policy


Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced


1st Party Risk

1st


Create, disseminate, and maintain an understandable, usable risk management policy with statements of management intent, expectations, and direction

Ex1


Periodically review policy and supporting processes and procedures to ensure that they align with risk management strategy objectives and priorities, as well as the high-level direction of the cybersecurity policy

Ex2


Require approval from senior management on policy

Ex3


Communicate cybersecurity risk management policy and supporting processes and procedures across the organization

Ex4


Require personnel to acknowledge receipt of policy when first hired, annually, and whenever policy is updated

Ex5


Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission


Update policy based on periodic reviews of cybersecurity risk management results to ensure that policy and supporting processes and procedures adequately maintain risk at an acceptable level

Ex1


Provide a timeline for reviewing changes to the organization's risk environment (e.g., changes in risk or in the organization's mission objectives), and communicate recommended policy updates

Ex2


Update policy to reflect changes in legal and regulatory requirements

Ex3


Update policy to reflect changes in technology (e.g., adoption of artificial intelligence) and changes to the business (e.g., acquisition of a new business, new contract requirements)

Ex4


Results of organization-wide cybersecurity risk management activities and performance are used to inform, improve, and adjust the risk management strategy

Oversight


Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction


Measure how well the risk management strategy and risk results have helped leaders make decisions and achieve organizational objectives

Ex1


Examine whether cybersecurity risk strategies that impede operations or innovation should be adjusted

Ex2


The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks


Review audit findings to confirm whether the existing cybersecurity strategy has ensured compliance with internal and external requirements

Ex1


Review the performance oversight of those in cybersecurity-related roles to determine whether policy changes are necessary

Ex2


Review strategy in light of cybersecurity incidents

Ex3


Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed


1st Party Risk

1st


Review key performance indicators (KPIs) to ensure that organization-wide policies and procedures achieve objectives

Ex1


Review key risk indicators (KRIs) to identify risks the organization faces, including likelihood and potential impact

Ex2


Collect and communicate metrics on cybersecurity risk management with senior leadership

Ex3


Cyber supply chain risk management processes are identified, established, managed, monitored, and improved by organizational stakeholders

Cybersecurity Supply Chain Risk Management


A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders


Establish a strategy that expresses the objectives of the cybersecurity supply chain risk management program

Ex1


Develop the cybersecurity supply chain risk management program, including a plan (with milestones), policies, and procedures that guide implementation and improvement of the program, and share the policies and procedures with the organizational stakeholders

Ex2


Develop and implement program processes based on the strategy, objectives, policies, and procedures that are agreed upon and performed by the organizational stakeholders

Ex3


Establish a cross-organizational mechanism that ensures alignment between functions that contribute to cybersecurity supply chain risk management, such as cybersecurity, IT, operations, legal, human resources, and engineering

Ex4


3rd Party Risk

3rd


Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally


Identify one or more specific roles or positions that will be responsible and accountable for planning, resourcing, and executing cybersecurity supply chain risk management activities

Ex1


Document cybersecurity supply chain risk management roles and responsibilities in policy

Ex2


Create responsibility matrixes to document who will be responsible and accountable for cybersecurity supply chain risk management activities and how those teams and individuals will be consulted and informed

Ex3


Include cybersecurity supply chain risk management responsibilities and performance requirements in personnel descriptions to ensure clarity and improve accountability

Ex4


Document performance goals for personnel with cybersecurity risk management-specific responsibilities, and periodically measure them to demonstrate and improve performance

Ex5


Develop roles and responsibilities for suppliers, customers, and business partners to address shared responsibilities for applicable cybersecurity risks, and integrate them into organizational policies and applicable third-party agreements

Ex6


Internally communicate cybersecurity supply chain risk management roles and responsibilities for third parties

Ex7


Establish rules and protocols for information sharing and reporting processes between the organization and its suppliers

Ex8


Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes


Identify areas of alignment and overlap with cybersecurity and enterprise risk management

Ex1


Establish integrated control sets for cybersecurity risk management and cybersecurity supply chain risk management

Ex2


Integrate cybersecurity supply chain risk management into improvement processes

Ex3


Escalate material cybersecurity risks in supply chains to senior management, and address them at the enterprise risk management level

Ex4


Suppliers are known and prioritized by criticality


Develop criteria for supplier criticality based on, for example, the sensitivity of data processed or possessed by suppliers, the degree of access to the organization's systems, and the importance of the products or services to the organization's mission

Ex1


Keep a record of all suppliers, and prioritize suppliers based on the criticality criteria

Ex2


3rd Party Risk

3rd


Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties


Establish security requirements for suppliers, products, and services commensurate with their criticality level and potential impact if compromised

Ex1


Include all cybersecurity and supply chain requirements that third parties must follow and how compliance with the requirements may be verified in default contractual language

Ex2


Define the rules and protocols for information sharing between the organization and its suppliers and sub-tier suppliers in agreements

Ex3


Manage risk by including security requirements in agreements based on their criticality and potential impact if compromised

Ex4


Define security requirements in service-level agreements (SLAs) for monitoring suppliers for acceptable security performance throughout the supplier relationship lifecycle

Ex5


Contractually require suppliers to disclose cybersecurity features, functions, and vulnerabilities of their products and services for the life of the product or the term of service

Ex6


Contractually require suppliers to provide and maintain a current component inventory (e.g., software or hardware bill of materials) for critical products

Ex7


Contractually require suppliers to vet their employees and guard against insider threats

Ex8


Contractually require suppliers to provide evidence of performing acceptable security practices through, for example, self-attestation, conformance to known standards, certifications, or inspections

Ex9


Specify in contracts and other agreements the rights and responsibilities of the organization, its suppliers, and their supply chains, with respect to potential cybersecurity risks

Ex10


Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships


Perform thorough due diligence on prospective suppliers that is consistent with procurement planning and commensurate with the level of risk, criticality, and complexity of each supplier relationship

Ex1


Assess the suitability of the technology and cybersecurity capabilities and the risk management practices of prospective suppliers

Ex2


Conduct supplier risk assessments against business and applicable cybersecurity requirements

Ex3


Assess the authenticity, integrity, and security of critical products prior to acquisition and use

Ex4


3rd Party Risk

3rd


The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship


Adjust assessment formats and frequencies based on the third party's reputation and the criticality of the products or services they provide

Ex1


Evaluate third parties' evidence of compliance with contractual cybersecurity requirements, such as self-attestations, warranties, certifications, and other artifacts

Ex2


Monitor critical suppliers to ensure that they are fulfilling their security obligations throughout the supplier relationship lifecycle using a variety of methods and techniques, such as inspections, audits, tests, or other forms of evaluation

Ex3


Monitor critical suppliers, services, and products for changes to their risk profiles, and reevaluate supplier criticality and risk impact accordingly

Ex4


Plan for unexpected supplier and supply chain-related interruptions to ensure business continuity

Ex5


Relevant suppliers and other third parties are included in incident planning, response, and recovery activities


Define and use rules and protocols for reporting incident response and recovery activities and the status between the organization and its suppliers

Ex1


Identify and document the roles and responsibilities of the organization and its suppliers for incident response

Ex2


Include critical suppliers in incident response exercises and simulations

Ex3


Define and coordinate crisis communication methods and protocols between the organization and its critical suppliers

Ex4


Conduct collaborative lessons learned sessions with critical suppliers

Ex5


Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle


Policies and procedures require provenance records for all acquired technology products and services

Ex1


Periodically provide risk reporting to leaders about how acquired components are proven to be untampered and authentic

Ex2


Communicate regularly among cybersecurity risk managers and operations personnel about the need to acquire software patches, updates, and upgrades only from authenticated and trustworthy software providers

Ex3


Review policies to ensure that they require approved supplier personnel to perform maintenance on supplier products

Ex4


Policies and procedure require checking upgrades to critical hardware for unauthorized changes

Ex5


3rd Party Risk

3rd


Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement


Establish processes for terminating critical relationships under both normal and adverse circumstances

Ex1


Define and implement plans for component end-of-life maintenance support and obsolescence

Ex2


Verify that supplier access to organization resources is deactivated promptly when it is no longer needed

Ex3


Verify that assets containing the organization's data are returned or properly disposed of in a timely, controlled, and safe manner

Ex4


Develop and execute a plan for terminating or transitioning supplier relationships that takes supply chain security risk and resiliency into account

Ex5


Mitigate risks to data and systems created by supplier termination

Ex6


Manage data leakage risks associated with supplier termination

Ex7


The organization's current cybersecurity risks are understood

IDENTIFY


Assets (e.g., data, hardware, software, systems, facilities, services, people) that enable the organization to achieve business purposes are identified and managed consistent with their relative importance to organizational objectives and the organization's risk strategy

Asset Management


Inventories of hardware managed by the organization are maintained


1st Party Risk

1st


Maintain inventories for all types of hardware, including IT, IoT, OT, and mobile devices

Ex1


Constantly monitor networks to detect new hardware and automatically update inventories

Ex2


Inventories of software, services, and systems managed by the organization are maintained


Maintain inventories for all types of software and services, including commercial-off-the-shelf, open-source, custom applications, API services, and cloud-based applications and services

Ex1


Constantly monitor all platforms, including containers and virtual machines, for software and service inventory changes

Ex2


Maintain an inventory of the organization's systems

Ex3


Representations of the organization's authorized network communication and internal and external network data flows are maintained


3rd Party Risk

3rd


Maintain baselines of communication and data flows within the organization's wired and wireless networks

Ex1


Maintain baselines of communication and data flows between the organization and third parties

Ex2


Maintain baselines of communication and data flows for the organization's infrastructure-as-a-service (IaaS) usage

Ex3


Maintain documentation of expected network ports, protocols, and services that are typically used among authorized systems

Ex4


Inventories of services provided by suppliers are maintained


Inventory all external services used by the organization, including third-party infrastructure-as-a-service (IaaS), platform-as-a-service (PaaS), and software-as-a-service (SaaS) offerings; APIs; and other externally hosted application services

Ex1


Update the inventory when a new external service is going to be utilized to ensure adequate cybersecurity risk management monitoring of the organization's use of that service

Ex2


Assets are prioritized based on classification, criticality, resources, and impact on the mission


1st Party Risk

1st


Define criteria for prioritizing each class of assets

Ex1


Apply the prioritization criteria to assets

Ex2


Track the asset priorities and update them periodically or when significant changes to the organization occur

Ex3


Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established


Incorporated into GV.RR-02, GV.SC-02


Inventories of data and corresponding metadata for designated data types are maintained


Maintain a list of the designated data types of interest (e.g., personally identifiable information, protected health information, financial account numbers, organization intellectual property, operational technology data)

Ex1


Continuously discover and analyze ad hoc data to identify new instances of designated data types

Ex2


Assign data classifications to designated data types through tags or labels

Ex3


Track the provenance, data owner, and geolocation of each instance of designated data types

Ex4


Systems, hardware, software, services, and data are managed throughout their life cycles


3rd Party Risk

3rd


Integrate cybersecurity considerations throughout the life cycles of systems, hardware, software, and services

Ex1


Integrate cybersecurity considerations into product life cycles

Ex2


Identify unofficial uses of technology to meet mission objectives (i.e., shadow IT)

Ex3


Periodically identify redundant systems, hardware, software, and services that unnecessarily increase the organization's attack surface

Ex4


Properly configure and secure systems, hardware, software, and services prior to their deployment in production

Ex5


Update inventories when systems, hardware, software, and services are moved or transferred within the organization

Ex6


Securely destroy stored data based on the organization's data retention policy using the prescribed destruction method, and keep and manage a record of the destructions

Ex7


Securely sanitize data storage when hardware is being retired, decommissioned, reassigned, or sent for repairs or replacement

Ex8


Offer methods for destroying paper, storage media, and other physical forms of data storage

Ex9


The cybersecurity risk to the organization, assets, and individuals is understood by the organization

Risk Assessment


Vulnerabilities in assets are identified, validated, and recorded


1st Party Risk

1st


Use vulnerability management technologies to identify unpatched and misconfigured software

Ex1


Assess network and system architectures for design and implementation weaknesses that affect cybersecurity

Ex2


Review, analyze, or test organization-developed software to identify design, coding, and default configuration vulnerabilities

Ex3


Assess facilities that house critical computing assets for physical vulnerabilities and resilience issues

Ex4


Monitor sources of cyber threat intelligence for information on new vulnerabilities in products and services

Ex5


Review processes and procedures for weaknesses that could be exploited to affect cybersecurity

Ex6


Cyber threat intelligence is received from information sharing forums and sources


Configure cybersecurity tools and technologies with detection or response capabilities to securely ingest cyber threat intelligence feeds

Ex1


Receive and review advisories from reputable third parties on current threat actors and their tactics, techniques, and procedures (TTPs)

Ex2


Monitor sources of cyber threat intelligence for information on the types of vulnerabilities that emerging technologies may have

Ex3


Internal and external threats to the organization are identified and recorded


3rd Party Risk

3rd


Use cyber threat intelligence to maintain awareness of the types of threat actors likely to target the organization and the TTPs they are likely to use

Ex1


Perform threat hunting to look for signs of threat actors within the environment

Ex2


Implement processes for identifying internal threat actors

Ex3


Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded


1st Party Risk

1st


Business leaders and cybersecurity risk management practitioners work together to estimate the likelihood and impact of risk scenarios and record them in risk registers

Ex1


Enumerate the potential business impacts of unauthorized access to the organization's communications, systems, and data processed in or by those systems

Ex2


Account for the potential impacts of cascading failures for systems of systems

Ex3


Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization


Develop threat models to better understand risks to the data and identify appropriate risk responses

Ex1


Prioritize cybersecurity resource allocations and investments based on estimated likelihoods and impacts

Ex2


Risk responses are chosen, prioritized, planned, tracked, and communicated


Apply the vulnerability management plan's criteria for deciding whether to accept, transfer, mitigate, or avoid risk

Ex1


Apply the vulnerability management plan's criteria for selecting compensating controls to mitigate risk

Ex2


Track the progress of risk response implementation (e.g., plan of action and milestones [POA&M], risk register, risk detail report)

Ex3


Use risk assessment findings to inform risk response decisions and actions

Ex4


Communicate planned risk responses to affected stakeholders in priority order

Ex5


Changes and exceptions are managed, assessed for risk impact, recorded, and tracked


Implement and follow procedures for the formal documentation, review, testing, and approval of proposed changes and requested exceptions

Ex1


Document the possible risks of making or not making each proposed change, and provide guidance on rolling back changes

Ex2


Document the risks related to each requested exception and the plan for responding to those risks

Ex3


Periodically review risks that were accepted based upon planned future actions or milestones

Ex4


Processes for receiving, analyzing, and responding to vulnerability disclosures are established


1st Party Risk

1st


3rd Party Risk

3rd


Conduct vulnerability information sharing between the organization and its suppliers following the rules and protocols defined in contracts

Ex1


Assign responsibilities and verify the execution of procedures for processing, analyzing the impact of, and responding to cybersecurity threat, vulnerability, or incident disclosures by suppliers, customers, partners, and government cybersecurity organizations

Ex2


The authenticity and integrity of hardware and software are assessed prior to acquisition and use


Assess the authenticity and cybersecurity of critical technology products and services prior to acquisition and use

Ex1


Critical suppliers are assessed prior to acquisition


Conduct supplier risk assessments against business and applicable cybersecurity requirements, including the supply chain

Ex1


Improvements to organizational cybersecurity risk management processes, procedures and activities are identified across all CSF Functions

Improvement


Improvements are identified from evaluations


Perform self-assessments of critical services that take current threats and TTPs into consideration

Ex1


Invest in third-party assessments or independent audits of the effectiveness of the organization's cybersecurity program to identify areas that need improvement

Ex2


Constantly evaluate compliance with selected cybersecurity requirements through automated means

Ex3


Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties


Identify improvements for future incident response activities based on findings from incident response assessments (e.g., tabletop exercises and simulations, tests, internal reviews, independent audits)

Ex1


Identify improvements for future business continuity, disaster recovery, and incident response activities based on exercises performed in coordination with critical service providers and product suppliers

Ex2


Involve internal stakeholders (e.g., senior executives, legal department, HR) in security tests and exercises as appropriate

Ex3


Perform penetration testing to identify opportunities to improve the security posture of selected high-risk systems as approved by leadership

Ex4


Exercise contingency plans for responding to and recovering from the discovery that products or services did not originate with the contracted supplier or partner or were altered before receipt

Ex5


Collect and analyze performance metrics using security tools and services to inform improvements to the cybersecurity program

Ex6


Improvements are identified from execution of operational processes, procedures, and activities


1st Party Risk

1st


Conduct collaborative lessons learned sessions with suppliers

Ex1


Annually review cybersecurity policies, processes, and procedures to take lessons learned into account

Ex2


Use metrics to assess operational cybersecurity performance over time

Ex3


Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved


Establish contingency plans (e.g., incident response, business continuity, disaster recovery) for responding to and recovering from adverse events that can interfere with operations, expose confidential information, or otherwise endanger the organization's mission and viability

Ex1


Include contact and communication information, processes for handling common scenarios, and criteria for prioritization, escalation, and elevation in all contingency plans

Ex2


Create a vulnerability management plan to identify and assess all types of vulnerabilities and to prioritize, test, and implement risk responses

Ex3


Communicate cybersecurity plans (including updates) to those responsible for carrying them out and to affected parties

Ex4


Review and update all cybersecurity plans annually or when a need for significant improvements is identified

Ex5


The organization’s role in the supply chain is identified and communicated


Incorporated into GV.OC-05


The organization’s place in critical infrastructure and its industry sector is identified and communicated


Incorporated into GV.OC-01


Priorities for organizational mission, objectives, and activities are established and communicated


Dependencies and critical functions for delivery of critical services are established


Incorporated into GV.OC-04, GV.OC-05


Resilience requirements to support delivery of critical services are established for all operating states (e.g. under duress/attack, during recovery, normal operations)


Incorporated into GV.OC-04


Incorporated into GV.OC


Organizational cybersecurity policy is established and communicated


Incorporated into GV.PO, GV.PO-01, GV.PO-02


Cybersecurity roles and responsibilities are coordinated and aligned with internal roles and external partners


Incorporated into GV.OC-02, GV.RR, GV.RR-02


Legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations, are understood and managed


Moved to GV.OC-03


Governance and risk management processes address cybersecurity risks


Moved to GV.RM-04


Incorporated into GV


Risk management processes are established, managed, and agreed to by organizational stakeholders


Incorporated into GV.RM-01, GV.RM-06, GV.RR-03


Organizational risk tolerance is determined and clearly expressed


Incorporated into GV.RM-02, GV.RM-04


The organization’s determination of risk tolerance is informed by its role in critical infrastructure and sector specific risk analysis


Moved into GV.RM-02


Incorporated into GV.RM


Cyber supply chain risk management processes are identified, established, assessed, managed, and agreed to by organizational stakeholders


Incorporated into GV.RM-05, GV.SC-01, GV.SC-06, GV.SC-09, GV.SC-10


Suppliers and third party partners of information systems, components, and services are identified, prioritized, and assessed using a cyber supply chain risk assessment process


Incorporated into GV.OC-02, GV.SC-03, GV.SC-04, GV.SC-07, ID.RA-10


Contracts with suppliers and third-party partners are used to implement appropriate measures designed to meet the objectives of an organization’s cybersecurity program and Cyber Supply Chain Risk Management Plan.


Moved to GV.SC-05


Suppliers and third-party partners are routinely assessed using audits, test results, or other forms of evaluations to confirm they are meeting their contractual obligations.


Incorporated into GV.SC-07, ID.RA-10


Response and recovery planning and testing are conducted with suppliers and third-party providers


Incorporated into GV.SC-08, ID.IM-02


Incorporated into GV.SC


Safeguards to manage the organization's cybersecurity risks are used

PROTECT


Access to physical and logical assets is limited to authorized users, services, and hardware and  managed commensurate with the assessed risk of unauthorized access

Identity Management, Authentication, and Access Control


Identities and credentials for authorized users, services, and hardware are managed by the organization


1st Party Risk

1st


Initiate requests for new access or additional access for employees, contractors, and others, and track, review, and fulfill the requests, with permission from system or data owners when needed

Ex1


Issue, manage, and revoke cryptographic certificates and identity tokens, cryptographic keys (i.e., key management), and other credentials

Ex2


Select a unique identifier for each device from immutable hardware characteristics or an identifier securely provisioned to the device

Ex3


Physically label authorized hardware with an identifier for inventory and servicing purposes

Ex4


Identities are proofed and bound to credentials based on the context of interactions


3rd Party Risk

3rd


Verify a person's claimed identity at enrollment time using government-issued identity credentials (e.g., passport, visa, driver's license)

Ex1


Issue a different credential for each person (i.e., no credential sharing)

Ex2


Users, services, and hardware are authenticated


Require multifactor authentication

Ex1


Enforce policies for the minimum strength of passwords, PINs, and similar authenticators

Ex2


Periodically reauthenticate users, services, and hardware based on risk (e.g., in zero trust architectures)

Ex3


Ensure that authorized personnel can access accounts essential for protecting safety under emergency conditions

Ex4


Identity assertions are protected, conveyed, and verified


Protect identity assertions that are used to convey authentication and user information through single sign-on systems

Ex1


Protect identity assertions that are used to convey authentication and user information between federated systems

Ex2


Implement standards-based approaches for identity assertions in all contexts, and follow all guidance for the generation (e.g., data models, metadata), protection (e.g., digital signing, encryption), and verification (e.g., signature validation) of identity assertions

Ex3


Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties


1st Party Risk

1st


Review logical and physical access privileges periodically and whenever someone changes roles or leaves the organization, and promptly rescind privileges that are no longer needed

Ex1


Take attributes of the requester and the requested resource into account for authorization decisions (e.g., geolocation, day/time, requester endpoint's cyber health)

Ex2


Restrict access and privileges to the minimum necessary (e.g., zero trust architecture)

Ex3


Periodically review the privileges associated with critical business functions to confirm proper separation of duties

Ex4


Physical access to assets is managed, monitored, and enforced commensurate with risk


3rd Party Risk

3rd


Use security guards, security cameras, locked entrances, alarm systems, and other physical controls to monitor facilities and restrict access

Ex1


Employ additional physical security controls for areas that contain high-risk assets

Ex2


Escort guests, vendors, and other third parties within areas that contain business-critical assets

Ex3


The organization's personnel are provided with cybersecurity awareness and training so that they can perform their cybersecurity-related tasks

Awareness and Training


Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind


Provide basic cybersecurity awareness and training to employees, contractors, partners, suppliers, and all other users of the organization's non-public resources

Ex1


Train personnel to recognize social engineering attempts and other common attacks, report attacks and suspicious activity, comply with acceptable use policies, and perform basic cyber hygiene tasks (e.g., patching software, choosing passwords, protecting credentials)

Ex2


Explain the consequences of cybersecurity policy violations, both to individual users and the organization as a whole

Ex3


Periodically assess or test users on their understanding of basic cybersecurity practices

Ex4


Require annual refreshers to reinforce existing practices and introduce new practices

Ex5


Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind


1st Party Risk

1st


Identify the specialized roles within the organization that require additional cybersecurity training, such as physical and cybersecurity personnel, finance personnel, senior leadership, and anyone with access to business-critical data

Ex1


Provide role-based cybersecurity awareness and training to all those in specialized roles, including contractors, partners, suppliers, and other third parties

Ex2


Periodically assess or test users on their understanding of cybersecurity practices for their specialized roles

Ex3


Ex4


Third-party stakeholders (e.g., suppliers, customers, partners) understand their roles and responsibilities


Incorporated into PR.AT-01, PR.AT-02


Senior executives understand their roles and responsibilities


Incorporated into PR.AT-02


Physical and cybersecurity personnel understand their roles and responsibilities


Data are managed consistent with the organization's risk strategy to protect the confidentiality, integrity, and availability of information

Data Security


The confidentiality, integrity, and availability of data-at-rest are protected


Use encryption, digital signatures, and cryptographic hashes to protect the confidentiality and integrity of stored data in files, databases, virtual machine disk images, container images, and other resources

Ex1


Use full disk encryption to protect data stored on user endpoints

Ex2


Confirm the integrity of software by validating signatures

Ex3


Restrict the use of removable media to prevent data exfiltration

Ex4


Physically secure removable media containing unencrypted sensitive information, such as within locked offices or file cabinets

Ex5


The confidentiality, integrity, and availability of data-in-transit are protected


1st Party Risk

1st


Use encryption, digital signatures, and cryptographic hashes to protect the confidentiality and integrity of network communications

Ex1


Automatically encrypt or block outbound emails and other communications that contain sensitive data, depending on the data classification

Ex2


Block access to personal email, file sharing, file storage services, and other personal communications applications and services from organizational systems and networks

Ex3


Prevent reuse of sensitive data from production environments (e.g., customer records) in development, testing, and other non-production environments

Ex4


Assets are formally managed throughout removal, transfers, and disposition


Incorporated into ID.AM-08, PR.PS-03


Adequate capacity to ensure availability is maintained


Moved to PR.IR-04


Protections against data leaks are implemented


Incorporated into PR.DS-01, PR.DS-02, PR.DS-10


Integrity checking mechanisms are used to verify software, firmware, and information integrity


Incorporated into PR.DS-01, DE.CM-09


The development and testing environment(s) are separate from the production environment


Incorporated into PR.IR-01


Integrity checking mechanisms are used to verify hardware integrity


Incorporated into ID.RA-09, DE.CM-09


The confidentiality, integrity, and availability of data-in-use are protected


1st Party Risk

1st


Remove data that must remain confidential (e.g., from processors and memory) as soon as it is no longer needed

Ex1


Protect data in use from access by other users and processes of the same platform

Ex2


Backups of data are created, protected, maintained, and tested


Continuously back up critical data in near-real-time, and back up other data frequently at agreed-upon schedules

Ex1


Test backups and restores for all types of data sources at least annually

Ex2


Securely store some backups offline and offsite so that an incident or disaster will not damage them

Ex3


Enforce geographic separation and geolocation restrictions for data backup storage

Ex4


The hardware, software (e.g., firmware, operating systems, applications), and services of physical and virtual platforms are managed consistent with the organization's risk strategy to protect their confidentiality, integrity, and availability

Platform Security


Configuration management practices are established and applied


Establish, test, deploy, and maintain hardened baselines that enforce the organization's cybersecurity policies and provide only essential capabilities (i.e., principle of least functionality)

Ex1


Review all default configuration settings that may potentially impact cybersecurity when installing or upgrading software

Ex2


Monitor implemented software for deviations from approved baselines

Ex3


Software is maintained, replaced, and removed commensurate with risk


Perform routine and emergency patching within the timeframes specified in the vulnerability management plan

Ex1


Update container images, and deploy new container instances to replace rather than update existing instances

Ex2


Replace end-of-life software and service versions with supported, maintained versions

Ex3


Uninstall and remove unauthorized software and services that pose undue risks

Ex4


Uninstall and remove any unnecessary software components (e.g., operating system utilities) that attackers might misuse

Ex5


Define and implement plans for software and service end-of-life maintenance support and obsolescence

Ex6


Hardware is maintained, replaced, and removed commensurate with risk


1st Party Risk

1st


3rd Party Risk

3rd


Replace hardware when it lacks needed security capabilities or when it cannot support software with needed security capabilities

Ex1


Define and implement plans for hardware end-of-life maintenance support and obsolescence

Ex2


Perform hardware disposal in a secure, responsible, and auditable manner

Ex3


Log records are generated and made available for continuous monitoring


Configure all operating systems, applications, and services (including cloud-based services) to generate log records

Ex1


Configure log generators to securely share their logs with the organization's logging infrastructure systems and services

Ex2


Configure log generators to record the data needed by zero-trust architectures

Ex3


Installation and execution of unauthorized software are prevented


When risk warrants it, restrict software execution to permitted products only or deny the execution of prohibited and unauthorized software

Ex1


Verify the source of new software and the software's integrity before installing it

Ex2


Configure platforms to use only approved DNS services that block access to known malicious domains

Ex3


Configure platforms to allow the installation of organization-approved software only

Ex4


Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle


Protect all components of organization-developed software from tampering and unauthorized access

Ex1


Secure all software produced by the organization, with minimal vulnerabilities in their releases

Ex2


Maintain the software used in production environments, and securely dispose of software once it is no longer needed

Ex3


Security architectures are managed with the organization's risk strategy to protect asset confidentiality, integrity, and availability, and organizational resilience

Technology Infrastructure Resilience


Networks and environments are protected from unauthorized logical access and usage


1st Party Risk

1st


3rd Party Risk

3rd


Logically segment organization networks and cloud-based platforms according to trust boundaries and platform types (e.g., IT, IoT, OT, mobile, guests), and permit required communications only between segments

Ex1


Logically segment organization networks from external networks, and permit only necessary communications to enter the organization's networks from the external networks

Ex2


Implement zero trust architectures to restrict network access to each resource to the minimum necessary

Ex3


Check the cyber health of endpoints before allowing them to access and use production resources

Ex4


The organization's technology assets are protected from environmental threats


Protect organizational equipment from known environmental threats, such as flooding, fire, wind, and excessive heat and humidity

Ex1


Include protection from environmental threats and provisions for adequate operating infrastructure in requirements for service providers that operate systems on the organization's behalf

Ex2


Mechanisms are implemented to achieve resilience requirements in normal and adverse situations


Avoid single points of failure in systems and infrastructure

Ex1


Use load balancing to increase capacity and improve reliability

Ex2


Use high-availability components like redundant storage and power supplies to improve system reliability

Ex3


Adequate resource capacity to ensure availability is maintained


Monitor usage of storage, power, compute, network bandwidth, and other resources

Ex1


Forecast future needs, and scale resources accordingly

Ex2


Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users and processes


Incorporated into PR.AA-01, PR.AA-05


Physical access to assets is managed and protected


Moved to PR.AA-06


Remote access is managed


Incorporated into PR.AA-03, PR.AA-05, PR.IR-01


Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties


Moved to PR.AA-05


Network integrity is protected (e.g., network segregation, network segmentation)


Incorporated into PR.IR-01


Identities are proofed and bound to credentials and asserted in interactions


Moved to PR.AA-02


Users, devices, and other assets are authenticated (e.g., single-factor, multi-factor) commensurate with the risk of the transaction (e.g., individuals’ security and privacy risks and other organizational risks)


Moved to PR.AA-03


Moved to PR.AA


A baseline configuration of information technology/industrial control systems is created and maintained incorporating security principles (e.g. concept of least functionality)


Incorporated into PR.PS-01


A System Development Life Cycle to manage systems is implemented


Incorporated into ID.AM-08, PR.PS-06


Configuration change control processes are in place


Incorporated into PR.PS-01, ID.RA-07


Backups of information are conducted, maintained, and tested


Moved to PR.DS-11


Policy and regulations regarding the physical operating environment for organizational assets are met


Moved to PR.IR-02


Data is destroyed according to policy


Incorporated into ID.AM-08


Protection processes are improved


Incorporated into ID.IM, ID.IM-03


Effectiveness of protection technologies is shared


Moved to ID.IM-03


Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed


Moved to ID.IM-04


Response and recovery plans are tested


Incorporated into ID.IM-02, ID.IM-04


Cybersecurity is included in human resources practices (e.g., deprovisioning, personnel screening)


Moved to GV.RR-04


A vulnerability management plan is developed and implemented


Incorporated into ID.RA-01, PR.PS-02


Incorporated into other Categories and Functions


Maintenance and repair of organizational assets are performed and logged, with approved and controlled tools


Incorporated into ID.AM-08, PR.PS-03


Remote maintenance of organizational assets is approved, logged, and performed in a manner that prevents unauthorized access


Incorporated into ID.AM-08, PR.PS-02


Incorporated into ID.AM-08


Audit/log records are determined, documented, implemented, and reviewed in accordance with policy


Incorporated into PR.PS-04


Removable media is protected and its use restricted according to policy


Incorporated into PR.DS-01, PR.PS-01


The principle of least functionality is incorporated by configuring systems to provide only essential capabilities


Incorporated into PR.PS-01


Communications and control networks are protected


Incorporated into PR.AA-06, PR.IR-01


Mechanisms (e.g., failsafe, load balancing, hot swap) are implemented to achieve resilience requirements in normal and adverse situations


Moved to PR.IR-03


Incorporated into other Protect Categories


Possible cybersecurity attacks and compromises are found and analyzed

DETECT


Assets are monitored to find anomalies, indicators of compromise, and other potentially adverse events

Continuous Monitoring


Networks and network services are monitored to find potentially adverse events


Monitor DNS, BGP, and other network services for adverse events

Ex1


Monitor wired and wireless networks for connections from unauthorized endpoints

Ex2


Monitor facilities for unauthorized or rogue wireless networks

Ex3


Compare actual network flows against baselines to detect deviations

Ex4


Monitor network communications to identify changes in security postures for zero trust purposes

Ex5


1st Party Risk

1st


The physical environment is monitored to find potentially adverse events


Monitor logs from physical access control systems (e.g., badge readers) to find unusual access patterns (e.g., deviations from the norm) and failed access attempts

Ex1


Review and monitor physical access records (e.g., from visitor registration, sign-in sheets)

Ex2


Monitor physical access controls (e.g., locks, latches, hinge pins, alarms) for signs of tampering

Ex3


Monitor the physical environment using alarm systems, cameras, and security guards

Ex4


Personnel activity and technology usage are monitored to find potentially adverse events


Use behavior analytics software to detect anomalous user activity to mitigate insider threats

Ex1


Monitor logs from logical access control systems to find unusual access patterns and failed access attempts

Ex2


Continuously monitor deception technology, including user accounts, for any usage

Ex3


Malicious code is detected


Incorporated into DE.CM-01, DE.CM-09


Unauthorized mobile code is detected


External service provider activities and services are monitored to find potentially adverse events


Monitor remote and onsite administration and maintenance activities that external providers perform on organizational systems

Ex1


Monitor activity from cloud-based services, internet service providers, and other service providers for deviations from expected behavior

Ex2


3rd Party Risk

3rd


Monitoring for unauthorized personnel, connections, devices, and software is performed


Incorporated into DE.CM-01, DE.CM-03, DE.CM-06, DE.CM-09


Vulnerability scans are performed


Incorporated into ID.RA-01


Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events


Monitor email, web, file sharing, collaboration services, and other common attack vectors to detect malware, phishing, data leaks and exfiltration, and other adverse events

Ex1


Monitor authentication attempts to identify attacks against credentials and unauthorized credential reuse

Ex2


Monitor software configurations for deviations from security baselines

Ex3


Monitor hardware and software for signs of tampering

Ex4


Use technologies with a presence on endpoints to detect cyber health issues (e.g., missing patches, malware infections, unauthorized software), and redirect the endpoints to a remediation environment before access is authorized

Ex5


1st Party Risk

1st


Anomalies, indicators of compromise, and other potentially adverse events are analyzed to characterize the events and detect cybersecurity incidents

Adverse Event Analysis


A baseline of network operations and expected data flows for users and systems is established and managed


Incorporated into ID.AM-03


Potentially adverse events are analyzed to better understand associated activities


Use security information and event management (SIEM) or other tools to continuously monitor log events for known malicious and suspicious activity

Ex1


Utilize up-to-date cyber threat intelligence in log analysis tools to improve detection accuracy and characterize threat actors, their methods, and indicators of compromise

Ex2


Regularly conduct manual reviews of log events for technologies that cannot be sufficiently monitored through automation

Ex3


Use log analysis tools to generate reports on their findings

Ex4


Information is correlated from multiple sources


Constantly transfer log data generated by other sources to a relatively small number of log servers

Ex1


Use event correlation technology (e.g., SIEM) to collect information captured by multiple sources

Ex2


Utilize cyber threat intelligence to help correlate events among log sources

Ex3


The estimated impact and scope of adverse events are understood


Use SIEMs or other tools to estimate impact and scope, and review and refine the estimates

Ex1


A person creates their own estimates of impact and scope

Ex2


Incident alert thresholds are established


Moved to DE.AE-08


Information on adverse events is provided to authorized staff and tools


Use cybersecurity software to generate alerts and provide them to the security operations center (SOC), incident responders, and incident response tools

Ex1


Incident responders and other authorized personnel can access log analysis findings at all times

Ex2


Automatically create and assign tickets in the organization's ticketing system when certain types of alerts occur

Ex3


Manually create and assign tickets in the organization's ticketing system when technical staff discover indicators of compromise

Ex4


1st Party Risk

1st


Cyber threat intelligence and other contextual information are integrated into the analysis


Securely provide cyber threat intelligence feeds to detection technologies, processes, and personnel

Ex1


Securely provide information from asset inventories to detection technologies, processes, and personnel

Ex2


Rapidly acquire and analyze vulnerability disclosures for the organization's technologies from suppliers, vendors, and third-party security advisories

Ex3


Incidents are declared when adverse events meet the defined incident criteria


Apply incident criteria to known and assumed characteristics of activity in order to determine whether an incident should be declared

Ex1


Take known false positives into account when applying incident criteria

Ex2


Roles and responsibilities for detection are well defined to ensure accountability


Incorporated into GV.RR-02


Detection activities comply with all applicable requirements


Incorporated into DE.AE


Detection processes are tested


Incorporated into ID.IM-02


Event detection information is communicated


Incorporated into DE.AE-06


Detection processes are continuously improved


Incorporated into ID.IM, ID.IM-03


Incorporated into other Categories and Functions


Actions regarding a detected cybersecurity incident are taken

RESPOND


Responses to detected cybersecurity incidents are managed

Incident Management


The incident response plan is executed in coordination with relevant third parties once an incident is declared


Detection technologies automatically report confirmed incidents

Ex1


Request incident response assistance from the organization's incident response outsourcer

Ex2


Designate an incident lead for each incident

Ex3


Initiate execution of additional cybersecurity plans as needed to support incident response (for example, business continuity and disaster recovery)

Ex4


3rd Party Risk

3rd


Incident reports are triaged and validated


1st Party Risk

1st


Preliminarily review incident reports to confirm that they are cybersecurity-related and necessitate incident response activities

Ex1


Apply criteria to estimate the severity of an incident

Ex2


Incidents are categorized and prioritized


Further review and categorize incidents based on the type of incident (e.g., data breach, ransomware, DDoS, account compromise)

Ex1


Prioritize incidents based on their scope, likely impact, and time-critical nature

Ex2


Select incident response strategies for active incidents by balancing the need to quickly recover from an incident with the need to observe the attacker or conduct a more thorough investigation

Ex3


Incidents are escalated or elevated as needed


Track and validate the status of all ongoing incidents

Ex1


Coordinate incident escalation or elevation with designated internal and external stakeholders

Ex2


The criteria for initiating incident recovery are applied


Apply incident recovery criteria to known and assumed characteristics of the incident to determine whether incident recovery processes should be initiated

Ex1


Take the possible operational disruption of incident recovery activities into account

Ex2


Investigations are conducted to ensure effective response and support forensics and recovery activities

Incident Analysis


Notifications from detection systems are investigated


Incorporated into RS.MA-02


The impact of the incident is understood


Incorporated into RS.MA-02, RS.MA-03, RS.MA-04


Analysis is performed to establish what has taken place during an incident and the root cause of the incident


1st Party Risk

1st


Determine the sequence of events that occurred during the incident and which assets and resources were involved in each event

Ex1


Attempt to determine what vulnerabilities, threats, and threat actors were directly or indirectly involved in the incident

Ex2


Analyze the incident to find the underlying, systemic root causes

Ex3


Check any cyber deception technology for additional information on attacker behavior

Ex4


Incidents are categorized consistent with response plans


Moved to RS.MA-03


Processes are established to receive, analyze and respond to vulnerabilities disclosed to the organization from internal and external sources (e.g. internal testing, security bulletins, or security researchers)


Moved to ID.RA-08


Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved


Require each incident responder and others (e.g., system administrators, cybersecurity engineers) who perform incident response tasks to record their actions and make the record immutable

Ex1


Require the incident lead to document the incident in detail and be responsible for preserving the integrity of the documentation and the sources of all information being reported

Ex2


Incident data and metadata are collected, and their integrity and provenance are preserved


Collect, preserve, and safeguard the integrity of all pertinent incident data and metadata (e.g., data source, date/time of collection) based on evidence preservation and chain-of-custody procedures

Ex1


An incident's magnitude is estimated and validated


Review other potential targets of the incident to search for indicators of compromise and evidence of persistence

Ex1


Automatically run tools on targets to look for indicators of compromise and evidence of persistence

Ex2


Response activities are coordinated with internal and external stakeholders as required by laws, regulations, or policies

Incident Response Reporting and Communication


Personnel know their roles and order of operations when a response is needed


Incorporated into PR.AT-01


Internal and external stakeholders are notified of incidents


1st Party Risk

1st


3rd Party Risk

3rd


Follow the organization's breach notification procedures after discovering a data breach incident, including notifying affected customers

Ex1


Notify business partners and customers of incidents in accordance with contractual requirements

Ex2


Notify law enforcement agencies and regulatory bodies of incidents based on criteria in the incident response plan and management approval

Ex3


Information is shared with designated internal and external stakeholders


Securely share information consistent with response plans and information sharing agreements

Ex1


Voluntarily share information about an attacker's observed TTPs, with all sensitive data removed, with an Information Sharing and Analysis Center (ISAC)

Ex2


Notify HR when malicious insider activity occurs

Ex3


Regularly update senior leadership on the status of major incidents

Ex4


Follow the rules and protocols defined in contracts for incident information sharing between the organization and its suppliers

Ex5


Coordinate crisis communication methods between the organization and its critical suppliers

Ex6


Coordination with stakeholders occurs consistent with response plans


Incorporated into RS.MA-01, RS.MA-04


Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness


Incorporated into RS.CO-03


Activities are performed to prevent expansion of an event and mitigate its effects

Incident Mitigation


Incidents are contained


1st Party Risk

1st


3rd Party Risk

3rd


Cybersecurity technologies (e.g., antivirus software) and cybersecurity features of other technologies (e.g., operating systems, network infrastructure devices) automatically perform containment actions

Ex1


Allow incident responders to manually select and perform containment actions

Ex2


Allow a third party (e.g., internet service provider, managed security service provider) to perform containment actions on behalf of the organization

Ex3


Automatically transfer compromised endpoints to a remediation virtual local area network (VLAN)

Ex4


Incidents are eradicated


Cybersecurity technologies and cybersecurity features of other technologies (e.g., operating systems, network infrastructure devices) automatically perform eradication actions

Ex1


Allow incident responders to manually select and perform eradication actions

Ex2


Allow a third party (e.g., managed security service provider) to perform eradication actions on behalf of the organization

Ex3


Newly identified vulnerabilities are mitigated or documented as accepted risks


Incorporated into ID.RA-06


Response plan is executed during or after an incident


Incorporated into RS.MA-01


Incorporated into RS.MA


Response plans incorporate lessons learned


Incorporated into ID.IM-03, ID.IM-04


Response strategies are updated


Incorporated into ID.IM-03


Incorporated into ID.IM


Assets and operations affected by a cybersecurity incident are restored

RECOVER


Restoration activities are performed to ensure operational availability of systems and services affected by cybersecurity incidents

Incident Recovery Plan Execution


The recovery portion of the incident response plan is executed once initiated from the incident response process


1st Party Risk

1st


Begin recovery procedures during or after incident response processes

Ex1


Make all individuals with recovery responsibilities aware of the plans for recovery and the authorizations required to implement each aspect of the plans

Ex2


Recovery actions are selected, scoped, prioritized, and performed


Select recovery actions based on the criteria defined in the incident response plan and available resources

Ex1


Change planned recovery actions based on a reassessment of organizational needs and resources

Ex2


The integrity of backups and other restoration assets is verified before using them for restoration


Check restoration assets for indicators of compromise, file corruption, and other integrity issues before use

Ex1


Critical mission functions and cybersecurity risk management are considered to establish post-incident operational norms


Use business impact and system categorization records (including service delivery objectives) to validate that essential services are restored in the appropriate order

Ex1


Work with system owners to confirm the successful restoration of systems and the return to normal operations

Ex2


Monitor the performance of restored systems to verify the adequacy of the restoration

Ex3


The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed


Check restored assets for indicators of compromise and remediation of root causes of the incident before production use

Ex1


Verify the correctness and adequacy of the restoration actions taken before putting a restored system online

Ex2


The end of incident recovery is declared based on criteria, and incident-related documentation is completed


Prepare an after-action report that documents the incident itself, the response and recovery actions taken, and lessons learned

Ex1


Declare the end of incident recovery once the criteria are met

Ex2


Restoration activities are coordinated with internal and external parties

Incident Recovery Communication


Public relations are managed


Incorporated into RC.CO-04


Reputation is repaired after an incident


Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders


1st Party Risk

1st


3rd Party Risk

3rd


Securely share recovery information, including restoration progress, consistent with response plans and information sharing agreements

Ex1


Regularly update senior leadership on recovery status and restoration progress for major incidents

Ex2


Follow the rules and protocols defined in contracts for incident information sharing between the organization and its suppliers

Ex3


Coordinate crisis communication between the organization and its critical suppliers

Ex4


Public updates on incident recovery are shared using approved methods and messaging


Follow the organization's breach notification procedures for recovering from a data breach incident

Ex1


Explain the steps being taken to recover from the incident and to prevent a recurrence

Ex2


Recovery plans incorporate lessons learned


Incorporated into ID.IM-03, ID.IM-04


Recovery strategies are updated


Incorporated into ID.IM-03


Incorporated into ID.IM


Organizational Context

The circumstances - mission, stakeholder expectations, dependencies, and legal, regulatory, and contractual requirements - surrounding the organization's cybersecurity risk management decisions are understood


Risk Management Strategy

The organization's priorities, constraints, risk tolerance and appetite statements, and assumptions are established, communicated, and used to support operational risk decisions


Cybersecurity roles, responsibilities, and authorities to foster accountability, performance assessment, and continuous improvement are established and communicated


Policy

Organizational cybersecurity policy is established, communicated, and enforced


Oversight

Results of organization-wide cybersecurity risk management activities and performance are used to inform, improve, and adjust the risk management strategy


Cyber supply chain risk management processes are identified, established, managed, monitored, and improved by organizational stakeholders


Asset Management

Assets (e.g., data, hardware, software, systems, facilities, services, people) that enable the organization to achieve business purposes are identified and managed consistent with their relative importance to organizational objectives and the organization's risk strategy


Risk Assessment

The cybersecurity risk to the organization, assets, and individuals is understood by the organization


Improvement

Improvements to organizational cybersecurity risk management processes, procedures and activities are identified across all CSF Functions


Access to physical and logical assets is limited to authorized users, services, and hardware and  managed commensurate with the assessed risk of unauthorized access


Awareness and Training

The organization's personnel are provided with cybersecurity awareness and training so that they can perform their cybersecurity-related tasks


Data Security

Data are managed consistent with the organization's risk strategy to protect the confidentiality, integrity, and availability of information


Platform Security

The hardware, software (e.g., firmware, operating systems, applications), and services of physical and virtual platforms are managed consistent with the organization's risk strategy to protect their confidentiality, integrity, and availability


Technology Infrastructure Resilience

Security architectures are managed with the organization's risk strategy to protect asset confidentiality, integrity, and availability, and organizational resilience


Continuous Monitoring

Assets are monitored to find anomalies, indicators of compromise, and other potentially adverse events


Adverse Event Analysis

Anomalies, indicators of compromise, and other potentially adverse events are analyzed to characterize the events and detect cybersecurity incidents


Incident Management

Responses to detected cybersecurity incidents are managed


Incident Analysis

Investigations are conducted to ensure effective response and support forensics and recovery activities


Response activities are coordinated with internal and external stakeholders as required by laws, regulations, or policies


Incident Mitigation

Activities are performed to prevent expansion of an event and mitigate its effects


Incident Recovery Plan Execution

Restoration activities are performed to ensure operational availability of systems and services affected by cybersecurity incidents


Incident Recovery Communication

Restoration activities are coordinated with internal and external parties


GOVERN

The organization's cybersecurity risk management strategy, expectations, and policy are established, communicated, and monitored


IDENTIFY

The organization's current cybersecurity risks are understood


PROTECT

Safeguards to manage the organization's cybersecurity risks are used


DETECT

Possible cybersecurity attacks and compromises are found and analyzed


RESPOND

Actions regarding a detected cybersecurity incident are taken


RECOVER

Assets and operations affected by a cybersecurity incident are restored


Ex1

Share the organization's mission (e.g., through vision and mission statements, marketing, and service strategies) to provide a basis for identifying risks that may impede that mission


Ex1

Identify relevant internal stakeholders and their cybersecurity-related expectations (e.g., performance and risk expectations of officers, directors, and advisors; cultural expectations of employees)


Ex2

Identify relevant external stakeholders and their cybersecurity-related expectations (e.g., privacy expectations of customers, business expectations of partnerships, compliance expectations of regulators, ethics expectations of society)


Ex1

Determine a process to track and manage legal and regulatory requirements regarding protection of individuals' information (e.g., Health Insurance Portability and Accountability Act, California Consumer Privacy Act, General Data Protection Regulation)


Ex2

Determine a process to track and manage contractual requirements for cybersecurity management of supplier, customer, and partner information


Ex3

Align the organization's cybersecurity strategy with legal, regulatory, and contractual requirements


Ex1

Establish criteria for determining the criticality of capabilities and services as viewed by internal and external stakeholders


Ex2

Determine (e.g., from a business impact analysis) assets and business operations that are vital to achieving mission objectives and the potential impact of a loss (or partial loss) of such operations


Ex3

Establish and communicate resilience objectives (e.g., recovery time objectives) for delivering critical capabilities and services in various operating states (e.g., under attack, during recovery, normal operation)


Ex1

Create an inventory of the organization's dependencies on external resources (e.g., facilities, cloud-based hosting providers) and their relationships to organizational assets and business functions


Ex2

Identify and document external dependencies that are potential points of failure for the organization's critical capabilities and services, and share that information with appropriate personnel


Ex1

Update near-term and long-term cybersecurity risk management objectives as part of annual strategic planning and when major changes occur


Ex2

Establish measurable objectives for cybersecurity risk management (e.g., manage the quality of user training, ensure adequate risk protection for industrial control systems)


Ex3

Senior leaders agree about cybersecurity objectives and use them for measuring and managing risk and performance


Ex1

Determine and communicate risk appetite statements that convey expectations about the appropriate level of risk for the organization


Ex2

Translate risk appetite statements into specific, measurable, and broadly understandable risk tolerance statements


Ex3

Refine organizational objectives and risk appetite periodically based on known risk exposure and residual risk


Ex1

Aggregate and manage cybersecurity risks alongside other enterprise risks (e.g., compliance, financial, operational, regulatory, reputational, safety)


Ex2

Include cybersecurity risk managers in enterprise risk management planning


Ex3

Establish criteria for escalating cybersecurity risks within enterprise risk management


Ex1

Specify criteria for accepting and avoiding cybersecurity risk for various classifications of data


Ex2

Determine whether to purchase cybersecurity insurance


Ex3

Document conditions under which shared responsibility models are acceptable (e.g., outsourcing certain cybersecurity functions, having a third party perform financial transactions on behalf of the organization, using public cloud-based services)


Ex1

Determine how to update senior executives, directors, and management on the organization's cybersecurity posture at agreed-upon intervals


Ex2

Identify how all departments across the organization - such as management, operations, internal auditors, legal, acquisition, physical security, and HR - will communicate with each other about cybersecurity risks


Ex1

Establish criteria for using a quantitative approach to cybersecurity risk analysis, and specify probability and exposure formulas


Ex2

Create and use templates (e.g., a risk register) to document cybersecurity risk information (e.g., risk description, exposure, treatment, and ownership)


Ex3

Establish criteria for risk prioritization at the appropriate levels within the enterprise


Ex4

Use a consistent list of risk categories to support integrating, aggregating, and comparing cybersecurity risks


Ex1

Define and communicate guidance and methods for identifying opportunities and including them in risk discussions (e.g., strengths, weaknesses, opportunities, and threats [SWOT] analysis)


Ex2

Identify stretch goals and document them


Ex3

Calculate, document, and prioritize positive risks alongside negative risks


Ex1

Leaders (e.g., directors) agree on their roles and responsibilities in developing, implementing, and assessing the organization's cybersecurity strategy


Ex2

Share leaders' expectations regarding a secure and ethical culture, especially when current events present the opportunity to highlight positive or negative examples of cybersecurity risk management


Ex3

Leaders direct the CISO to maintain a comprehensive cybersecurity risk strategy and review and update it at least annually and after major events


Ex4

Conduct reviews to ensure adequate authority and coordination among those responsible for managing cybersecurity risk


Ex1

Document risk management roles and responsibilities in policy


Ex2

Document who is responsible and accountable for cybersecurity risk management activities and how those teams and individuals are to be consulted and informed


Ex3

Include cybersecurity responsibilities and performance requirements in personnel descriptions


Ex4

Document performance goals for personnel with cybersecurity risk management responsibilities, and periodically measure performance to identify areas for improvement


Ex5

Clearly articulate cybersecurity responsibilities within operations, risk functions, and internal audit functions


Ex1

Conduct periodic management reviews to ensure that those given cybersecurity risk management responsibilities have the necessary authority


Ex2

Identify resource allocation and investment in line with risk tolerance and response


Ex3

Provide adequate and sufficient people, process, and technical resources to support the cybersecurity strategy


Ex1

Integrate cybersecurity risk management considerations into human resources processes (e.g., personnel screening, onboarding, change notification, offboarding)


Ex2

Consider cybersecurity knowledge to be a positive factor in hiring, training, and retention decisions


Ex3

Conduct background checks prior to onboarding new personnel for sensitive roles, and periodically repeat background checks for personnel with such roles


Ex4

Define and enforce obligations for personnel to be aware of, adhere to, and uphold security policies as they relate to their roles


Ex1

Create, disseminate, and maintain an understandable, usable risk management policy with statements of management intent, expectations, and direction


Ex2

Periodically review policy and supporting processes and procedures to ensure that they align with risk management strategy objectives and priorities, as well as the high-level direction of the cybersecurity policy


Ex3

Require approval from senior management on policy


Ex4

Communicate cybersecurity risk management policy and supporting processes and procedures across the organization


Ex5

Require personnel to acknowledge receipt of policy when first hired, annually, and whenever policy is updated


Ex1

Update policy based on periodic reviews of cybersecurity risk management results to ensure that policy and supporting processes and procedures adequately maintain risk at an acceptable level


Ex2

Provide a timeline for reviewing changes to the organization's risk environment (e.g., changes in risk or in the organization's mission objectives), and communicate recommended policy updates


Ex3

Update policy to reflect changes in legal and regulatory requirements


Ex4

Update policy to reflect changes in technology (e.g., adoption of artificial intelligence) and changes to the business (e.g., acquisition of a new business, new contract requirements)


Ex1

Measure how well the risk management strategy and risk results have helped leaders make decisions and achieve organizational objectives


Ex2

Examine whether cybersecurity risk strategies that impede operations or innovation should be adjusted


Ex1

Review audit findings to confirm whether the existing cybersecurity strategy has ensured compliance with internal and external requirements


Ex2

Review the performance oversight of those in cybersecurity-related roles to determine whether policy changes are necessary


Ex3

Review strategy in light of cybersecurity incidents


Ex1

Review key performance indicators (KPIs) to ensure that organization-wide policies and procedures achieve objectives


Ex2

Review key risk indicators (KRIs) to identify risks the organization faces, including likelihood and potential impact


Ex3

Collect and communicate metrics on cybersecurity risk management with senior leadership


Ex1

Establish a strategy that expresses the objectives of the cybersecurity supply chain risk management program


Ex2

Develop the cybersecurity supply chain risk management program, including a plan (with milestones), policies, and procedures that guide implementation and improvement of the program, and share the policies and procedures with the organizational stakeholders


Ex3

Develop and implement program processes based on the strategy, objectives, policies, and procedures that are agreed upon and performed by the organizational stakeholders


Ex4

Establish a cross-organizational mechanism that ensures alignment between functions that contribute to cybersecurity supply chain risk management, such as cybersecurity, IT, operations, legal, human resources, and engineering


Ex1

Identify one or more specific roles or positions that will be responsible and accountable for planning, resourcing, and executing cybersecurity supply chain risk management activities


Ex2

Document cybersecurity supply chain risk management roles and responsibilities in policy


Ex3

Create responsibility matrixes to document who will be responsible and accountable for cybersecurity supply chain risk management activities and how those teams and individuals will be consulted and informed


Ex4

Include cybersecurity supply chain risk management responsibilities and performance requirements in personnel descriptions to ensure clarity and improve accountability


Ex5

Document performance goals for personnel with cybersecurity risk management-specific responsibilities, and periodically measure them to demonstrate and improve performance


Ex6

Develop roles and responsibilities for suppliers, customers, and business partners to address shared responsibilities for applicable cybersecurity risks, and integrate them into organizational policies and applicable third-party agreements


Ex7

Internally communicate cybersecurity supply chain risk management roles and responsibilities for third parties


Ex8

Establish rules and protocols for information sharing and reporting processes between the organization and its suppliers


Ex1

Identify areas of alignment and overlap with cybersecurity and enterprise risk management


Ex2

Establish integrated control sets for cybersecurity risk management and cybersecurity supply chain risk management


Ex3

Integrate cybersecurity supply chain risk management into improvement processes


Ex4

Escalate material cybersecurity risks in supply chains to senior management, and address them at the enterprise risk management level


Ex1

Develop criteria for supplier criticality based on, for example, the sensitivity of data processed or possessed by suppliers, the degree of access to the organization's systems, and the importance of the products or services to the organization's mission


Ex2

Keep a record of all suppliers, and prioritize suppliers based on the criticality criteria


Ex1

Establish security requirements for suppliers, products, and services commensurate with their criticality level and potential impact if compromised


Ex2

Include all cybersecurity and supply chain requirements that third parties must follow and how compliance with the requirements may be verified in default contractual language


Ex3

Define the rules and protocols for information sharing between the organization and its suppliers and sub-tier suppliers in agreements


Ex4

Manage risk by including security requirements in agreements based on their criticality and potential impact if compromised


Ex5

Define security requirements in service-level agreements (SLAs) for monitoring suppliers for acceptable security performance throughout the supplier relationship lifecycle


Ex6

Contractually require suppliers to disclose cybersecurity features, functions, and vulnerabilities of their products and services for the life of the product or the term of service


Ex7

Contractually require suppliers to provide and maintain a current component inventory (e.g., software or hardware bill of materials) for critical products


Ex8

Contractually require suppliers to vet their employees and guard against insider threats


Ex9

Contractually require suppliers to provide evidence of performing acceptable security practices through, for example, self-attestation, conformance to known standards, certifications, or inspections


Ex10

Specify in contracts and other agreements the rights and responsibilities of the organization, its suppliers, and their supply chains, with respect to potential cybersecurity risks


Ex1

Perform thorough due diligence on prospective suppliers that is consistent with procurement planning and commensurate with the level of risk, criticality, and complexity of each supplier relationship


Ex2

Assess the suitability of the technology and cybersecurity capabilities and the risk management practices of prospective suppliers


Ex3

Conduct supplier risk assessments against business and applicable cybersecurity requirements


Ex4

Assess the authenticity, integrity, and security of critical products prior to acquisition and use


Ex1

Adjust assessment formats and frequencies based on the third party's reputation and the criticality of the products or services they provide


Ex2

Evaluate third parties' evidence of compliance with contractual cybersecurity requirements, such as self-attestations, warranties, certifications, and other artifacts


Ex3

Monitor critical suppliers to ensure that they are fulfilling their security obligations throughout the supplier relationship lifecycle using a variety of methods and techniques, such as inspections, audits, tests, or other forms of evaluation


Ex4

Monitor critical suppliers, services, and products for changes to their risk profiles, and reevaluate supplier criticality and risk impact accordingly


Ex5

Plan for unexpected supplier and supply chain-related interruptions to ensure business continuity


Ex1

Define and use rules and protocols for reporting incident response and recovery activities and the status between the organization and its suppliers


Ex2

Identify and document the roles and responsibilities of the organization and its suppliers for incident response


Ex3

Include critical suppliers in incident response exercises and simulations


Ex4

Define and coordinate crisis communication methods and protocols between the organization and its critical suppliers


Ex5

Conduct collaborative lessons learned sessions with critical suppliers


Ex1

Policies and procedures require provenance records for all acquired technology products and services


Ex2

Periodically provide risk reporting to leaders about how acquired components are proven to be untampered and authentic


Ex3

Communicate regularly among cybersecurity risk managers and operations personnel about the need to acquire software patches, updates, and upgrades only from authenticated and trustworthy software providers


Ex4

Review policies to ensure that they require approved supplier personnel to perform maintenance on supplier products


Ex5

Policies and procedure require checking upgrades to critical hardware for unauthorized changes


Ex1

Establish processes for terminating critical relationships under both normal and adverse circumstances


Ex2

Define and implement plans for component end-of-life maintenance support and obsolescence


Ex3

Verify that supplier access to organization resources is deactivated promptly when it is no longer needed


Ex4

Verify that assets containing the organization's data are returned or properly disposed of in a timely, controlled, and safe manner


Ex5

Develop and execute a plan for terminating or transitioning supplier relationships that takes supply chain security risk and resiliency into account


Ex6

Mitigate risks to data and systems created by supplier termination


Ex7

Manage data leakage risks associated with supplier termination


Ex1

Maintain inventories for all types of hardware, including IT, IoT, OT, and mobile devices


Ex2

Constantly monitor networks to detect new hardware and automatically update inventories


Ex1

Maintain inventories for all types of software and services, including commercial-off-the-shelf, open-source, custom applications, API services, and cloud-based applications and services


Ex2

Constantly monitor all platforms, including containers and virtual machines, for software and service inventory changes


Ex3

Maintain an inventory of the organization's systems


Ex1

Maintain baselines of communication and data flows within the organization's wired and wireless networks


Ex2

Maintain baselines of communication and data flows between the organization and third parties


Ex3

Maintain baselines of communication and data flows for the organization's infrastructure-as-a-service (IaaS) usage


Ex4

Maintain documentation of expected network ports, protocols, and services that are typically used among authorized systems


Ex1

Inventory all external services used by the organization, including third-party infrastructure-as-a-service (IaaS), platform-as-a-service (PaaS), and software-as-a-service (SaaS) offerings; APIs; and other externally hosted application services


Ex2

Update the inventory when a new external service is going to be utilized to ensure adequate cybersecurity risk management monitoring of the organization's use of that service


Ex1

Define criteria for prioritizing each class of assets


Ex2

Apply the prioritization criteria to assets


Ex3

Track the asset priorities and update them periodically or when significant changes to the organization occur


Ex1

Maintain a list of the designated data types of interest (e.g., personally identifiable information, protected health information, financial account numbers, organization intellectual property, operational technology data)


Ex2

Continuously discover and analyze ad hoc data to identify new instances of designated data types


Ex3

Assign data classifications to designated data types through tags or labels


Ex4

Track the provenance, data owner, and geolocation of each instance of designated data types


Ex1

Integrate cybersecurity considerations throughout the life cycles of systems, hardware, software, and services


Ex2

Integrate cybersecurity considerations into product life cycles


Ex3

Identify unofficial uses of technology to meet mission objectives (i.e., shadow IT)


Ex4

Periodically identify redundant systems, hardware, software, and services that unnecessarily increase the organization's attack surface


Ex5

Properly configure and secure systems, hardware, software, and services prior to their deployment in production


Ex6

Update inventories when systems, hardware, software, and services are moved or transferred within the organization


Ex7

Securely destroy stored data based on the organization's data retention policy using the prescribed destruction method, and keep and manage a record of the destructions


Ex8

Securely sanitize data storage when hardware is being retired, decommissioned, reassigned, or sent for repairs or replacement


Ex9

Offer methods for destroying paper, storage media, and other physical forms of data storage


Ex1

Use vulnerability management technologies to identify unpatched and misconfigured software


Ex2

Assess network and system architectures for design and implementation weaknesses that affect cybersecurity


Ex3

Review, analyze, or test organization-developed software to identify design, coding, and default configuration vulnerabilities


Ex4

Assess facilities that house critical computing assets for physical vulnerabilities and resilience issues


Ex5

Monitor sources of cyber threat intelligence for information on new vulnerabilities in products and services


Ex6

Review processes and procedures for weaknesses that could be exploited to affect cybersecurity


Ex1

Configure cybersecurity tools and technologies with detection or response capabilities to securely ingest cyber threat intelligence feeds


Ex2

Receive and review advisories from reputable third parties on current threat actors and their tactics, techniques, and procedures (TTPs)


Ex3

Monitor sources of cyber threat intelligence for information on the types of vulnerabilities that emerging technologies may have


Ex1

Use cyber threat intelligence to maintain awareness of the types of threat actors likely to target the organization and the TTPs they are likely to use


Ex2

Perform threat hunting to look for signs of threat actors within the environment


Ex3

Implement processes for identifying internal threat actors


Ex1

Business leaders and cybersecurity risk management practitioners work together to estimate the likelihood and impact of risk scenarios and record them in risk registers


Ex2

Enumerate the potential business impacts of unauthorized access to the organization's communications, systems, and data processed in or by those systems


Ex3

Account for the potential impacts of cascading failures for systems of systems


Ex1

Develop threat models to better understand risks to the data and identify appropriate risk responses


Ex2

Prioritize cybersecurity resource allocations and investments based on estimated likelihoods and impacts