Instruction: What is DE.AE-02.293? (Ex4)

Output: Use log analysis tools to generate reports on their findings


Instruction: Explain DE.AE-02.293.

Output: Use log analysis tools to generate reports on their findings


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is DE.AE-03?

Output: Information is correlated from multiple sources


Instruction: Explain the requirement of DE.AE-03.

Output: Information is correlated from multiple sources


Instruction: What outcome is expected by DE.AE-03?

Output: Information is correlated from multiple sources


Instruction: What is DE.AE-03.294? (Ex1)

Output: Constantly transfer log data generated by other sources to a relatively small number of log servers


Instruction: Explain DE.AE-03.294.

Output: Constantly transfer log data generated by other sources to a relatively small number of log servers


Instruction: What is DE.AE-03.295? (Ex2)

Output: Use event correlation technology (e.g., SIEM) to collect information captured by multiple sources


Instruction: Explain DE.AE-03.295.

Output: Use event correlation technology (e.g., SIEM) to collect information captured by multiple sources


Instruction: What is DE.AE-03.296? (Ex3)

Output: Utilize cyber threat intelligence to help correlate events among log sources


Instruction: Explain DE.AE-03.296.

Output: Utilize cyber threat intelligence to help correlate events among log sources


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is DE.AE-04?

Output: The estimated impact and scope of adverse events are understood


Instruction: Explain the requirement of DE.AE-04.

Output: The estimated impact and scope of adverse events are understood


Instruction: What outcome is expected by DE.AE-04?

Output: The estimated impact and scope of adverse events are understood


Instruction: What is DE.AE-04.297? (Ex1)

Output: Use SIEMs or other tools to estimate impact and scope, and review and refine the estimates


Instruction: Explain DE.AE-04.297.

Output: Use SIEMs or other tools to estimate impact and scope, and review and refine the estimates


Instruction: What is DE.AE-04.298? (Ex2)

Output: A person creates their own estimates of impact and scope


Instruction: Explain DE.AE-04.298.

Output: A person creates their own estimates of impact and scope


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is DE.AE-05?

Output: Incident alert thresholds are established


Instruction: Explain the requirement of DE.AE-05.

Output: Incident alert thresholds are established


Instruction: What outcome is expected by DE.AE-05?

Output: Incident alert thresholds are established


Instruction: What is WR-DE.AE-05?

Output: Moved to DE.AE-08


Instruction: Explain WR-DE.AE-05.

Output: Moved to DE.AE-08


Instruction: What is DE.AE-06?

Output: Information on adverse events is provided to authorized staff and tools


Instruction: Explain the requirement of DE.AE-06.

Output: Information on adverse events is provided to authorized staff and tools


Instruction: What outcome is expected by DE.AE-06?

Output: Information on adverse events is provided to authorized staff and tools


Instruction: What is DE.AE-06.299? (Ex1)

Output: Use cybersecurity software to generate alerts and provide them to the security operations center (SOC), incident responders, and incident response tools


Instruction: Explain DE.AE-06.299.

Output: Use cybersecurity software to generate alerts and provide them to the security operations center (SOC), incident responders, and incident response tools


Instruction: What is DE.AE-06.300? (Ex2)

Output: Incident responders and other authorized personnel can access log analysis findings at all times


Instruction: Explain DE.AE-06.300.

Output: Incident responders and other authorized personnel can access log analysis findings at all times


Instruction: What is DE.AE-06.301? (Ex3)

Output: Automatically create and assign tickets in the organization's ticketing system when certain types of alerts occur


Instruction: Explain DE.AE-06.301.

Output: Automatically create and assign tickets in the organization's ticketing system when certain types of alerts occur


Instruction: What is DE.AE-06.302? (Ex4)

Output: Manually create and assign tickets in the organization's ticketing system when technical staff discover indicators of compromise


Instruction: Explain DE.AE-06.302.

Output: Manually create and assign tickets in the organization's ticketing system when technical staff discover indicators of compromise


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is DE.AE-07?

Output: Cyber threat intelligence and other contextual information are integrated into the analysis


Instruction: Explain the requirement of DE.AE-07.

Output: Cyber threat intelligence and other contextual information are integrated into the analysis


Instruction: What outcome is expected by DE.AE-07?

Output: Cyber threat intelligence and other contextual information are integrated into the analysis


Instruction: What is DE.AE-07.303? (Ex1)

Output: Securely provide cyber threat intelligence feeds to detection technologies, processes, and personnel


Instruction: Explain DE.AE-07.303.

Output: Securely provide cyber threat intelligence feeds to detection technologies, processes, and personnel


Instruction: What is DE.AE-07.304? (Ex2)

Output: Securely provide information from asset inventories to detection technologies, processes, and personnel


Instruction: Explain DE.AE-07.304.

Output: Securely provide information from asset inventories to detection technologies, processes, and personnel


Instruction: What is DE.AE-07.305? (Ex3)

Output: Rapidly acquire and analyze vulnerability disclosures for the organization's technologies from suppliers, vendors, and third-party security advisories


Instruction: Explain DE.AE-07.305.

Output: Rapidly acquire and analyze vulnerability disclosures for the organization's technologies from suppliers, vendors, and third-party security advisories


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is DE.AE-08?

Output: Incidents are declared when adverse events meet the defined incident criteria


Instruction: Explain the requirement of DE.AE-08.

Output: Incidents are declared when adverse events meet the defined incident criteria


Instruction: What outcome is expected by DE.AE-08?

Output: Incidents are declared when adverse events meet the defined incident criteria


Instruction: What is DE.AE-08.306? (Ex1)

Output: Apply incident criteria to known and assumed characteristics of activity in order to determine whether an incident should be declared


Instruction: Explain DE.AE-08.306.

Output: Apply incident criteria to known and assumed characteristics of activity in order to determine whether an incident should be declared


Instruction: What is DE.AE-08.307? (Ex2)

Output: Take known false positives into account when applying incident criteria


Instruction: Explain DE.AE-08.307.

Output: Take known false positives into account when applying incident criteria


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is DE.DP-01?

Output: Roles and responsibilities for detection are well defined to ensure accountability


Instruction: Explain the requirement of DE.DP-01.

Output: Roles and responsibilities for detection are well defined to ensure accountability


Instruction: What outcome is expected by DE.DP-01?

Output: Roles and responsibilities for detection are well defined to ensure accountability


Instruction: What is WR-DE.DP-01?

Output: Incorporated into GV.RR-02


Instruction: Explain WR-DE.DP-01.

Output: Incorporated into GV.RR-02


Instruction: What is DE.DP-02?

Output: Detection activities comply with all applicable requirements


Instruction: Explain the requirement of DE.DP-02.

Output: Detection activities comply with all applicable requirements


Instruction: What outcome is expected by DE.DP-02?

Output: Detection activities comply with all applicable requirements


Instruction: What is WR-DE.DP-02?

Output: Incorporated into DE.AE


Instruction: Explain WR-DE.DP-02.

Output: Incorporated into DE.AE


Instruction: What is DE.DP-03?

Output: Detection processes are tested


Instruction: Explain the requirement of DE.DP-03.

Output: Detection processes are tested


Instruction: What outcome is expected by DE.DP-03?

Output: Detection processes are tested


Instruction: What is WR-DE.DP-03?

Output: Incorporated into ID.IM-02


Instruction: Explain WR-DE.DP-03.

Output: Incorporated into ID.IM-02


Instruction: What is DE.DP-04?

Output: Event detection information is communicated


Instruction: Explain the requirement of DE.DP-04.

Output: Event detection information is communicated


Instruction: What outcome is expected by DE.DP-04?

Output: Event detection information is communicated


Instruction: What is WR-DE.DP-04?

Output: Incorporated into DE.AE-06


Instruction: Explain WR-DE.DP-04.

Output: Incorporated into DE.AE-06


Instruction: What is DE.DP-05?

Output: Detection processes are continuously improved


Instruction: Explain the requirement of DE.DP-05.

Output: Detection processes are continuously improved


Instruction: What outcome is expected by DE.DP-05?

Output: Detection processes are continuously improved


Instruction: What is WR-DE.DP-05?

Output: Incorporated into ID.IM, ID.IM-03


Instruction: Explain WR-DE.DP-05.

Output: Incorporated into ID.IM, ID.IM-03


Instruction: What is WR-DE.DP?

Output: Incorporated into other Categories and Functions


Instruction: Explain WR-DE.DP.

Output: Incorporated into other Categories and Functions


Instruction: What is RS? (RESPOND)

Output: Actions regarding a detected cybersecurity incident are taken


Instruction: Summarize the scope of RS.

Output: Actions regarding a detected cybersecurity incident are taken


Instruction: What does RS cover?

Output: Actions regarding a detected cybersecurity incident are taken


Instruction: What is RS.MA? (Incident Management)

Output: Responses to detected cybersecurity incidents are managed


Instruction: Summarize the scope of RS.MA.

Output: Responses to detected cybersecurity incidents are managed


Instruction: What does RS.MA cover?

Output: Responses to detected cybersecurity incidents are managed


Instruction: What is RS.MA-01?

Output: The incident response plan is executed in coordination with relevant third parties once an incident is declared


Instruction: Explain the requirement of RS.MA-01.

Output: The incident response plan is executed in coordination with relevant third parties once an incident is declared


Instruction: What outcome is expected by RS.MA-01?

Output: The incident response plan is executed in coordination with relevant third parties once an incident is declared


Instruction: What is RS.MA-01.308? (Ex1)

Output: Detection technologies automatically report confirmed incidents


Instruction: Explain RS.MA-01.308.

Output: Detection technologies automatically report confirmed incidents


Instruction: What is RS.MA-01.309? (Ex2)

Output: Request incident response assistance from the organization's incident response outsourcer


Instruction: Explain RS.MA-01.309.

Output: Request incident response assistance from the organization's incident response outsourcer


Instruction: What is RS.MA-01.310? (Ex3)

Output: Designate an incident lead for each incident


Instruction: Explain RS.MA-01.310.

Output: Designate an incident lead for each incident


Instruction: What is RS.MA-01.311? (Ex4)

Output: Initiate execution of additional cybersecurity plans as needed to support incident response (for example, business continuity and disaster recovery)


Instruction: Explain RS.MA-01.311.

Output: Initiate execution of additional cybersecurity plans as needed to support incident response (for example, business continuity and disaster recovery)


Instruction: What is third? (3rd)

Output: 3rd Party Risk


Instruction: Explain third.

Output: 3rd Party Risk


Instruction: What is RS.MA-02?

Output: Incident reports are triaged and validated


Instruction: Explain the requirement of RS.MA-02.

Output: Incident reports are triaged and validated


Instruction: What outcome is expected by RS.MA-02?

Output: Incident reports are triaged and validated


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is RS.MA-02.312? (Ex1)

Output: Preliminarily review incident reports to confirm that they are cybersecurity-related and necessitate incident response activities


Instruction: Explain RS.MA-02.312.

Output: Preliminarily review incident reports to confirm that they are cybersecurity-related and necessitate incident response activities


Instruction: What is RS.MA-02.313? (Ex2)

Output: Apply criteria to estimate the severity of an incident


Instruction: Explain RS.MA-02.313.

Output: Apply criteria to estimate the severity of an incident


Instruction: What is RS.MA-03?

Output: Incidents are categorized and prioritized


Instruction: Explain the requirement of RS.MA-03.

Output: Incidents are categorized and prioritized


Instruction: What outcome is expected by RS.MA-03?

Output: Incidents are categorized and prioritized


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is RS.MA-03.314? (Ex1)

Output: Further review and categorize incidents based on the type of incident (e.g., data breach, ransomware, DDoS, account compromise)


Instruction: Explain RS.MA-03.314.

Output: Further review and categorize incidents based on the type of incident (e.g., data breach, ransomware, DDoS, account compromise)


Instruction: What is RS.MA-03.315? (Ex2)

Output: Prioritize incidents based on their scope, likely impact, and time-critical nature


Instruction: Explain RS.MA-03.315.

Output: Prioritize incidents based on their scope, likely impact, and time-critical nature


Instruction: What is RS.MA-03.316? (Ex3)

Output: Select incident response strategies for active incidents by balancing the need to quickly recover from an incident with the need to observe the attacker or conduct a more thorough investigation


Instruction: Explain RS.MA-03.316.

Output: Select incident response strategies for active incidents by balancing the need to quickly recover from an incident with the need to observe the attacker or conduct a more thorough investigation


Instruction: What is RS.MA-04?

Output: Incidents are escalated or elevated as needed


Instruction: Explain the requirement of RS.MA-04.

Output: Incidents are escalated or elevated as needed


Instruction: What outcome is expected by RS.MA-04?

Output: Incidents are escalated or elevated as needed


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is RS.MA-04.317? (Ex1)

Output: Track and validate the status of all ongoing incidents


Instruction: Explain RS.MA-04.317.

Output: Track and validate the status of all ongoing incidents


Instruction: What is RS.MA-04.318? (Ex2)

Output: Coordinate incident escalation or elevation with designated internal and external stakeholders


Instruction: Explain RS.MA-04.318.

Output: Coordinate incident escalation or elevation with designated internal and external stakeholders


Instruction: What is RS.MA-05?

Output: The criteria for initiating incident recovery are applied


Instruction: Explain the requirement of RS.MA-05.

Output: The criteria for initiating incident recovery are applied


Instruction: What outcome is expected by RS.MA-05?

Output: The criteria for initiating incident recovery are applied


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is RS.MA-05.319? (Ex1)

Output: Apply incident recovery criteria to known and assumed characteristics of the incident to determine whether incident recovery processes should be initiated


Instruction: Explain RS.MA-05.319.

Output: Apply incident recovery criteria to known and assumed characteristics of the incident to determine whether incident recovery processes should be initiated


Instruction: What is RS.MA-05.320? (Ex2)

Output: Take the possible operational disruption of incident recovery activities into account


Instruction: Explain RS.MA-05.320.

Output: Take the possible operational disruption of incident recovery activities into account


Instruction: What is RS.AN? (Incident Analysis)

Output: Investigations are conducted to ensure effective response and support forensics and recovery activities


Instruction: Summarize the scope of RS.AN.

Output: Investigations are conducted to ensure effective response and support forensics and recovery activities


Instruction: What does RS.AN cover?

Output: Investigations are conducted to ensure effective response and support forensics and recovery activities


Instruction: What is RS.AN-01?

Output: Notifications from detection systems are investigated


Instruction: Explain the requirement of RS.AN-01.

Output: Notifications from detection systems are investigated


Instruction: What outcome is expected by RS.AN-01?

Output: Notifications from detection systems are investigated


Instruction: What is WR-RS.AN-01?

Output: Incorporated into RS.MA-02


Instruction: Explain WR-RS.AN-01.

Output: Incorporated into RS.MA-02


Instruction: What is RS.AN-02?

Output: The impact of the incident is understood


Instruction: Explain the requirement of RS.AN-02.

Output: The impact of the incident is understood


Instruction: What outcome is expected by RS.AN-02?

Output: The impact of the incident is understood


Instruction: What is WR-RS.AN-02?

Output: Incorporated into RS.MA-02, RS.MA-03, RS.MA-04


Instruction: Explain WR-RS.AN-02.

Output: Incorporated into RS.MA-02, RS.MA-03, RS.MA-04


Instruction: What is RS.AN-03?

Output: Analysis is performed to establish what has taken place during an incident and the root cause of the incident


Instruction: Explain the requirement of RS.AN-03.

Output: Analysis is performed to establish what has taken place during an incident and the root cause of the incident


Instruction: What outcome is expected by RS.AN-03?

Output: Analysis is performed to establish what has taken place during an incident and the root cause of the incident


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is RS.AN-03.321? (Ex1)

Output: Determine the sequence of events that occurred during the incident and which assets and resources were involved in each event


Instruction: Explain RS.AN-03.321.

Output: Determine the sequence of events that occurred during the incident and which assets and resources were involved in each event


Instruction: What is RS.AN-03.322? (Ex2)

Output: Attempt to determine what vulnerabilities, threats, and threat actors were directly or indirectly involved in the incident


Instruction: Explain RS.AN-03.322.

Output: Attempt to determine what vulnerabilities, threats, and threat actors were directly or indirectly involved in the incident


Instruction: What is RS.AN-03.323? (Ex3)

Output: Analyze the incident to find the underlying, systemic root causes


Instruction: Explain RS.AN-03.323.

Output: Analyze the incident to find the underlying, systemic root causes


Instruction: What is RS.AN-03.324? (Ex4)

Output: Check any cyber deception technology for additional information on attacker behavior


Instruction: Explain RS.AN-03.324.

Output: Check any cyber deception technology for additional information on attacker behavior


Instruction: What is RS.AN-04?

Output: Incidents are categorized consistent with response plans


Instruction: Explain the requirement of RS.AN-04.

Output: Incidents are categorized consistent with response plans


Instruction: What outcome is expected by RS.AN-04?

Output: Incidents are categorized consistent with response plans


Instruction: What is WR-RS.AN-04?

Output: Moved to RS.MA-03


Instruction: Explain WR-RS.AN-04.

Output: Moved to RS.MA-03


Instruction: What is RS.AN-05?

Output: Processes are established to receive, analyze and respond to vulnerabilities disclosed to the organization from internal and external sources (e.g. internal testing, security bulletins, or security researchers)


Instruction: Explain the requirement of RS.AN-05.

Output: Processes are established to receive, analyze and respond to vulnerabilities disclosed to the organization from internal and external sources (e.g. internal testing, security bulletins, or security researchers)


Instruction: What outcome is expected by RS.AN-05?

Output: Processes are established to receive, analyze and respond to vulnerabilities disclosed to the organization from internal and external sources (e.g. internal testing, security bulletins, or security researchers)


Instruction: What is WR-RS.AN-05?

Output: Moved to ID.RA-08


Instruction: Explain WR-RS.AN-05.

Output: Moved to ID.RA-08


Instruction: What is RS.AN-06?

Output: Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved


Instruction: Explain the requirement of RS.AN-06.

Output: Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved


Instruction: What outcome is expected by RS.AN-06?

Output: Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is RS.AN-06.325? (Ex1)

Output: Require each incident responder and others (e.g., system administrators, cybersecurity engineers) who perform incident response tasks to record their actions and make the record immutable


Instruction: Explain RS.AN-06.325.

Output: Require each incident responder and others (e.g., system administrators, cybersecurity engineers) who perform incident response tasks to record their actions and make the record immutable


Instruction: What is RS.AN-06.326? (Ex2)

Output: Require the incident lead to document the incident in detail and be responsible for preserving the integrity of the documentation and the sources of all information being reported


Instruction: Explain RS.AN-06.326.

Output: Require the incident lead to document the incident in detail and be responsible for preserving the integrity of the documentation and the sources of all information being reported


Instruction: What is RS.AN-07?

Output: Incident data and metadata are collected, and their integrity and provenance are preserved


Instruction: Explain the requirement of RS.AN-07.

Output: Incident data and metadata are collected, and their integrity and provenance are preserved


Instruction: What outcome is expected by RS.AN-07?

Output: Incident data and metadata are collected, and their integrity and provenance are preserved


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is RS.AN-07.327? (Ex1)

Output: Collect, preserve, and safeguard the integrity of all pertinent incident data and metadata (e.g., data source, date/time of collection) based on evidence preservation and chain-of-custody procedures


Instruction: Explain RS.AN-07.327.

Output: Collect, preserve, and safeguard the integrity of all pertinent incident data and metadata (e.g., data source, date/time of collection) based on evidence preservation and chain-of-custody procedures


Instruction: What is RS.AN-08?

Output: An incident's magnitude is estimated and validated


Instruction: Explain the requirement of RS.AN-08.

Output: An incident's magnitude is estimated and validated


Instruction: What outcome is expected by RS.AN-08?

Output: An incident's magnitude is estimated and validated


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is RS.AN-08.328? (Ex1)

Output: Review other potential targets of the incident to search for indicators of compromise and evidence of persistence


Instruction: Explain RS.AN-08.328.

Output: Review other potential targets of the incident to search for indicators of compromise and evidence of persistence


Instruction: What is RS.AN-08.329? (Ex2)

Output: Automatically run tools on targets to look for indicators of compromise and evidence of persistence


Instruction: Explain RS.AN-08.329.

Output: Automatically run tools on targets to look for indicators of compromise and evidence of persistence


Instruction: What is RS.CO? (Incident Response Reporting and Communication)

Output: Response activities are coordinated with internal and external stakeholders as required by laws, regulations, or policies


Instruction: Summarize the scope of RS.CO.

Output: Response activities are coordinated with internal and external stakeholders as required by laws, regulations, or policies


Instruction: What does RS.CO cover?

Output: Response activities are coordinated with internal and external stakeholders as required by laws, regulations, or policies


Instruction: What is RS.CO-01?

Output: Personnel know their roles and order of operations when a response is needed


Instruction: Explain the requirement of RS.CO-01.

Output: Personnel know their roles and order of operations when a response is needed


Instruction: What outcome is expected by RS.CO-01?

Output: Personnel know their roles and order of operations when a response is needed


Instruction: What is WR-RS.CO-01?

Output: Incorporated into PR.AT-01


Instruction: Explain WR-RS.CO-01.

Output: Incorporated into PR.AT-01


Instruction: What is RS.CO-02?

Output: Internal and external stakeholders are notified of incidents


Instruction: Explain the requirement of RS.CO-02.

Output: Internal and external stakeholders are notified of incidents


Instruction: What outcome is expected by RS.CO-02?

Output: Internal and external stakeholders are notified of incidents


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is third? (3rd)

Output: 3rd Party Risk


Instruction: Explain third.

Output: 3rd Party Risk


Instruction: What is RS.CO-02.330? (Ex1)

Output: Follow the organization's breach notification procedures after discovering a data breach incident, including notifying affected customers


Instruction: Explain RS.CO-02.330.

Output: Follow the organization's breach notification procedures after discovering a data breach incident, including notifying affected customers


Instruction: What is RS.CO-02.331? (Ex2)

Output: Notify business partners and customers of incidents in accordance with contractual requirements


Instruction: Explain RS.CO-02.331.

Output: Notify business partners and customers of incidents in accordance with contractual requirements


Instruction: What is RS.CO-02.332? (Ex3)

Output: Notify law enforcement agencies and regulatory bodies of incidents based on criteria in the incident response plan and management approval


Instruction: Explain RS.CO-02.332.

Output: Notify law enforcement agencies and regulatory bodies of incidents based on criteria in the incident response plan and management approval


Instruction: What is RS.CO-03?

Output: Information is shared with designated internal and external stakeholders


Instruction: Explain the requirement of RS.CO-03.

Output: Information is shared with designated internal and external stakeholders


Instruction: What outcome is expected by RS.CO-03?

Output: Information is shared with designated internal and external stakeholders


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is third? (3rd)

Output: 3rd Party Risk


Instruction: Explain third.

Output: 3rd Party Risk


Instruction: What is RS.CO-03.333? (Ex1)

Output: Securely share information consistent with response plans and information sharing agreements


Instruction: Explain RS.CO-03.333.

Output: Securely share information consistent with response plans and information sharing agreements


Instruction: What is RS.CO-03.334? (Ex2)

Output: Voluntarily share information about an attacker's observed TTPs, with all sensitive data removed, with an Information Sharing and Analysis Center (ISAC)


Instruction: Explain RS.CO-03.334.

Output: Voluntarily share information about an attacker's observed TTPs, with all sensitive data removed, with an Information Sharing and Analysis Center (ISAC)


Instruction: What is RS.CO-03.335? (Ex3)

Output: Notify HR when malicious insider activity occurs


Instruction: Explain RS.CO-03.335.

Output: Notify HR when malicious insider activity occurs


Instruction: What is RS.CO-03.336? (Ex4)

Output: Regularly update senior leadership on the status of major incidents


Instruction: Explain RS.CO-03.336.

Output: Regularly update senior leadership on the status of major incidents


Instruction: What is RS.CO-03.337? (Ex5)

Output: Follow the rules and protocols defined in contracts for incident information sharing between the organization and its suppliers


Instruction: Explain RS.CO-03.337.

Output: Follow the rules and protocols defined in contracts for incident information sharing between the organization and its suppliers


Instruction: What is RS.CO-03.338? (Ex6)

Output: Coordinate crisis communication methods between the organization and its critical suppliers


Instruction: Explain RS.CO-03.338.

Output: Coordinate crisis communication methods between the organization and its critical suppliers


Instruction: What is RS.CO-04?

Output: Coordination with stakeholders occurs consistent with response plans


Instruction: Explain the requirement of RS.CO-04.

Output: Coordination with stakeholders occurs consistent with response plans


Instruction: What outcome is expected by RS.CO-04?

Output: Coordination with stakeholders occurs consistent with response plans


Instruction: What is WR-RS.CO-04?

Output: Incorporated into RS.MA-01, RS.MA-04


Instruction: Explain WR-RS.CO-04.

Output: Incorporated into RS.MA-01, RS.MA-04


Instruction: What is RS.CO-05?

Output: Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness


Instruction: Explain the requirement of RS.CO-05.

Output: Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness


Instruction: What outcome is expected by RS.CO-05?

Output: Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness


Instruction: What is WR-RS.CO-05?

Output: Incorporated into RS.CO-03


Instruction: Explain WR-RS.CO-05.

Output: Incorporated into RS.CO-03


Instruction: What is RS.MI? (Incident Mitigation)

Output: Activities are performed to prevent expansion of an event and mitigate its effects


Instruction: Summarize the scope of RS.MI.

Output: Activities are performed to prevent expansion of an event and mitigate its effects


Instruction: What does RS.MI cover?

Output: Activities are performed to prevent expansion of an event and mitigate its effects


Instruction: What is RS.MI-01?

Output: Incidents are contained


Instruction: Explain the requirement of RS.MI-01.

Output: Incidents are contained


Instruction: What outcome is expected by RS.MI-01?

Output: Incidents are contained


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is third? (3rd)

Output: 3rd Party Risk


Instruction: Explain third.

Output: 3rd Party Risk


Instruction: What is RS.MI-01.339? (Ex1)

Output: Cybersecurity technologies (e.g., antivirus software) and cybersecurity features of other technologies (e.g., operating systems, network infrastructure devices) automatically perform containment actions


Instruction: Explain RS.MI-01.339.

Output: Cybersecurity technologies (e.g., antivirus software) and cybersecurity features of other technologies (e.g., operating systems, network infrastructure devices) automatically perform containment actions


Instruction: What is RS.MI-01.340? (Ex2)

Output: Allow incident responders to manually select and perform containment actions


Instruction: Explain RS.MI-01.340.

Output: Allow incident responders to manually select and perform containment actions


Instruction: What is RS.MI-01.341? (Ex3)

Output: Allow a third party (e.g., internet service provider, managed security service provider) to perform containment actions on behalf of the organization


Instruction: Explain RS.MI-01.341.

Output: Allow a third party (e.g., internet service provider, managed security service provider) to perform containment actions on behalf of the organization


Instruction: What is RS.MI-01.342? (Ex4)

Output: Automatically transfer compromised endpoints to a remediation virtual local area network (VLAN)


Instruction: Explain RS.MI-01.342.

Output: Automatically transfer compromised endpoints to a remediation virtual local area network (VLAN)


Instruction: What is RS.MI-02?

Output: Incidents are eradicated


Instruction: Explain the requirement of RS.MI-02.

Output: Incidents are eradicated


Instruction: What outcome is expected by RS.MI-02?

Output: Incidents are eradicated


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is third? (3rd)

Output: 3rd Party Risk


Instruction: Explain third.

Output: 3rd Party Risk


Instruction: What is RS.MI-02.343? (Ex1)

Output: Cybersecurity technologies and cybersecurity features of other technologies (e.g., operating systems, network infrastructure devices) automatically perform eradication actions


Instruction: Explain RS.MI-02.343.

Output: Cybersecurity technologies and cybersecurity features of other technologies (e.g., operating systems, network infrastructure devices) automatically perform eradication actions


Instruction: What is RS.MI-02.344? (Ex2)

Output: Allow incident responders to manually select and perform eradication actions


Instruction: Explain RS.MI-02.344.

Output: Allow incident responders to manually select and perform eradication actions


Instruction: What is RS.MI-02.345? (Ex3)

Output: Allow a third party (e.g., managed security service provider) to perform eradication actions on behalf of the organization


Instruction: Explain RS.MI-02.345.

Output: Allow a third party (e.g., managed security service provider) to perform eradication actions on behalf of the organization


Instruction: What is RS.MI-03?

Output: Newly identified vulnerabilities are mitigated or documented as accepted risks


Instruction: Explain the requirement of RS.MI-03.

Output: Newly identified vulnerabilities are mitigated or documented as accepted risks


Instruction: What outcome is expected by RS.MI-03?

Output: Newly identified vulnerabilities are mitigated or documented as accepted risks


Instruction: What is WR-RS.MI-03?

Output: Incorporated into ID.RA-06


Instruction: Explain WR-RS.MI-03.

Output: Incorporated into ID.RA-06


Instruction: What is RS.RP-01?

Output: Response plan is executed during or after an incident


Instruction: Explain the requirement of RS.RP-01.

Output: Response plan is executed during or after an incident


Instruction: What outcome is expected by RS.RP-01?

Output: Response plan is executed during or after an incident


Instruction: What is WR-RS.RP-01?

Output: Incorporated into RS.MA-01


Instruction: Explain WR-RS.RP-01.

Output: Incorporated into RS.MA-01


Instruction: What is WR-RS.RP?

Output: Incorporated into RS.MA


Instruction: Explain WR-RS.RP.

Output: Incorporated into RS.MA


Instruction: What is RS.IM-01?

Output: Response plans incorporate lessons learned


Instruction: Explain the requirement of RS.IM-01.

Output: Response plans incorporate lessons learned


Instruction: What outcome is expected by RS.IM-01?

Output: Response plans incorporate lessons learned


Instruction: What is WR-RS.IM-01?

Output: Incorporated into ID.IM-03, ID.IM-04


Instruction: Explain WR-RS.IM-01.

Output: Incorporated into ID.IM-03, ID.IM-04


Instruction: What is RS.IM-02?

Output: Response strategies are updated


Instruction: Explain the requirement of RS.IM-02.

Output: Response strategies are updated


Instruction: What outcome is expected by RS.IM-02?

Output: Response strategies are updated


Instruction: What is WR-RS.IM-02?

Output: Incorporated into ID.IM-03


Instruction: Explain WR-RS.IM-02.

Output: Incorporated into ID.IM-03


Instruction: What is WR-RS.IM?

Output: Incorporated into ID.IM


Instruction: Explain WR-RS.IM.

Output: Incorporated into ID.IM


Instruction: What is RC? (RECOVER)

Output: Assets and operations affected by a cybersecurity incident are restored


Instruction: Summarize the scope of RC.

Output: Assets and operations affected by a cybersecurity incident are restored


Instruction: What does RC cover?

Output: Assets and operations affected by a cybersecurity incident are restored


Instruction: What is RC.RP? (Incident Recovery Plan Execution)

Output: Restoration activities are performed to ensure operational availability of systems and services affected by cybersecurity incidents


Instruction: Summarize the scope of RC.RP.

Output: Restoration activities are performed to ensure operational availability of systems and services affected by cybersecurity incidents


Instruction: What does RC.RP cover?

Output: Restoration activities are performed to ensure operational availability of systems and services affected by cybersecurity incidents


Instruction: What is RC.RP-01?

Output: The recovery portion of the incident response plan is executed once initiated from the incident response process


Instruction: Explain the requirement of RC.RP-01.

Output: The recovery portion of the incident response plan is executed once initiated from the incident response process


Instruction: What outcome is expected by RC.RP-01?

Output: The recovery portion of the incident response plan is executed once initiated from the incident response process


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is RC.RP-01.346? (Ex1)

Output: Begin recovery procedures during or after incident response processes


Instruction: Explain RC.RP-01.346.

Output: Begin recovery procedures during or after incident response processes


Instruction: What is RC.RP-01.347? (Ex2)

Output: Make all individuals with recovery responsibilities aware of the plans for recovery and the authorizations required to implement each aspect of the plans


Instruction: Explain RC.RP-01.347.

Output: Make all individuals with recovery responsibilities aware of the plans for recovery and the authorizations required to implement each aspect of the plans


Instruction: What is RC.RP-02?

Output: Recovery actions are selected, scoped, prioritized, and performed


Instruction: Explain the requirement of RC.RP-02.

Output: Recovery actions are selected, scoped, prioritized, and performed


Instruction: What outcome is expected by RC.RP-02?

Output: Recovery actions are selected, scoped, prioritized, and performed


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is RC.RP-02.348? (Ex1)

Output: Select recovery actions based on the criteria defined in the incident response plan and available resources


Instruction: Explain RC.RP-02.348.

Output: Select recovery actions based on the criteria defined in the incident response plan and available resources


Instruction: What is RC.RP-02.349? (Ex2)

Output: Change planned recovery actions based on a reassessment of organizational needs and resources


Instruction: Explain RC.RP-02.349.

Output: Change planned recovery actions based on a reassessment of organizational needs and resources


Instruction: What is RC.RP-03?

Output: The integrity of backups and other restoration assets is verified before using them for restoration


Instruction: Explain the requirement of RC.RP-03.

Output: The integrity of backups and other restoration assets is verified before using them for restoration


Instruction: What outcome is expected by RC.RP-03?

Output: The integrity of backups and other restoration assets is verified before using them for restoration


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is RC.RP-03.350? (Ex1)

Output: Check restoration assets for indicators of compromise, file corruption, and other integrity issues before use


Instruction: Explain RC.RP-03.350.

Output: Check restoration assets for indicators of compromise, file corruption, and other integrity issues before use


Instruction: What is RC.RP-04?

Output: Critical mission functions and cybersecurity risk management are considered to establish post-incident operational norms


Instruction: Explain the requirement of RC.RP-04.

Output: Critical mission functions and cybersecurity risk management are considered to establish post-incident operational norms


Instruction: What outcome is expected by RC.RP-04?

Output: Critical mission functions and cybersecurity risk management are considered to establish post-incident operational norms


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is RC.RP-04.351? (Ex1)

Output: Use business impact and system categorization records (including service delivery objectives) to validate that essential services are restored in the appropriate order


Instruction: Explain RC.RP-04.351.

Output: Use business impact and system categorization records (including service delivery objectives) to validate that essential services are restored in the appropriate order


Instruction: What is RC.RP-04.352? (Ex2)

Output: Work with system owners to confirm the successful restoration of systems and the return to normal operations


Instruction: Explain RC.RP-04.352.

Output: Work with system owners to confirm the successful restoration of systems and the return to normal operations


Instruction: What is RC.RP-04.353? (Ex3)

Output: Monitor the performance of restored systems to verify the adequacy of the restoration


Instruction: Explain RC.RP-04.353.

Output: Monitor the performance of restored systems to verify the adequacy of the restoration


Instruction: What is RC.RP-05?

Output: The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed


Instruction: Explain the requirement of RC.RP-05.

Output: The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed


Instruction: What outcome is expected by RC.RP-05?

Output: The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is RC.RP-05.354? (Ex1)

Output: Check restored assets for indicators of compromise and remediation of root causes of the incident before production use


Instruction: Explain RC.RP-05.354.

Output: Check restored assets for indicators of compromise and remediation of root causes of the incident before production use


Instruction: What is RC.RP-05.355? (Ex2)

Output: Verify the correctness and adequacy of the restoration actions taken before putting a restored system online


Instruction: Explain RC.RP-05.355.

Output: Verify the correctness and adequacy of the restoration actions taken before putting a restored system online


Instruction: What is RC.RP-06?

Output: The end of incident recovery is declared based on criteria, and incident-related documentation is completed


Instruction: Explain the requirement of RC.RP-06.

Output: The end of incident recovery is declared based on criteria, and incident-related documentation is completed


Instruction: What outcome is expected by RC.RP-06?

Output: The end of incident recovery is declared based on criteria, and incident-related documentation is completed


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is RC.RP-06.356? (Ex1)

Output: Prepare an after-action report that documents the incident itself, the response and recovery actions taken, and lessons learned


Instruction: Explain RC.RP-06.356.

Output: Prepare an after-action report that documents the incident itself, the response and recovery actions taken, and lessons learned


Instruction: What is RC.RP-06.357? (Ex2)

Output: Declare the end of incident recovery once the criteria are met


Instruction: Explain RC.RP-06.357.

Output: Declare the end of incident recovery once the criteria are met


Instruction: What is RC.CO? (Incident Recovery Communication)

Output: Restoration activities are coordinated with internal and external parties


Instruction: Summarize the scope of RC.CO.

Output: Restoration activities are coordinated with internal and external parties


Instruction: What does RC.CO cover?

Output: Restoration activities are coordinated with internal and external parties


Instruction: What is RC.CO-01?

Output: Public relations are managed


Instruction: Explain the requirement of RC.CO-01.

Output: Public relations are managed


Instruction: What outcome is expected by RC.CO-01?

Output: Public relations are managed


Instruction: What is WR-RC.CO-01?

Output: Incorporated into RC.CO-04


Instruction: Explain WR-RC.CO-01.

Output: Incorporated into RC.CO-04


Instruction: What is RC.CO-02?

Output: Reputation is repaired after an incident


Instruction: Explain the requirement of RC.CO-02.

Output: Reputation is repaired after an incident


Instruction: What outcome is expected by RC.CO-02?

Output: Reputation is repaired after an incident


Instruction: What is WR-RC.CO-02?

Output: Incorporated into RC.CO-04


Instruction: Explain WR-RC.CO-02.

Output: Incorporated into RC.CO-04


Instruction: What is RC.CO-03?

Output: Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders


Instruction: Explain the requirement of RC.CO-03.

Output: Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders


Instruction: What outcome is expected by RC.CO-03?

Output: Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is third? (3rd)

Output: 3rd Party Risk


Instruction: Explain third.

Output: 3rd Party Risk


Instruction: What is RC.CO-03.358? (Ex1)

Output: Securely share recovery information, including restoration progress, consistent with response plans and information sharing agreements


Instruction: Explain RC.CO-03.358.

Output: Securely share recovery information, including restoration progress, consistent with response plans and information sharing agreements


Instruction: What is RC.CO-03.359? (Ex2)

Output: Regularly update senior leadership on recovery status and restoration progress for major incidents


Instruction: Explain RC.CO-03.359.

Output: Regularly update senior leadership on recovery status and restoration progress for major incidents


Instruction: What is RC.CO-03.360? (Ex3)

Output: Follow the rules and protocols defined in contracts for incident information sharing between the organization and its suppliers


Instruction: Explain RC.CO-03.360.

Output: Follow the rules and protocols defined in contracts for incident information sharing between the organization and its suppliers


Instruction: What is RC.CO-03.361? (Ex4)

Output: Coordinate crisis communication between the organization and its critical suppliers


Instruction: Explain RC.CO-03.361.

Output: Coordinate crisis communication between the organization and its critical suppliers


Instruction: What is RC.CO-04?

Output: Public updates on incident recovery are shared using approved methods and messaging


Instruction: Explain the requirement of RC.CO-04.

Output: Public updates on incident recovery are shared using approved methods and messaging


Instruction: What outcome is expected by RC.CO-04?

Output: Public updates on incident recovery are shared using approved methods and messaging


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is RC.CO-04.362? (Ex1)

Output: Follow the organization's breach notification procedures for recovering from a data breach incident


Instruction: Explain RC.CO-04.362.

Output: Follow the organization's breach notification procedures for recovering from a data breach incident


Instruction: What is RC.CO-04.363? (Ex2)

Output: Explain the steps being taken to recover from the incident and to prevent a recurrence


Instruction: Explain RC.CO-04.363.

Output: Explain the steps being taken to recover from the incident and to prevent a recurrence


Instruction: What is RC.IM-01?

Output: Recovery plans incorporate lessons learned


Instruction: Explain the requirement of RC.IM-01.

Output: Recovery plans incorporate lessons learned


Instruction: What outcome is expected by RC.IM-01?

Output: Recovery plans incorporate lessons learned


Instruction: What is WR-RC.IM-01?

Output: Incorporated into ID.IM-03, ID.IM-04


Instruction: Explain WR-RC.IM-01.

Output: Incorporated into ID.IM-03, ID.IM-04


Instruction: What is RC.IM-02?

Output: Recovery strategies are updated


Instruction: Explain the requirement of RC.IM-02.

Output: Recovery strategies are updated


Instruction: What outcome is expected by RC.IM-02?

Output: Recovery strategies are updated


Instruction: What is WR-RC.IM-02?

Output: Incorporated into ID.IM-03


Instruction: Explain WR-RC.IM-02.

Output: Incorporated into ID.IM-03


Instruction: What is WR-RC.IM?

Output: Incorporated into ID.IM


Instruction: Explain WR-RC.IM.

Output: Incorporated into ID.IM


Instruction: What is GV.OC? (Organizational Context)

Output: The circumstances - mission, stakeholder expectations, dependencies, and legal, regulatory, and contractual requirements - surrounding the organization's cybersecurity risk management decisions are understood


Instruction: Summarize the scope of GV.OC.

Output: The circumstances - mission, stakeholder expectations, dependencies, and legal, regulatory, and contractual requirements - surrounding the organization's cybersecurity risk management decisions are understood


Instruction: What does GV.OC cover?

Output: The circumstances - mission, stakeholder expectations, dependencies, and legal, regulatory, and contractual requirements - surrounding the organization's cybersecurity risk management decisions are understood


Instruction: What is GV.RM? (Risk Management Strategy)

Output: The organization's priorities, constraints, risk tolerance and appetite statements, and assumptions are established, communicated, and used to support operational risk decisions


Instruction: Summarize the scope of GV.RM.

Output: The organization's priorities, constraints, risk tolerance and appetite statements, and assumptions are established, communicated, and used to support operational risk decisions


Instruction: What does GV.RM cover?

Output: The organization's priorities, constraints, risk tolerance and appetite statements, and assumptions are established, communicated, and used to support operational risk decisions


Instruction: What is GV.RR? (Roles, Responsibilities, and Authorities)

Output: Cybersecurity roles, responsibilities, and authorities to foster accountability, performance assessment, and continuous improvement are established and communicated


Instruction: Summarize the scope of GV.RR.

Output: Cybersecurity roles, responsibilities, and authorities to foster accountability, performance assessment, and continuous improvement are established and communicated


Instruction: What does GV.RR cover?

Output: Cybersecurity roles, responsibilities, and authorities to foster accountability, performance assessment, and continuous improvement are established and communicated


Instruction: What is GV.PO? (Policy)

Output: Organizational cybersecurity policy is established, communicated, and enforced


Instruction: Summarize the scope of GV.PO.

Output: Organizational cybersecurity policy is established, communicated, and enforced


Instruction: What does GV.PO cover?

Output: Organizational cybersecurity policy is established, communicated, and enforced


Instruction: What is GV.OV? (Oversight)

Output: Results of organization-wide cybersecurity risk management activities and performance are used to inform, improve, and adjust the risk management strategy


Instruction: Summarize the scope of GV.OV.

Output: Results of organization-wide cybersecurity risk management activities and performance are used to inform, improve, and adjust the risk management strategy


Instruction: What does GV.OV cover?

Output: Results of organization-wide cybersecurity risk management activities and performance are used to inform, improve, and adjust the risk management strategy


Instruction: What is GV.SC? (Cybersecurity Supply Chain Risk Management)

Output: Cyber supply chain risk management processes are identified, established, managed, monitored, and improved by organizational stakeholders


Instruction: Summarize the scope of GV.SC.

Output: Cyber supply chain risk management processes are identified, established, managed, monitored, and improved by organizational stakeholders


Instruction: What does GV.SC cover?

Output: Cyber supply chain risk management processes are identified, established, managed, monitored, and improved by organizational stakeholders


Instruction: What is ID.AM? (Asset Management)

Output: Assets (e.g., data, hardware, software, systems, facilities, services, people) that enable the organization to achieve business purposes are identified and managed consistent with their relative importance to organizational objectives and the organization's risk strategy


Instruction: Summarize the scope of ID.AM.

Output: Assets (e.g., data, hardware, software, systems, facilities, services, people) that enable the organization to achieve business purposes are identified and managed consistent with their relative importance to organizational objectives and the organization's risk strategy


Instruction: What does ID.AM cover?

Output: Assets (e.g., data, hardware, software, systems, facilities, services, people) that enable the organization to achieve business purposes are identified and managed consistent with their relative importance to organizational objectives and the organization's risk strategy


Instruction: What is ID.RA? (Risk Assessment)

Output: The cybersecurity risk to the organization, assets, and individuals is understood by the organization


Instruction: Summarize the scope of ID.RA.

Output: The cybersecurity risk to the organization, assets, and individuals is understood by the organization


Instruction: What does ID.RA cover?

Output: The cybersecurity risk to the organization, assets, and individuals is understood by the organization


Instruction: What is ID.IM? (Improvement)

Output: Improvements to organizational cybersecurity risk management processes, procedures and activities are identified across all CSF Functions


Instruction: Summarize the scope of ID.IM.

Output: Improvements to organizational cybersecurity risk management processes, procedures and activities are identified across all CSF Functions


Instruction: What does ID.IM cover?

Output: Improvements to organizational cybersecurity risk management processes, procedures and activities are identified across all CSF Functions


Instruction: What is PR.AA? (Identity Management, Authentication, and Access Control)

Output: Access to physical and logical assets is limited to authorized users, services, and hardware and  managed commensurate with the assessed risk of unauthorized access


Instruction: Summarize the scope of PR.AA.

Output: Access to physical and logical assets is limited to authorized users, services, and hardware and  managed commensurate with the assessed risk of unauthorized access


Instruction: What does PR.AA cover?

Output: Access to physical and logical assets is limited to authorized users, services, and hardware and  managed commensurate with the assessed risk of unauthorized access


Instruction: What is PR.AT? (Awareness and Training)

Output: The organization's personnel are provided with cybersecurity awareness and training so that they can perform their cybersecurity-related tasks


Instruction: Summarize the scope of PR.AT.

Output: The organization's personnel are provided with cybersecurity awareness and training so that they can perform their cybersecurity-related tasks


Instruction: What does PR.AT cover?

Output: The organization's personnel are provided with cybersecurity awareness and training so that they can perform their cybersecurity-related tasks


Instruction: What is PR.DS? (Data Security)

Output: Data are managed consistent with the organization's risk strategy to protect the confidentiality, integrity, and availability of information


Instruction: Summarize the scope of PR.DS.

Output: Data are managed consistent with the organization's risk strategy to protect the confidentiality, integrity, and availability of information


Instruction: What does PR.DS cover?

Output: Data are managed consistent with the organization's risk strategy to protect the confidentiality, integrity, and availability of information


Instruction: What is PR.PS? (Platform Security)

Output: The hardware, software (e.g., firmware, operating systems, applications), and services of physical and virtual platforms are managed consistent with the organization's risk strategy to protect their confidentiality, integrity, and availability


Instruction: Summarize the scope of PR.PS.

Output: The hardware, software (e.g., firmware, operating systems, applications), and services of physical and virtual platforms are managed consistent with the organization's risk strategy to protect their confidentiality, integrity, and availability


Instruction: What does PR.PS cover?

Output: The hardware, software (e.g., firmware, operating systems, applications), and services of physical and virtual platforms are managed consistent with the organization's risk strategy to protect their confidentiality, integrity, and availability


Instruction: What is PR.IR? (Technology Infrastructure Resilience)

Output: Security architectures are managed with the organization's risk strategy to protect asset confidentiality, integrity, and availability, and organizational resilience


Instruction: Summarize the scope of PR.IR.

Output: Security architectures are managed with the organization's risk strategy to protect asset confidentiality, integrity, and availability, and organizational resilience


Instruction: What does PR.IR cover?

Output: Security architectures are managed with the organization's risk strategy to protect asset confidentiality, integrity, and availability, and organizational resilience


Instruction: What is DE.CM? (Continuous Monitoring)

Output: Assets are monitored to find anomalies, indicators of compromise, and other potentially adverse events


Instruction: Summarize the scope of DE.CM.

Output: Assets are monitored to find anomalies, indicators of compromise, and other potentially adverse events


Instruction: What does DE.CM cover?

Output: Assets are monitored to find anomalies, indicators of compromise, and other potentially adverse events


Instruction: What is DE.AE? (Adverse Event Analysis)

Output: Anomalies, indicators of compromise, and other potentially adverse events are analyzed to characterize the events and detect cybersecurity incidents


Instruction: Summarize the scope of DE.AE.

Output: Anomalies, indicators of compromise, and other potentially adverse events are analyzed to characterize the events and detect cybersecurity incidents


Instruction: What does DE.AE cover?

Output: Anomalies, indicators of compromise, and other potentially adverse events are analyzed to characterize the events and detect cybersecurity incidents


Instruction: What is RS.MA? (Incident Management)

Output: Responses to detected cybersecurity incidents are managed


Instruction: Summarize the scope of RS.MA.

Output: Responses to detected cybersecurity incidents are managed


Instruction: What does RS.MA cover?

Output: Responses to detected cybersecurity incidents are managed


Instruction: What is RS.AN? (Incident Analysis)

Output: Investigations are conducted to ensure effective response and support forensics and recovery activities


Instruction: Summarize the scope of RS.AN.

Output: Investigations are conducted to ensure effective response and support forensics and recovery activities


Instruction: What does RS.AN cover?

Output: Investigations are conducted to ensure effective response and support forensics and recovery activities


Instruction: What is RS.CO? (Incident Response Reporting and Communication)

Output: Response activities are coordinated with internal and external stakeholders as required by laws, regulations, or policies


Instruction: Summarize the scope of RS.CO.

Output: Response activities are coordinated with internal and external stakeholders as required by laws, regulations, or policies


Instruction: What does RS.CO cover?

Output: Response activities are coordinated with internal and external stakeholders as required by laws, regulations, or policies


Instruction: What is RS.MI? (Incident Mitigation)

Output: Activities are performed to prevent expansion of an event and mitigate its effects


Instruction: Summarize the scope of RS.MI.

Output: Activities are performed to prevent expansion of an event and mitigate its effects


Instruction: What does RS.MI cover?

Output: Activities are performed to prevent expansion of an event and mitigate its effects


Instruction: What is RC.RP? (Incident Recovery Plan Execution)

Output: Restoration activities are performed to ensure operational availability of systems and services affected by cybersecurity incidents


Instruction: Summarize the scope of RC.RP.

Output: Restoration activities are performed to ensure operational availability of systems and services affected by cybersecurity incidents


Instruction: What does RC.RP cover?

Output: Restoration activities are performed to ensure operational availability of systems and services affected by cybersecurity incidents


Instruction: What is RC.CO? (Incident Recovery Communication)

Output: Restoration activities are coordinated with internal and external parties


Instruction: Summarize the scope of RC.CO.

Output: Restoration activities are coordinated with internal and external parties


Instruction: What does RC.CO cover?

Output: Restoration activities are coordinated with internal and external parties


Instruction: What is GV? (GOVERN)

Output: The organization's cybersecurity risk management strategy, expectations, and policy are established, communicated, and monitored


Instruction: Summarize the scope of GV.

Output: The organization's cybersecurity risk management strategy, expectations, and policy are established, communicated, and monitored


Instruction: What does GV cover?

Output: The organization's cybersecurity risk management strategy, expectations, and policy are established, communicated, and monitored


Instruction: What is ID? (IDENTIFY)

Output: The organization's current cybersecurity risks are understood


Instruction: Summarize the scope of ID.

Output: The organization's current cybersecurity risks are understood


Instruction: What does ID cover?

Output: The organization's current cybersecurity risks are understood


Instruction: What is PR? (PROTECT)

Output: Safeguards to manage the organization's cybersecurity risks are used


Instruction: Summarize the scope of PR.

Output: Safeguards to manage the organization's cybersecurity risks are used


Instruction: What does PR cover?

Output: Safeguards to manage the organization's cybersecurity risks are used


Instruction: What is DE? (DETECT)

Output: Possible cybersecurity attacks and compromises are found and analyzed


Instruction: Summarize the scope of DE.

Output: Possible cybersecurity attacks and compromises are found and analyzed


Instruction: What does DE cover?

Output: Possible cybersecurity attacks and compromises are found and analyzed


Instruction: What is RS? (RESPOND)

Output: Actions regarding a detected cybersecurity incident are taken


Instruction: Summarize the scope of RS.

Output: Actions regarding a detected cybersecurity incident are taken


Instruction: What does RS cover?

Output: Actions regarding a detected cybersecurity incident are taken


Instruction: What is RC? (RECOVER)

Output: Assets and operations affected by a cybersecurity incident are restored


Instruction: Summarize the scope of RC.

Output: Assets and operations affected by a cybersecurity incident are restored


Instruction: What does RC cover?

Output: Assets and operations affected by a cybersecurity incident are restored


Instruction: What is GV.OC-01.001? (Ex1)

Output: Share the organization's mission (e.g., through vision and mission statements, marketing, and service strategies) to provide a basis for identifying risks that may impede that mission


Instruction: Explain GV.OC-01.001.

Output: Share the organization's mission (e.g., through vision and mission statements, marketing, and service strategies) to provide a basis for identifying risks that may impede that mission


Instruction: What is GV.OC-02.002? (Ex1)

Output: Identify relevant internal stakeholders and their cybersecurity-related expectations (e.g., performance and risk expectations of officers, directors, and advisors; cultural expectations of employees)


Instruction: Explain GV.OC-02.002.

Output: Identify relevant internal stakeholders and their cybersecurity-related expectations (e.g., performance and risk expectations of officers, directors, and advisors; cultural expectations of employees)


Instruction: What is GV.OC-02.003? (Ex2)

Output: Identify relevant external stakeholders and their cybersecurity-related expectations (e.g., privacy expectations of customers, business expectations of partnerships, compliance expectations of regulators, ethics expectations of society)


Instruction: Explain GV.OC-02.003.

Output: Identify relevant external stakeholders and their cybersecurity-related expectations (e.g., privacy expectations of customers, business expectations of partnerships, compliance expectations of regulators, ethics expectations of society)


Instruction: What is GV.OC-03.004? (Ex1)

Output: Determine a process to track and manage legal and regulatory requirements regarding protection of individuals' information (e.g., Health Insurance Portability and Accountability Act, California Consumer Privacy Act, General Data Protection Regulation)


Instruction: Explain GV.OC-03.004.

Output: Determine a process to track and manage legal and regulatory requirements regarding protection of individuals' information (e.g., Health Insurance Portability and Accountability Act, California Consumer Privacy Act, General Data Protection Regulation)


Instruction: What is GV.OC-03.005? (Ex2)

Output: Determine a process to track and manage contractual requirements for cybersecurity management of supplier, customer, and partner information


Instruction: Explain GV.OC-03.005.

Output: Determine a process to track and manage contractual requirements for cybersecurity management of supplier, customer, and partner information


Instruction: What is GV.OC-03.006? (Ex3)

Output: Align the organization's cybersecurity strategy with legal, regulatory, and contractual requirements


Instruction: Explain GV.OC-03.006.

Output: Align the organization's cybersecurity strategy with legal, regulatory, and contractual requirements


Instruction: What is GV.OC-04.007? (Ex1)

Output: Establish criteria for determining the criticality of capabilities and services as viewed by internal and external stakeholders


Instruction: Explain GV.OC-04.007.

Output: Establish criteria for determining the criticality of capabilities and services as viewed by internal and external stakeholders


Instruction: What is GV.OC-04.008? (Ex2)

Output: Determine (e.g., from a business impact analysis) assets and business operations that are vital to achieving mission objectives and the potential impact of a loss (or partial loss) of such operations


Instruction: Explain GV.OC-04.008.

Output: Determine (e.g., from a business impact analysis) assets and business operations that are vital to achieving mission objectives and the potential impact of a loss (or partial loss) of such operations


Instruction: What is GV.OC-04.009? (Ex3)

Output: Establish and communicate resilience objectives (e.g., recovery time objectives) for delivering critical capabilities and services in various operating states (e.g., under attack, during recovery, normal operation)


Instruction: Explain GV.OC-04.009.

Output: Establish and communicate resilience objectives (e.g., recovery time objectives) for delivering critical capabilities and services in various operating states (e.g., under attack, during recovery, normal operation)


Instruction: What is GV.OC-05.010? (Ex1)

Output: Create an inventory of the organization's dependencies on external resources (e.g., facilities, cloud-based hosting providers) and their relationships to organizational assets and business functions


Instruction: Explain GV.OC-05.010.

Output: Create an inventory of the organization's dependencies on external resources (e.g., facilities, cloud-based hosting providers) and their relationships to organizational assets and business functions


Instruction: What is GV.OC-05.011? (Ex2)

Output: Identify and document external dependencies that are potential points of failure for the organization's critical capabilities and services, and share that information with appropriate personnel


Instruction: Explain GV.OC-05.011.

Output: Identify and document external dependencies that are potential points of failure for the organization's critical capabilities and services, and share that information with appropriate personnel


Instruction: What is GV.RM-01.012? (Ex1)

Output: Update near-term and long-term cybersecurity risk management objectives as part of annual strategic planning and when major changes occur


Instruction: Explain GV.RM-01.012.

Output: Update near-term and long-term cybersecurity risk management objectives as part of annual strategic planning and when major changes occur


Instruction: What is GV.RM-01.013? (Ex2)

Output: Establish measurable objectives for cybersecurity risk management (e.g., manage the quality of user training, ensure adequate risk protection for industrial control systems)


Instruction: Explain GV.RM-01.013.

Output: Establish measurable objectives for cybersecurity risk management (e.g., manage the quality of user training, ensure adequate risk protection for industrial control systems)


Instruction: What is GV.RM-01.014? (Ex3)

Output: Senior leaders agree about cybersecurity objectives and use them for measuring and managing risk and performance


Instruction: Explain GV.RM-01.014.

Output: Senior leaders agree about cybersecurity objectives and use them for measuring and managing risk and performance


Instruction: What is GV.RM-02.015? (Ex1)

Output: Determine and communicate risk appetite statements that convey expectations about the appropriate level of risk for the organization


Instruction: Explain GV.RM-02.015.

Output: Determine and communicate risk appetite statements that convey expectations about the appropriate level of risk for the organization


Instruction: What is GV.RM-02.016? (Ex2)

Output: Translate risk appetite statements into specific, measurable, and broadly understandable risk tolerance statements


Instruction: Explain GV.RM-02.016.

Output: Translate risk appetite statements into specific, measurable, and broadly understandable risk tolerance statements


Instruction: What is GV.RM-02.017? (Ex3)

Output: Refine organizational objectives and risk appetite periodically based on known risk exposure and residual risk


Instruction: Explain GV.RM-02.017.

Output: Refine organizational objectives and risk appetite periodically based on known risk exposure and residual risk


Instruction: What is GV.RM-03.018? (Ex1)

Output: Aggregate and manage cybersecurity risks alongside other enterprise risks (e.g., compliance, financial, operational, regulatory, reputational, safety)


Instruction: Explain GV.RM-03.018.

Output: Aggregate and manage cybersecurity risks alongside other enterprise risks (e.g., compliance, financial, operational, regulatory, reputational, safety)


Instruction: What is GV.RM-03.019? (Ex2)

Output: Include cybersecurity risk managers in enterprise risk management planning


Instruction: Explain GV.RM-03.019.

Output: Include cybersecurity risk managers in enterprise risk management planning


Instruction: What is GV.RM-03.020? (Ex3)

Output: Establish criteria for escalating cybersecurity risks within enterprise risk management


Instruction: Explain GV.RM-03.020.

Output: Establish criteria for escalating cybersecurity risks within enterprise risk management


Instruction: What is GV.RM-04.021? (Ex1)

Output: Specify criteria for accepting and avoiding cybersecurity risk for various classifications of data


Instruction: Explain GV.RM-04.021.

Output: Specify criteria for accepting and avoiding cybersecurity risk for various classifications of data


Instruction: What is GV.RM-04.022? (Ex2)

Output: Determine whether to purchase cybersecurity insurance


Instruction: Explain GV.RM-04.022.

Output: Determine whether to purchase cybersecurity insurance


Instruction: What is GV.RM-04.023? (Ex3)

Output: Document conditions under which shared responsibility models are acceptable (e.g., outsourcing certain cybersecurity functions, having a third party perform financial transactions on behalf of the organization, using public cloud-based services)


Instruction: Explain GV.RM-04.023.

Output: Document conditions under which shared responsibility models are acceptable (e.g., outsourcing certain cybersecurity functions, having a third party perform financial transactions on behalf of the organization, using public cloud-based services)


Instruction: What is GV.RM-05.024? (Ex1)

Output: Determine how to update senior executives, directors, and management on the organization's cybersecurity posture at agreed-upon intervals


Instruction: Explain GV.RM-05.024.

Output: Determine how to update senior executives, directors, and management on the organization's cybersecurity posture at agreed-upon intervals


Instruction: What is GV.RM-05.025? (Ex2)

Output: Identify how all departments across the organization - such as management, operations, internal auditors, legal, acquisition, physical security, and HR - will communicate with each other about cybersecurity risks


Instruction: Explain GV.RM-05.025.

Output: Identify how all departments across the organization - such as management, operations, internal auditors, legal, acquisition, physical security, and HR - will communicate with each other about cybersecurity risks


Instruction: What is GV.RM-06.026? (Ex1)

Output: Establish criteria for using a quantitative approach to cybersecurity risk analysis, and specify probability and exposure formulas


Instruction: Explain GV.RM-06.026.

Output: Establish criteria for using a quantitative approach to cybersecurity risk analysis, and specify probability and exposure formulas


Instruction: What is GV.RM-06.027? (Ex2)

Output: Create and use templates (e.g., a risk register) to document cybersecurity risk information (e.g., risk description, exposure, treatment, and ownership)


Instruction: Explain GV.RM-06.027.

Output: Create and use templates (e.g., a risk register) to document cybersecurity risk information (e.g., risk description, exposure, treatment, and ownership)


Instruction: What is GV.RM-06.028? (Ex3)

Output: Establish criteria for risk prioritization at the appropriate levels within the enterprise


Instruction: Explain GV.RM-06.028.

Output: Establish criteria for risk prioritization at the appropriate levels within the enterprise


Instruction: What is GV.RM-06.029? (Ex4)

Output: Use a consistent list of risk categories to support integrating, aggregating, and comparing cybersecurity risks


Instruction: Explain GV.RM-06.029.

Output: Use a consistent list of risk categories to support integrating, aggregating, and comparing cybersecurity risks


Instruction: What is GV.RM-07.030? (Ex1)

Output: Define and communicate guidance and methods for identifying opportunities and including them in risk discussions (e.g., strengths, weaknesses, opportunities, and threats [SWOT] analysis)


Instruction: Explain GV.RM-07.030.

Output: Define and communicate guidance and methods for identifying opportunities and including them in risk discussions (e.g., strengths, weaknesses, opportunities, and threats [SWOT] analysis)


Instruction: What is GV.RM-07.031? (Ex2)

Output: Identify stretch goals and document them


Instruction: Explain GV.RM-07.031.

Output: Identify stretch goals and document them


Instruction: What is GV.RM-07.032? (Ex3)

Output: Calculate, document, and prioritize positive risks alongside negative risks


Instruction: Explain GV.RM-07.032.

Output: Calculate, document, and prioritize positive risks alongside negative risks


Instruction: What is GV.RR-01.033? (Ex1)

Output: Leaders (e.g., directors) agree on their roles and responsibilities in developing, implementing, and assessing the organization's cybersecurity strategy


Instruction: Explain GV.RR-01.033.

Output: Leaders (e.g., directors) agree on their roles and responsibilities in developing, implementing, and assessing the organization's cybersecurity strategy


Instruction: What is GV.RR-01.034? (Ex2)

Output: Share leaders' expectations regarding a secure and ethical culture, especially when current events present the opportunity to highlight positive or negative examples of cybersecurity risk management


Instruction: Explain GV.RR-01.034.

Output: Share leaders' expectations regarding a secure and ethical culture, especially when current events present the opportunity to highlight positive or negative examples of cybersecurity risk management


Instruction: What is GV.RR-01.035? (Ex3)

Output: Leaders direct the CISO to maintain a comprehensive cybersecurity risk strategy and review and update it at least annually and after major events


Instruction: Explain GV.RR-01.035.

Output: Leaders direct the CISO to maintain a comprehensive cybersecurity risk strategy and review and update it at least annually and after major events


Instruction: What is GV.RR-01.036? (Ex4)

Output: Conduct reviews to ensure adequate authority and coordination among those responsible for managing cybersecurity risk


Instruction: Explain GV.RR-01.036.

Output: Conduct reviews to ensure adequate authority and coordination among those responsible for managing cybersecurity risk


Instruction: What is GV.RR-02.037? (Ex1)

Output: Document risk management roles and responsibilities in policy


Instruction: Explain GV.RR-02.037.

Output: Document risk management roles and responsibilities in policy


Instruction: What is GV.RR-02.038? (Ex2)

Output: Document who is responsible and accountable for cybersecurity risk management activities and how those teams and individuals are to be consulted and informed


Instruction: Explain GV.RR-02.038.

Output: Document who is responsible and accountable for cybersecurity risk management activities and how those teams and individuals are to be consulted and informed


Instruction: What is GV.RR-02.039? (Ex3)

Output: Include cybersecurity responsibilities and performance requirements in personnel descriptions


Instruction: Explain GV.RR-02.039.

Output: Include cybersecurity responsibilities and performance requirements in personnel descriptions


Instruction: What is GV.RR-02.040? (Ex4)

Output: Document performance goals for personnel with cybersecurity risk management responsibilities, and periodically measure performance to identify areas for improvement


Instruction: Explain GV.RR-02.040.

Output: Document performance goals for personnel with cybersecurity risk management responsibilities, and periodically measure performance to identify areas for improvement


Instruction: What is GV.RR-02.041? (Ex5)

Output: Clearly articulate cybersecurity responsibilities within operations, risk functions, and internal audit functions


Instruction: Explain GV.RR-02.041.

Output: Clearly articulate cybersecurity responsibilities within operations, risk functions, and internal audit functions


Instruction: What is GV.RR-03.042? (Ex1)

Output: Conduct periodic management reviews to ensure that those given cybersecurity risk management responsibilities have the necessary authority


Instruction: Explain GV.RR-03.042.

Output: Conduct periodic management reviews to ensure that those given cybersecurity risk management responsibilities have the necessary authority


Instruction: What is GV.RR-03.043? (Ex2)

Output: Identify resource allocation and investment in line with risk tolerance and response


Instruction: Explain GV.RR-03.043.

Output: Identify resource allocation and investment in line with risk tolerance and response


Instruction: What is GV.RR-03.044? (Ex3)

Output: Provide adequate and sufficient people, process, and technical resources to support the cybersecurity strategy


Instruction: Explain GV.RR-03.044.

Output: Provide adequate and sufficient people, process, and technical resources to support the cybersecurity strategy


Instruction: What is GV.RR-04.045? (Ex1)

Output: Integrate cybersecurity risk management considerations into human resources processes (e.g., personnel screening, onboarding, change notification, offboarding)


Instruction: Explain GV.RR-04.045.

Output: Integrate cybersecurity risk management considerations into human resources processes (e.g., personnel screening, onboarding, change notification, offboarding)


Instruction: What is GV.RR-04.046? (Ex2)

Output: Consider cybersecurity knowledge to be a positive factor in hiring, training, and retention decisions


Instruction: Explain GV.RR-04.046.

Output: Consider cybersecurity knowledge to be a positive factor in hiring, training, and retention decisions


Instruction: What is GV.RR-04.047? (Ex3)

Output: Conduct background checks prior to onboarding new personnel for sensitive roles, and periodically repeat background checks for personnel with such roles


Instruction: Explain GV.RR-04.047.

Output: Conduct background checks prior to onboarding new personnel for sensitive roles, and periodically repeat background checks for personnel with such roles


Instruction: What is GV.RR-04.048? (Ex4)

Output: Define and enforce obligations for personnel to be aware of, adhere to, and uphold security policies as they relate to their roles


Instruction: Explain GV.RR-04.048.

Output: Define and enforce obligations for personnel to be aware of, adhere to, and uphold security policies as they relate to their roles


Instruction: What is GV.PO-01.049? (Ex1)

Output: Create, disseminate, and maintain an understandable, usable risk management policy with statements of management intent, expectations, and direction


Instruction: Explain GV.PO-01.049.

Output: Create, disseminate, and maintain an understandable, usable risk management policy with statements of management intent, expectations, and direction


Instruction: What is GV.PO-01.050? (Ex2)

Output: Periodically review policy and supporting processes and procedures to ensure that they align with risk management strategy objectives and priorities, as well as the high-level direction of the cybersecurity policy


Instruction: Explain GV.PO-01.050.

Output: Periodically review policy and supporting processes and procedures to ensure that they align with risk management strategy objectives and priorities, as well as the high-level direction of the cybersecurity policy


Instruction: What is GV.PO-01.051? (Ex3)

Output: Require approval from senior management on policy


Instruction: Explain GV.PO-01.051.

Output: Require approval from senior management on policy


Instruction: What is GV.PO-01.052? (Ex4)

Output: Communicate cybersecurity risk management policy and supporting processes and procedures across the organization


Instruction: Explain GV.PO-01.052.

Output: Communicate cybersecurity risk management policy and supporting processes and procedures across the organization


Instruction: What is GV.PO-01.053? (Ex5)

Output: Require personnel to acknowledge receipt of policy when first hired, annually, and whenever policy is updated


Instruction: Explain GV.PO-01.053.

Output: Require personnel to acknowledge receipt of policy when first hired, annually, and whenever policy is updated


Instruction: What is GV.PO-02.054? (Ex1)

Output: Update policy based on periodic reviews of cybersecurity risk management results to ensure that policy and supporting processes and procedures adequately maintain risk at an acceptable level


Instruction: Explain GV.PO-02.054.

Output: Update policy based on periodic reviews of cybersecurity risk management results to ensure that policy and supporting processes and procedures adequately maintain risk at an acceptable level


Instruction: What is GV.PO-02.055? (Ex2)

Output: Provide a timeline for reviewing changes to the organization's risk environment (e.g., changes in risk or in the organization's mission objectives), and communicate recommended policy updates


Instruction: Explain GV.PO-02.055.

Output: Provide a timeline for reviewing changes to the organization's risk environment (e.g., changes in risk or in the organization's mission objectives), and communicate recommended policy updates


Instruction: What is GV.PO-02.056? (Ex3)

Output: Update policy to reflect changes in legal and regulatory requirements


Instruction: Explain GV.PO-02.056.

Output: Update policy to reflect changes in legal and regulatory requirements


Instruction: What is GV.PO-02.057? (Ex4)

Output: Update policy to reflect changes in technology (e.g., adoption of artificial intelligence) and changes to the business (e.g., acquisition of a new business, new contract requirements)


Instruction: Explain GV.PO-02.057.

Output: Update policy to reflect changes in technology (e.g., adoption of artificial intelligence) and changes to the business (e.g., acquisition of a new business, new contract requirements)


Instruction: What is GV.OV-01.058? (Ex1)

Output: Measure how well the risk management strategy and risk results have helped leaders make decisions and achieve organizational objectives


Instruction: Explain GV.OV-01.058.

Output: Measure how well the risk management strategy and risk results have helped leaders make decisions and achieve organizational objectives


Instruction: What is GV.OV-01.059? (Ex2)

Output: Examine whether cybersecurity risk strategies that impede operations or innovation should be adjusted


Instruction: Explain GV.OV-01.059.

Output: Examine whether cybersecurity risk strategies that impede operations or innovation should be adjusted


Instruction: What is GV.OV-02.060? (Ex1)

Output: Review audit findings to confirm whether the existing cybersecurity strategy has ensured compliance with internal and external requirements


Instruction: Explain GV.OV-02.060.

Output: Review audit findings to confirm whether the existing cybersecurity strategy has ensured compliance with internal and external requirements


Instruction: What is GV.OV-02.061? (Ex2)

Output: Review the performance oversight of those in cybersecurity-related roles to determine whether policy changes are necessary


Instruction: Explain GV.OV-02.061.

Output: Review the performance oversight of those in cybersecurity-related roles to determine whether policy changes are necessary


Instruction: What is GV.OV-02.062? (Ex3)

Output: Review strategy in light of cybersecurity incidents


Instruction: Explain GV.OV-02.062.

Output: Review strategy in light of cybersecurity incidents


Instruction: What is GV.OV-03.063? (Ex1)

Output: Review key performance indicators (KPIs) to ensure that organization-wide policies and procedures achieve objectives


Instruction: Explain GV.OV-03.063.

Output: Review key performance indicators (KPIs) to ensure that organization-wide policies and procedures achieve objectives


Instruction: What is GV.OV-03.064? (Ex2)

Output: Review key risk indicators (KRIs) to identify risks the organization faces, including likelihood and potential impact


Instruction: Explain GV.OV-03.064.

Output: Review key risk indicators (KRIs) to identify risks the organization faces, including likelihood and potential impact


Instruction: What is GV.OV-03.065? (Ex3)

Output: Collect and communicate metrics on cybersecurity risk management with senior leadership


Instruction: Explain GV.OV-03.065.

Output: Collect and communicate metrics on cybersecurity risk management with senior leadership


Instruction: What is GV.SC-01.066? (Ex1)

Output: Establish a strategy that expresses the objectives of the cybersecurity supply chain risk management program


Instruction: Explain GV.SC-01.066.

Output: Establish a strategy that expresses the objectives of the cybersecurity supply chain risk management program


Instruction: What is GV.SC-01.067? (Ex2)

Output: Develop the cybersecurity supply chain risk management program, including a plan (with milestones), policies, and procedures that guide implementation and improvement of the program, and share the policies and procedures with the organizational stakeholders


Instruction: Explain GV.SC-01.067.

Output: Develop the cybersecurity supply chain risk management program, including a plan (with milestones), policies, and procedures that guide implementation and improvement of the program, and share the policies and procedures with the organizational stakeholders


Instruction: What is GV.SC-01.068? (Ex3)

Output: Develop and implement program processes based on the strategy, objectives, policies, and procedures that are agreed upon and performed by the organizational stakeholders


Instruction: Explain GV.SC-01.068.

Output: Develop and implement program processes based on the strategy, objectives, policies, and procedures that are agreed upon and performed by the organizational stakeholders


Instruction: What is GV.SC-01.069? (Ex4)

Output: Establish a cross-organizational mechanism that ensures alignment between functions that contribute to cybersecurity supply chain risk management, such as cybersecurity, IT, operations, legal, human resources, and engineering


Instruction: Explain GV.SC-01.069.

Output: Establish a cross-organizational mechanism that ensures alignment between functions that contribute to cybersecurity supply chain risk management, such as cybersecurity, IT, operations, legal, human resources, and engineering


Instruction: What is GV.SC-02.070? (Ex1)

Output: Identify one or more specific roles or positions that will be responsible and accountable for planning, resourcing, and executing cybersecurity supply chain risk management activities


Instruction: Explain GV.SC-02.070.

Output: Identify one or more specific roles or positions that will be responsible and accountable for planning, resourcing, and executing cybersecurity supply chain risk management activities


Instruction: What is GV.SC-02.071? (Ex2)

Output: Document cybersecurity supply chain risk management roles and responsibilities in policy


Instruction: Explain GV.SC-02.071.

Output: Document cybersecurity supply chain risk management roles and responsibilities in policy


Instruction: What is GV.SC-02.072? (Ex3)

Output: Create responsibility matrixes to document who will be responsible and accountable for cybersecurity supply chain risk management activities and how those teams and individuals will be consulted and informed


Instruction: Explain GV.SC-02.072.

Output: Create responsibility matrixes to document who will be responsible and accountable for cybersecurity supply chain risk management activities and how those teams and individuals will be consulted and informed


Instruction: What is GV.SC-02.073? (Ex4)

Output: Include cybersecurity supply chain risk management responsibilities and performance requirements in personnel descriptions to ensure clarity and improve accountability


Instruction: Explain GV.SC-02.073.

Output: Include cybersecurity supply chain risk management responsibilities and performance requirements in personnel descriptions to ensure clarity and improve accountability


Instruction: What is GV.SC-02.074? (Ex5)

Output: Document performance goals for personnel with cybersecurity risk management-specific responsibilities, and periodically measure them to demonstrate and improve performance


Instruction: Explain GV.SC-02.074.

Output: Document performance goals for personnel with cybersecurity risk management-specific responsibilities, and periodically measure them to demonstrate and improve performance


Instruction: What is GV.SC-02.075? (Ex6)

Output: Develop roles and responsibilities for suppliers, customers, and business partners to address shared responsibilities for applicable cybersecurity risks, and integrate them into organizational policies and applicable third-party agreements


Instruction: Explain GV.SC-02.075.

Output: Develop roles and responsibilities for suppliers, customers, and business partners to address shared responsibilities for applicable cybersecurity risks, and integrate them into organizational policies and applicable third-party agreements


Instruction: What is GV.SC-02.076? (Ex7)

Output: Internally communicate cybersecurity supply chain risk management roles and responsibilities for third parties


Instruction: Explain GV.SC-02.076.

Output: Internally communicate cybersecurity supply chain risk management roles and responsibilities for third parties


Instruction: What is GV.SC-02.077? (Ex8)

Output: Establish rules and protocols for information sharing and reporting processes between the organization and its suppliers


Instruction: Explain GV.SC-02.077.

Output: Establish rules and protocols for information sharing and reporting processes between the organization and its suppliers


Instruction: What is GV.SC-03.078? (Ex1)

Output: Identify areas of alignment and overlap with cybersecurity and enterprise risk management


Instruction: Explain GV.SC-03.078.

Output: Identify areas of alignment and overlap with cybersecurity and enterprise risk management


Instruction: What is GV.SC-03.079? (Ex2)

Output: Establish integrated control sets for cybersecurity risk management and cybersecurity supply chain risk management


Instruction: Explain GV.SC-03.079.

Output: Establish integrated control sets for cybersecurity risk management and cybersecurity supply chain risk management


Instruction: What is GV.SC-03.080? (Ex3)

Output: Integrate cybersecurity supply chain risk management into improvement processes


Instruction: Explain GV.SC-03.080.

Output: Integrate cybersecurity supply chain risk management into improvement processes


Instruction: What is GV.SC-03.081? (Ex4)

Output: Escalate material cybersecurity risks in supply chains to senior management, and address them at the enterprise risk management level


Instruction: Explain GV.SC-03.081.

Output: Escalate material cybersecurity risks in supply chains to senior management, and address them at the enterprise risk management level


Instruction: What is GV.SC-04.082? (Ex1)

Output: Develop criteria for supplier criticality based on, for example, the sensitivity of data processed or possessed by suppliers, the degree of access to the organization's systems, and the importance of the products or services to the organization's mission


Instruction: Explain GV.SC-04.082.

Output: Develop criteria for supplier criticality based on, for example, the sensitivity of data processed or possessed by suppliers, the degree of access to the organization's systems, and the importance of the products or services to the organization's mission


Instruction: What is GV.SC-04.083? (Ex2)

Output: Keep a record of all suppliers, and prioritize suppliers based on the criticality criteria


Instruction: Explain GV.SC-04.083.

Output: Keep a record of all suppliers, and prioritize suppliers based on the criticality criteria


Instruction: What is GV.SC-05.084? (Ex1)

Output: Establish security requirements for suppliers, products, and services commensurate with their criticality level and potential impact if compromised


Instruction: Explain GV.SC-05.084.

Output: Establish security requirements for suppliers, products, and services commensurate with their criticality level and potential impact if compromised


Instruction: What is GV.SC-05.085? (Ex2)

Output: Include all cybersecurity and supply chain requirements that third parties must follow and how compliance with the requirements may be verified in default contractual language


Instruction: Explain GV.SC-05.085.

Output: Include all cybersecurity and supply chain requirements that third parties must follow and how compliance with the requirements may be verified in default contractual language


Instruction: What is GV.SC-05.086? (Ex3)

Output: Define the rules and protocols for information sharing between the organization and its suppliers and sub-tier suppliers in agreements


Instruction: Explain GV.SC-05.086.

Output: Define the rules and protocols for information sharing between the organization and its suppliers and sub-tier suppliers in agreements


Instruction: What is GV.SC-05.087? (Ex4)

Output: Manage risk by including security requirements in agreements based on their criticality and potential impact if compromised


Instruction: Explain GV.SC-05.087.

Output: Manage risk by including security requirements in agreements based on their criticality and potential impact if compromised


Instruction: What is GV.SC-05.088? (Ex5)

Output: Define security requirements in service-level agreements (SLAs) for monitoring suppliers for acceptable security performance throughout the supplier relationship lifecycle