Instruction: What is GV? (GOVERN)

Output: The organization's cybersecurity risk management strategy, expectations, and policy are established, communicated, and monitored


Instruction: Summarize the scope of GV.

Output: The organization's cybersecurity risk management strategy, expectations, and policy are established, communicated, and monitored


Instruction: What does GV cover?

Output: The organization's cybersecurity risk management strategy, expectations, and policy are established, communicated, and monitored


Instruction: What is GV.OC? (Organizational Context)

Output: The circumstances - mission, stakeholder expectations, dependencies, and legal, regulatory, and contractual requirements - surrounding the organization's cybersecurity risk management decisions are understood


Instruction: Summarize the scope of GV.OC.

Output: The circumstances - mission, stakeholder expectations, dependencies, and legal, regulatory, and contractual requirements - surrounding the organization's cybersecurity risk management decisions are understood


Instruction: What does GV.OC cover?

Output: The circumstances - mission, stakeholder expectations, dependencies, and legal, regulatory, and contractual requirements - surrounding the organization's cybersecurity risk management decisions are understood


Instruction: What is GV.OC-01?

Output: The organizational mission is understood and informs cybersecurity risk management


Instruction: Explain the requirement of GV.OC-01.

Output: The organizational mission is understood and informs cybersecurity risk management


Instruction: What outcome is expected by GV.OC-01?

Output: The organizational mission is understood and informs cybersecurity risk management


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is GV.OC-01.001? (Ex1)

Output: Share the organization's mission (e.g., through vision and mission statements, marketing, and service strategies) to provide a basis for identifying risks that may impede that mission


Instruction: Explain GV.OC-01.001.

Output: Share the organization's mission (e.g., through vision and mission statements, marketing, and service strategies) to provide a basis for identifying risks that may impede that mission


Instruction: What is GV.OC-02?

Output: Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered


Instruction: Explain the requirement of GV.OC-02.

Output: Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered


Instruction: What outcome is expected by GV.OC-02?

Output: Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is third? (3rd)

Output: 3rd Party Risk


Instruction: Explain third.

Output: 3rd Party Risk


Instruction: What is GV.OC-02.002? (Ex1)

Output: Identify relevant internal stakeholders and their cybersecurity-related expectations (e.g., performance and risk expectations of officers, directors, and advisors; cultural expectations of employees)


Instruction: Explain GV.OC-02.002.

Output: Identify relevant internal stakeholders and their cybersecurity-related expectations (e.g., performance and risk expectations of officers, directors, and advisors; cultural expectations of employees)


Instruction: What is GV.OC-02.003? (Ex2)

Output: Identify relevant external stakeholders and their cybersecurity-related expectations (e.g., privacy expectations of customers, business expectations of partnerships, compliance expectations of regulators, ethics expectations of society)


Instruction: Explain GV.OC-02.003.

Output: Identify relevant external stakeholders and their cybersecurity-related expectations (e.g., privacy expectations of customers, business expectations of partnerships, compliance expectations of regulators, ethics expectations of society)


Instruction: What is GV.OC-03?

Output: Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed


Instruction: Explain the requirement of GV.OC-03.

Output: Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed


Instruction: What outcome is expected by GV.OC-03?

Output: Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is third? (3rd)

Output: 3rd Party Risk


Instruction: Explain third.

Output: 3rd Party Risk


Instruction: What is GV.OC-03.004? (Ex1)

Output: Determine a process to track and manage legal and regulatory requirements regarding protection of individuals' information (e.g., Health Insurance Portability and Accountability Act, California Consumer Privacy Act, General Data Protection Regulation)


Instruction: Explain GV.OC-03.004.

Output: Determine a process to track and manage legal and regulatory requirements regarding protection of individuals' information (e.g., Health Insurance Portability and Accountability Act, California Consumer Privacy Act, General Data Protection Regulation)


Instruction: What is GV.OC-03.005? (Ex2)

Output: Determine a process to track and manage contractual requirements for cybersecurity management of supplier, customer, and partner information


Instruction: Explain GV.OC-03.005.

Output: Determine a process to track and manage contractual requirements for cybersecurity management of supplier, customer, and partner information


Instruction: What is GV.OC-03.006? (Ex3)

Output: Align the organization's cybersecurity strategy with legal, regulatory, and contractual requirements


Instruction: Explain GV.OC-03.006.

Output: Align the organization's cybersecurity strategy with legal, regulatory, and contractual requirements


Instruction: What is GV.OC-04?

Output: Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated


Instruction: Explain the requirement of GV.OC-04.

Output: Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated


Instruction: What outcome is expected by GV.OC-04?

Output: Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is third? (3rd)

Output: 3rd Party Risk


Instruction: Explain third.

Output: 3rd Party Risk


Instruction: What is GV.OC-04.007? (Ex1)

Output: Establish criteria for determining the criticality of capabilities and services as viewed by internal and external stakeholders


Instruction: Explain GV.OC-04.007.

Output: Establish criteria for determining the criticality of capabilities and services as viewed by internal and external stakeholders


Instruction: What is GV.OC-04.008? (Ex2)

Output: Determine (e.g., from a business impact analysis) assets and business operations that are vital to achieving mission objectives and the potential impact of a loss (or partial loss) of such operations


Instruction: Explain GV.OC-04.008.

Output: Determine (e.g., from a business impact analysis) assets and business operations that are vital to achieving mission objectives and the potential impact of a loss (or partial loss) of such operations


Instruction: What is GV.OC-04.009? (Ex3)

Output: Establish and communicate resilience objectives (e.g., recovery time objectives) for delivering critical capabilities and services in various operating states (e.g., under attack, during recovery, normal operation)


Instruction: Explain GV.OC-04.009.

Output: Establish and communicate resilience objectives (e.g., recovery time objectives) for delivering critical capabilities and services in various operating states (e.g., under attack, during recovery, normal operation)


Instruction: What is GV.OC-05?

Output: Outcomes, capabilities, and services that the organization depends on are understood and communicated


Instruction: Explain the requirement of GV.OC-05.

Output: Outcomes, capabilities, and services that the organization depends on are understood and communicated


Instruction: What outcome is expected by GV.OC-05?

Output: Outcomes, capabilities, and services that the organization depends on are understood and communicated


Instruction: What is GV.OC-05.010? (Ex1)

Output: Create an inventory of the organization's dependencies on external resources (e.g., facilities, cloud-based hosting providers) and their relationships to organizational assets and business functions


Instruction: Explain GV.OC-05.010.

Output: Create an inventory of the organization's dependencies on external resources (e.g., facilities, cloud-based hosting providers) and their relationships to organizational assets and business functions


Instruction: What is GV.OC-05.011? (Ex2)

Output: Identify and document external dependencies that are potential points of failure for the organization's critical capabilities and services, and share that information with appropriate personnel


Instruction: Explain GV.OC-05.011.

Output: Identify and document external dependencies that are potential points of failure for the organization's critical capabilities and services, and share that information with appropriate personnel


Instruction: What is third? (3rd)

Output: 3rd Party Risk


Instruction: Explain third.

Output: 3rd Party Risk


Instruction: What is GV.RM? (Risk Management Strategy)

Output: The organization's priorities, constraints, risk tolerance and appetite statements, and assumptions are established, communicated, and used to support operational risk decisions


Instruction: Summarize the scope of GV.RM.

Output: The organization's priorities, constraints, risk tolerance and appetite statements, and assumptions are established, communicated, and used to support operational risk decisions


Instruction: What does GV.RM cover?

Output: The organization's priorities, constraints, risk tolerance and appetite statements, and assumptions are established, communicated, and used to support operational risk decisions


Instruction: What is GV.RM-01?

Output: Risk management objectives are established and agreed to by organizational stakeholders


Instruction: Explain the requirement of GV.RM-01.

Output: Risk management objectives are established and agreed to by organizational stakeholders


Instruction: What outcome is expected by GV.RM-01?

Output: Risk management objectives are established and agreed to by organizational stakeholders


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is GV.RM-01.012? (Ex1)

Output: Update near-term and long-term cybersecurity risk management objectives as part of annual strategic planning and when major changes occur


Instruction: Explain GV.RM-01.012.

Output: Update near-term and long-term cybersecurity risk management objectives as part of annual strategic planning and when major changes occur


Instruction: What is GV.RM-01.013? (Ex2)

Output: Establish measurable objectives for cybersecurity risk management (e.g., manage the quality of user training, ensure adequate risk protection for industrial control systems)


Instruction: Explain GV.RM-01.013.

Output: Establish measurable objectives for cybersecurity risk management (e.g., manage the quality of user training, ensure adequate risk protection for industrial control systems)


Instruction: What is GV.RM-01.014? (Ex3)

Output: Senior leaders agree about cybersecurity objectives and use them for measuring and managing risk and performance


Instruction: Explain GV.RM-01.014.

Output: Senior leaders agree about cybersecurity objectives and use them for measuring and managing risk and performance


Instruction: What is GV.RM-02?

Output: Risk appetite and risk tolerance statements are established, communicated, and maintained


Instruction: Explain the requirement of GV.RM-02.

Output: Risk appetite and risk tolerance statements are established, communicated, and maintained


Instruction: What outcome is expected by GV.RM-02?

Output: Risk appetite and risk tolerance statements are established, communicated, and maintained


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is third? (3rd)

Output: 3rd Party Risk


Instruction: Explain third.

Output: 3rd Party Risk


Instruction: What is GV.RM-02.015? (Ex1)

Output: Determine and communicate risk appetite statements that convey expectations about the appropriate level of risk for the organization


Instruction: Explain GV.RM-02.015.

Output: Determine and communicate risk appetite statements that convey expectations about the appropriate level of risk for the organization


Instruction: What is GV.RM-02.016? (Ex2)

Output: Translate risk appetite statements into specific, measurable, and broadly understandable risk tolerance statements


Instruction: Explain GV.RM-02.016.

Output: Translate risk appetite statements into specific, measurable, and broadly understandable risk tolerance statements


Instruction: What is GV.RM-02.017? (Ex3)

Output: Refine organizational objectives and risk appetite periodically based on known risk exposure and residual risk


Instruction: Explain GV.RM-02.017.

Output: Refine organizational objectives and risk appetite periodically based on known risk exposure and residual risk


Instruction: What is GV.RM-03?

Output: Cybersecurity risk management activities and outcomes are included in enterprise risk management processes


Instruction: Explain the requirement of GV.RM-03.

Output: Cybersecurity risk management activities and outcomes are included in enterprise risk management processes


Instruction: What outcome is expected by GV.RM-03?

Output: Cybersecurity risk management activities and outcomes are included in enterprise risk management processes


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is GV.RM-03.018? (Ex1)

Output: Aggregate and manage cybersecurity risks alongside other enterprise risks (e.g., compliance, financial, operational, regulatory, reputational, safety)


Instruction: Explain GV.RM-03.018.

Output: Aggregate and manage cybersecurity risks alongside other enterprise risks (e.g., compliance, financial, operational, regulatory, reputational, safety)


Instruction: What is GV.RM-03.019? (Ex2)

Output: Include cybersecurity risk managers in enterprise risk management planning


Instruction: Explain GV.RM-03.019.

Output: Include cybersecurity risk managers in enterprise risk management planning


Instruction: What is GV.RM-03.020? (Ex3)

Output: Establish criteria for escalating cybersecurity risks within enterprise risk management


Instruction: Explain GV.RM-03.020.

Output: Establish criteria for escalating cybersecurity risks within enterprise risk management


Instruction: What is GV.RM-04?

Output: Strategic direction that describes appropriate risk response options is established and communicated


Instruction: Explain the requirement of GV.RM-04.

Output: Strategic direction that describes appropriate risk response options is established and communicated


Instruction: What outcome is expected by GV.RM-04?

Output: Strategic direction that describes appropriate risk response options is established and communicated


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is GV.RM-04.021? (Ex1)

Output: Specify criteria for accepting and avoiding cybersecurity risk for various classifications of data


Instruction: Explain GV.RM-04.021.

Output: Specify criteria for accepting and avoiding cybersecurity risk for various classifications of data


Instruction: What is GV.RM-04.022? (Ex2)

Output: Determine whether to purchase cybersecurity insurance


Instruction: Explain GV.RM-04.022.

Output: Determine whether to purchase cybersecurity insurance


Instruction: What is GV.RM-04.023? (Ex3)

Output: Document conditions under which shared responsibility models are acceptable (e.g., outsourcing certain cybersecurity functions, having a third party perform financial transactions on behalf of the organization, using public cloud-based services)


Instruction: Explain GV.RM-04.023.

Output: Document conditions under which shared responsibility models are acceptable (e.g., outsourcing certain cybersecurity functions, having a third party perform financial transactions on behalf of the organization, using public cloud-based services)


Instruction: What is GV.RM-05?

Output: Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties


Instruction: Explain the requirement of GV.RM-05.

Output: Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties


Instruction: What outcome is expected by GV.RM-05?

Output: Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is third? (3rd)

Output: 3rd Party Risk


Instruction: Explain third.

Output: 3rd Party Risk


Instruction: What is GV.RM-05.024? (Ex1)

Output: Determine how to update senior executives, directors, and management on the organization's cybersecurity posture at agreed-upon intervals


Instruction: Explain GV.RM-05.024.

Output: Determine how to update senior executives, directors, and management on the organization's cybersecurity posture at agreed-upon intervals


Instruction: What is GV.RM-05.025? (Ex2)

Output: Identify how all departments across the organization - such as management, operations, internal auditors, legal, acquisition, physical security, and HR - will communicate with each other about cybersecurity risks


Instruction: Explain GV.RM-05.025.

Output: Identify how all departments across the organization - such as management, operations, internal auditors, legal, acquisition, physical security, and HR - will communicate with each other about cybersecurity risks


Instruction: What is GV.RM-06?

Output: A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated


Instruction: Explain the requirement of GV.RM-06.

Output: A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated


Instruction: What outcome is expected by GV.RM-06?

Output: A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is GV.RM-06.026? (Ex1)

Output: Establish criteria for using a quantitative approach to cybersecurity risk analysis, and specify probability and exposure formulas


Instruction: Explain GV.RM-06.026.

Output: Establish criteria for using a quantitative approach to cybersecurity risk analysis, and specify probability and exposure formulas


Instruction: What is GV.RM-06.027? (Ex2)

Output: Create and use templates (e.g., a risk register) to document cybersecurity risk information (e.g., risk description, exposure, treatment, and ownership)


Instruction: Explain GV.RM-06.027.

Output: Create and use templates (e.g., a risk register) to document cybersecurity risk information (e.g., risk description, exposure, treatment, and ownership)


Instruction: What is GV.RM-06.028? (Ex3)

Output: Establish criteria for risk prioritization at the appropriate levels within the enterprise


Instruction: Explain GV.RM-06.028.

Output: Establish criteria for risk prioritization at the appropriate levels within the enterprise


Instruction: What is GV.RM-06.029? (Ex4)

Output: Use a consistent list of risk categories to support integrating, aggregating, and comparing cybersecurity risks


Instruction: Explain GV.RM-06.029.

Output: Use a consistent list of risk categories to support integrating, aggregating, and comparing cybersecurity risks


Instruction: What is GV.RM-07?

Output: Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions


Instruction: Explain the requirement of GV.RM-07.

Output: Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions


Instruction: What outcome is expected by GV.RM-07?

Output: Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is GV.RM-07.030? (Ex1)

Output: Define and communicate guidance and methods for identifying opportunities and including them in risk discussions (e.g., strengths, weaknesses, opportunities, and threats [SWOT] analysis)


Instruction: Explain GV.RM-07.030.

Output: Define and communicate guidance and methods for identifying opportunities and including them in risk discussions (e.g., strengths, weaknesses, opportunities, and threats [SWOT] analysis)


Instruction: What is GV.RM-07.031? (Ex2)

Output: Identify stretch goals and document them


Instruction: Explain GV.RM-07.031.

Output: Identify stretch goals and document them


Instruction: What is GV.RM-07.032? (Ex3)

Output: Calculate, document, and prioritize positive risks alongside negative risks


Instruction: Explain GV.RM-07.032.

Output: Calculate, document, and prioritize positive risks alongside negative risks


Instruction: What is GV.RR? (Roles, Responsibilities, and Authorities)

Output: Cybersecurity roles, responsibilities, and authorities to foster accountability, performance assessment, and continuous improvement are established and communicated


Instruction: Summarize the scope of GV.RR.

Output: Cybersecurity roles, responsibilities, and authorities to foster accountability, performance assessment, and continuous improvement are established and communicated


Instruction: What does GV.RR cover?

Output: Cybersecurity roles, responsibilities, and authorities to foster accountability, performance assessment, and continuous improvement are established and communicated


Instruction: What is GV.RR-01?

Output: Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving


Instruction: Explain the requirement of GV.RR-01.

Output: Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving


Instruction: What outcome is expected by GV.RR-01?

Output: Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is GV.RR-01.033? (Ex1)

Output: Leaders (e.g., directors) agree on their roles and responsibilities in developing, implementing, and assessing the organization's cybersecurity strategy


Instruction: Explain GV.RR-01.033.

Output: Leaders (e.g., directors) agree on their roles and responsibilities in developing, implementing, and assessing the organization's cybersecurity strategy


Instruction: What is GV.RR-01.034? (Ex2)

Output: Share leaders' expectations regarding a secure and ethical culture, especially when current events present the opportunity to highlight positive or negative examples of cybersecurity risk management


Instruction: Explain GV.RR-01.034.

Output: Share leaders' expectations regarding a secure and ethical culture, especially when current events present the opportunity to highlight positive or negative examples of cybersecurity risk management


Instruction: What is GV.RR-01.035? (Ex3)

Output: Leaders direct the CISO to maintain a comprehensive cybersecurity risk strategy and review and update it at least annually and after major events


Instruction: Explain GV.RR-01.035.

Output: Leaders direct the CISO to maintain a comprehensive cybersecurity risk strategy and review and update it at least annually and after major events


Instruction: What is GV.RR-01.036? (Ex4)

Output: Conduct reviews to ensure adequate authority and coordination among those responsible for managing cybersecurity risk


Instruction: Explain GV.RR-01.036.

Output: Conduct reviews to ensure adequate authority and coordination among those responsible for managing cybersecurity risk


Instruction: What is GV.RR-02?

Output: Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced


Instruction: Explain the requirement of GV.RR-02.

Output: Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced


Instruction: What outcome is expected by GV.RR-02?

Output: Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is GV.RR-02.037? (Ex1)

Output: Document risk management roles and responsibilities in policy


Instruction: Explain GV.RR-02.037.

Output: Document risk management roles and responsibilities in policy


Instruction: What is GV.RR-02.038? (Ex2)

Output: Document who is responsible and accountable for cybersecurity risk management activities and how those teams and individuals are to be consulted and informed


Instruction: Explain GV.RR-02.038.

Output: Document who is responsible and accountable for cybersecurity risk management activities and how those teams and individuals are to be consulted and informed


Instruction: What is GV.RR-02.039? (Ex3)

Output: Include cybersecurity responsibilities and performance requirements in personnel descriptions


Instruction: Explain GV.RR-02.039.

Output: Include cybersecurity responsibilities and performance requirements in personnel descriptions


Instruction: What is GV.RR-02.040? (Ex4)

Output: Document performance goals for personnel with cybersecurity risk management responsibilities, and periodically measure performance to identify areas for improvement


Instruction: Explain GV.RR-02.040.

Output: Document performance goals for personnel with cybersecurity risk management responsibilities, and periodically measure performance to identify areas for improvement


Instruction: What is GV.RR-02.041? (Ex5)

Output: Clearly articulate cybersecurity responsibilities within operations, risk functions, and internal audit functions


Instruction: Explain GV.RR-02.041.

Output: Clearly articulate cybersecurity responsibilities within operations, risk functions, and internal audit functions


Instruction: What is GV.RR-03?

Output: Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies


Instruction: Explain the requirement of GV.RR-03.

Output: Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies


Instruction: What outcome is expected by GV.RR-03?

Output: Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is third? (3rd)

Output: 3rd Party Risk


Instruction: Explain third.

Output: 3rd Party Risk


Instruction: What is GV.RR-03.042? (Ex1)

Output: Conduct periodic management reviews to ensure that those given cybersecurity risk management responsibilities have the necessary authority


Instruction: Explain GV.RR-03.042.

Output: Conduct periodic management reviews to ensure that those given cybersecurity risk management responsibilities have the necessary authority


Instruction: What is GV.RR-03.043? (Ex2)

Output: Identify resource allocation and investment in line with risk tolerance and response


Instruction: Explain GV.RR-03.043.

Output: Identify resource allocation and investment in line with risk tolerance and response


Instruction: What is GV.RR-03.044? (Ex3)

Output: Provide adequate and sufficient people, process, and technical resources to support the cybersecurity strategy


Instruction: Explain GV.RR-03.044.

Output: Provide adequate and sufficient people, process, and technical resources to support the cybersecurity strategy


Instruction: What is GV.RR-04?

Output: Cybersecurity is included in human resources practices


Instruction: Explain the requirement of GV.RR-04.

Output: Cybersecurity is included in human resources practices


Instruction: What outcome is expected by GV.RR-04?

Output: Cybersecurity is included in human resources practices


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is GV.RR-04.045? (Ex1)

Output: Integrate cybersecurity risk management considerations into human resources processes (e.g., personnel screening, onboarding, change notification, offboarding)


Instruction: Explain GV.RR-04.045.

Output: Integrate cybersecurity risk management considerations into human resources processes (e.g., personnel screening, onboarding, change notification, offboarding)


Instruction: What is GV.RR-04.046? (Ex2)

Output: Consider cybersecurity knowledge to be a positive factor in hiring, training, and retention decisions


Instruction: Explain GV.RR-04.046.

Output: Consider cybersecurity knowledge to be a positive factor in hiring, training, and retention decisions


Instruction: What is GV.RR-04.047? (Ex3)

Output: Conduct background checks prior to onboarding new personnel for sensitive roles, and periodically repeat background checks for personnel with such roles


Instruction: Explain GV.RR-04.047.

Output: Conduct background checks prior to onboarding new personnel for sensitive roles, and periodically repeat background checks for personnel with such roles


Instruction: What is GV.RR-04.048? (Ex4)

Output: Define and enforce obligations for personnel to be aware of, adhere to, and uphold security policies as they relate to their roles


Instruction: Explain GV.RR-04.048.

Output: Define and enforce obligations for personnel to be aware of, adhere to, and uphold security policies as they relate to their roles


Instruction: What is GV.PO? (Policy)

Output: Organizational cybersecurity policy is established, communicated, and enforced


Instruction: Summarize the scope of GV.PO.

Output: Organizational cybersecurity policy is established, communicated, and enforced


Instruction: What does GV.PO cover?

Output: Organizational cybersecurity policy is established, communicated, and enforced


Instruction: What is GV.PO-01?

Output: Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced


Instruction: Explain the requirement of GV.PO-01.

Output: Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced


Instruction: What outcome is expected by GV.PO-01?

Output: Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is GV.PO-01.049? (Ex1)

Output: Create, disseminate, and maintain an understandable, usable risk management policy with statements of management intent, expectations, and direction


Instruction: Explain GV.PO-01.049.

Output: Create, disseminate, and maintain an understandable, usable risk management policy with statements of management intent, expectations, and direction


Instruction: What is GV.PO-01.050? (Ex2)

Output: Periodically review policy and supporting processes and procedures to ensure that they align with risk management strategy objectives and priorities, as well as the high-level direction of the cybersecurity policy


Instruction: Explain GV.PO-01.050.

Output: Periodically review policy and supporting processes and procedures to ensure that they align with risk management strategy objectives and priorities, as well as the high-level direction of the cybersecurity policy


Instruction: What is GV.PO-01.051? (Ex3)

Output: Require approval from senior management on policy


Instruction: Explain GV.PO-01.051.

Output: Require approval from senior management on policy


Instruction: What is GV.PO-01.052? (Ex4)

Output: Communicate cybersecurity risk management policy and supporting processes and procedures across the organization


Instruction: Explain GV.PO-01.052.

Output: Communicate cybersecurity risk management policy and supporting processes and procedures across the organization


Instruction: What is GV.PO-01.053? (Ex5)

Output: Require personnel to acknowledge receipt of policy when first hired, annually, and whenever policy is updated


Instruction: Explain GV.PO-01.053.

Output: Require personnel to acknowledge receipt of policy when first hired, annually, and whenever policy is updated


Instruction: What is GV.PO-02?

Output: Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission


Instruction: Explain the requirement of GV.PO-02.

Output: Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission


Instruction: What outcome is expected by GV.PO-02?

Output: Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is GV.PO-02.054? (Ex1)

Output: Update policy based on periodic reviews of cybersecurity risk management results to ensure that policy and supporting processes and procedures adequately maintain risk at an acceptable level


Instruction: Explain GV.PO-02.054.

Output: Update policy based on periodic reviews of cybersecurity risk management results to ensure that policy and supporting processes and procedures adequately maintain risk at an acceptable level


Instruction: What is GV.PO-02.055? (Ex2)

Output: Provide a timeline for reviewing changes to the organization's risk environment (e.g., changes in risk or in the organization's mission objectives), and communicate recommended policy updates


Instruction: Explain GV.PO-02.055.

Output: Provide a timeline for reviewing changes to the organization's risk environment (e.g., changes in risk or in the organization's mission objectives), and communicate recommended policy updates


Instruction: What is GV.PO-02.056? (Ex3)

Output: Update policy to reflect changes in legal and regulatory requirements


Instruction: Explain GV.PO-02.056.

Output: Update policy to reflect changes in legal and regulatory requirements


Instruction: What is GV.PO-02.057? (Ex4)

Output: Update policy to reflect changes in technology (e.g., adoption of artificial intelligence) and changes to the business (e.g., acquisition of a new business, new contract requirements)


Instruction: Explain GV.PO-02.057.

Output: Update policy to reflect changes in technology (e.g., adoption of artificial intelligence) and changes to the business (e.g., acquisition of a new business, new contract requirements)


Instruction: What is GV.OV? (Oversight)

Output: Results of organization-wide cybersecurity risk management activities and performance are used to inform, improve, and adjust the risk management strategy


Instruction: Summarize the scope of GV.OV.

Output: Results of organization-wide cybersecurity risk management activities and performance are used to inform, improve, and adjust the risk management strategy


Instruction: What does GV.OV cover?

Output: Results of organization-wide cybersecurity risk management activities and performance are used to inform, improve, and adjust the risk management strategy


Instruction: What is GV.OV-01?

Output: Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction


Instruction: Explain the requirement of GV.OV-01.

Output: Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction


Instruction: What outcome is expected by GV.OV-01?

Output: Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is GV.OV-01.058? (Ex1)

Output: Measure how well the risk management strategy and risk results have helped leaders make decisions and achieve organizational objectives


Instruction: Explain GV.OV-01.058.

Output: Measure how well the risk management strategy and risk results have helped leaders make decisions and achieve organizational objectives


Instruction: What is GV.OV-01.059? (Ex2)

Output: Examine whether cybersecurity risk strategies that impede operations or innovation should be adjusted


Instruction: Explain GV.OV-01.059.

Output: Examine whether cybersecurity risk strategies that impede operations or innovation should be adjusted


Instruction: What is GV.OV-02?

Output: The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks


Instruction: Explain the requirement of GV.OV-02.

Output: The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks


Instruction: What outcome is expected by GV.OV-02?

Output: The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is GV.OV-02.060? (Ex1)

Output: Review audit findings to confirm whether the existing cybersecurity strategy has ensured compliance with internal and external requirements


Instruction: Explain GV.OV-02.060.

Output: Review audit findings to confirm whether the existing cybersecurity strategy has ensured compliance with internal and external requirements


Instruction: What is GV.OV-02.061? (Ex2)

Output: Review the performance oversight of those in cybersecurity-related roles to determine whether policy changes are necessary


Instruction: Explain GV.OV-02.061.

Output: Review the performance oversight of those in cybersecurity-related roles to determine whether policy changes are necessary


Instruction: What is GV.OV-02.062? (Ex3)

Output: Review strategy in light of cybersecurity incidents


Instruction: Explain GV.OV-02.062.

Output: Review strategy in light of cybersecurity incidents


Instruction: What is GV.OV-03?

Output: Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed


Instruction: Explain the requirement of GV.OV-03.

Output: Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed


Instruction: What outcome is expected by GV.OV-03?

Output: Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is GV.OV-03.063? (Ex1)

Output: Review key performance indicators (KPIs) to ensure that organization-wide policies and procedures achieve objectives


Instruction: Explain GV.OV-03.063.

Output: Review key performance indicators (KPIs) to ensure that organization-wide policies and procedures achieve objectives


Instruction: What is GV.OV-03.064? (Ex2)

Output: Review key risk indicators (KRIs) to identify risks the organization faces, including likelihood and potential impact


Instruction: Explain GV.OV-03.064.

Output: Review key risk indicators (KRIs) to identify risks the organization faces, including likelihood and potential impact


Instruction: What is GV.OV-03.065? (Ex3)

Output: Collect and communicate metrics on cybersecurity risk management with senior leadership


Instruction: Explain GV.OV-03.065.

Output: Collect and communicate metrics on cybersecurity risk management with senior leadership


Instruction: What is GV.SC? (Cybersecurity Supply Chain Risk Management)

Output: Cyber supply chain risk management processes are identified, established, managed, monitored, and improved by organizational stakeholders


Instruction: Summarize the scope of GV.SC.

Output: Cyber supply chain risk management processes are identified, established, managed, monitored, and improved by organizational stakeholders


Instruction: What does GV.SC cover?

Output: Cyber supply chain risk management processes are identified, established, managed, monitored, and improved by organizational stakeholders


Instruction: What is GV.SC-01?

Output: A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders


Instruction: Explain the requirement of GV.SC-01.

Output: A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders


Instruction: What outcome is expected by GV.SC-01?

Output: A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders


Instruction: What is GV.SC-01.066? (Ex1)

Output: Establish a strategy that expresses the objectives of the cybersecurity supply chain risk management program


Instruction: Explain GV.SC-01.066.

Output: Establish a strategy that expresses the objectives of the cybersecurity supply chain risk management program


Instruction: What is GV.SC-01.067? (Ex2)

Output: Develop the cybersecurity supply chain risk management program, including a plan (with milestones), policies, and procedures that guide implementation and improvement of the program, and share the policies and procedures with the organizational stakeholders


Instruction: Explain GV.SC-01.067.

Output: Develop the cybersecurity supply chain risk management program, including a plan (with milestones), policies, and procedures that guide implementation and improvement of the program, and share the policies and procedures with the organizational stakeholders


Instruction: What is GV.SC-01.068? (Ex3)

Output: Develop and implement program processes based on the strategy, objectives, policies, and procedures that are agreed upon and performed by the organizational stakeholders


Instruction: Explain GV.SC-01.068.

Output: Develop and implement program processes based on the strategy, objectives, policies, and procedures that are agreed upon and performed by the organizational stakeholders


Instruction: What is GV.SC-01.069? (Ex4)

Output: Establish a cross-organizational mechanism that ensures alignment between functions that contribute to cybersecurity supply chain risk management, such as cybersecurity, IT, operations, legal, human resources, and engineering


Instruction: Explain GV.SC-01.069.

Output: Establish a cross-organizational mechanism that ensures alignment between functions that contribute to cybersecurity supply chain risk management, such as cybersecurity, IT, operations, legal, human resources, and engineering


Instruction: What is third? (3rd)

Output: 3rd Party Risk


Instruction: Explain third.

Output: 3rd Party Risk


Instruction: What is GV.SC-02?

Output: Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally


Instruction: Explain the requirement of GV.SC-02.

Output: Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally


Instruction: What outcome is expected by GV.SC-02?

Output: Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally


Instruction: What is GV.SC-02.070? (Ex1)

Output: Identify one or more specific roles or positions that will be responsible and accountable for planning, resourcing, and executing cybersecurity supply chain risk management activities


Instruction: Explain GV.SC-02.070.

Output: Identify one or more specific roles or positions that will be responsible and accountable for planning, resourcing, and executing cybersecurity supply chain risk management activities


Instruction: What is GV.SC-02.071? (Ex2)

Output: Document cybersecurity supply chain risk management roles and responsibilities in policy


Instruction: Explain GV.SC-02.071.

Output: Document cybersecurity supply chain risk management roles and responsibilities in policy


Instruction: What is GV.SC-02.072? (Ex3)

Output: Create responsibility matrixes to document who will be responsible and accountable for cybersecurity supply chain risk management activities and how those teams and individuals will be consulted and informed


Instruction: Explain GV.SC-02.072.

Output: Create responsibility matrixes to document who will be responsible and accountable for cybersecurity supply chain risk management activities and how those teams and individuals will be consulted and informed


Instruction: What is GV.SC-02.073? (Ex4)

Output: Include cybersecurity supply chain risk management responsibilities and performance requirements in personnel descriptions to ensure clarity and improve accountability


Instruction: Explain GV.SC-02.073.

Output: Include cybersecurity supply chain risk management responsibilities and performance requirements in personnel descriptions to ensure clarity and improve accountability


Instruction: What is GV.SC-02.074? (Ex5)

Output: Document performance goals for personnel with cybersecurity risk management-specific responsibilities, and periodically measure them to demonstrate and improve performance


Instruction: Explain GV.SC-02.074.

Output: Document performance goals for personnel with cybersecurity risk management-specific responsibilities, and periodically measure them to demonstrate and improve performance


Instruction: What is GV.SC-02.075? (Ex6)

Output: Develop roles and responsibilities for suppliers, customers, and business partners to address shared responsibilities for applicable cybersecurity risks, and integrate them into organizational policies and applicable third-party agreements


Instruction: Explain GV.SC-02.075.

Output: Develop roles and responsibilities for suppliers, customers, and business partners to address shared responsibilities for applicable cybersecurity risks, and integrate them into organizational policies and applicable third-party agreements


Instruction: What is GV.SC-02.076? (Ex7)

Output: Internally communicate cybersecurity supply chain risk management roles and responsibilities for third parties


Instruction: Explain GV.SC-02.076.

Output: Internally communicate cybersecurity supply chain risk management roles and responsibilities for third parties


Instruction: What is GV.SC-02.077? (Ex8)

Output: Establish rules and protocols for information sharing and reporting processes between the organization and its suppliers


Instruction: Explain GV.SC-02.077.

Output: Establish rules and protocols for information sharing and reporting processes between the organization and its suppliers


Instruction: What is third? (3rd)

Output: 3rd Party Risk


Instruction: Explain third.

Output: 3rd Party Risk


Instruction: What is GV.SC-03?

Output: Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes


Instruction: Explain the requirement of GV.SC-03.

Output: Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes


Instruction: What outcome is expected by GV.SC-03?

Output: Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes


Instruction: What is GV.SC-03.078? (Ex1)

Output: Identify areas of alignment and overlap with cybersecurity and enterprise risk management


Instruction: Explain GV.SC-03.078.

Output: Identify areas of alignment and overlap with cybersecurity and enterprise risk management


Instruction: What is GV.SC-03.079? (Ex2)

Output: Establish integrated control sets for cybersecurity risk management and cybersecurity supply chain risk management


Instruction: Explain GV.SC-03.079.

Output: Establish integrated control sets for cybersecurity risk management and cybersecurity supply chain risk management


Instruction: What is GV.SC-03.080? (Ex3)

Output: Integrate cybersecurity supply chain risk management into improvement processes


Instruction: Explain GV.SC-03.080.

Output: Integrate cybersecurity supply chain risk management into improvement processes


Instruction: What is GV.SC-03.081? (Ex4)

Output: Escalate material cybersecurity risks in supply chains to senior management, and address them at the enterprise risk management level


Instruction: Explain GV.SC-03.081.

Output: Escalate material cybersecurity risks in supply chains to senior management, and address them at the enterprise risk management level


Instruction: What is third? (3rd)

Output: 3rd Party Risk


Instruction: Explain third.

Output: 3rd Party Risk


Instruction: What is GV.SC-04?

Output: Suppliers are known and prioritized by criticality


Instruction: Explain the requirement of GV.SC-04.

Output: Suppliers are known and prioritized by criticality


Instruction: What outcome is expected by GV.SC-04?

Output: Suppliers are known and prioritized by criticality


Instruction: What is GV.SC-04.082? (Ex1)

Output: Develop criteria for supplier criticality based on, for example, the sensitivity of data processed or possessed by suppliers, the degree of access to the organization's systems, and the importance of the products or services to the organization's mission


Instruction: Explain GV.SC-04.082.

Output: Develop criteria for supplier criticality based on, for example, the sensitivity of data processed or possessed by suppliers, the degree of access to the organization's systems, and the importance of the products or services to the organization's mission


Instruction: What is GV.SC-04.083? (Ex2)

Output: Keep a record of all suppliers, and prioritize suppliers based on the criticality criteria


Instruction: Explain GV.SC-04.083.

Output: Keep a record of all suppliers, and prioritize suppliers based on the criticality criteria


Instruction: What is third? (3rd)

Output: 3rd Party Risk


Instruction: Explain third.

Output: 3rd Party Risk


Instruction: What is GV.SC-05?

Output: Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties


Instruction: Explain the requirement of GV.SC-05.

Output: Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties


Instruction: What outcome is expected by GV.SC-05?

Output: Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties


Instruction: What is GV.SC-05.084? (Ex1)

Output: Establish security requirements for suppliers, products, and services commensurate with their criticality level and potential impact if compromised


Instruction: Explain GV.SC-05.084.

Output: Establish security requirements for suppliers, products, and services commensurate with their criticality level and potential impact if compromised


Instruction: What is GV.SC-05.085? (Ex2)

Output: Include all cybersecurity and supply chain requirements that third parties must follow and how compliance with the requirements may be verified in default contractual language


Instruction: Explain GV.SC-05.085.

Output: Include all cybersecurity and supply chain requirements that third parties must follow and how compliance with the requirements may be verified in default contractual language


Instruction: What is GV.SC-05.086? (Ex3)

Output: Define the rules and protocols for information sharing between the organization and its suppliers and sub-tier suppliers in agreements


Instruction: Explain GV.SC-05.086.

Output: Define the rules and protocols for information sharing between the organization and its suppliers and sub-tier suppliers in agreements


Instruction: What is GV.SC-05.087? (Ex4)

Output: Manage risk by including security requirements in agreements based on their criticality and potential impact if compromised


Instruction: Explain GV.SC-05.087.

Output: Manage risk by including security requirements in agreements based on their criticality and potential impact if compromised


Instruction: What is GV.SC-05.088? (Ex5)

Output: Define security requirements in service-level agreements (SLAs) for monitoring suppliers for acceptable security performance throughout the supplier relationship lifecycle


Instruction: Explain GV.SC-05.088.

Output: Define security requirements in service-level agreements (SLAs) for monitoring suppliers for acceptable security performance throughout the supplier relationship lifecycle


Instruction: What is GV.SC-05.089? (Ex6)

Output: Contractually require suppliers to disclose cybersecurity features, functions, and vulnerabilities of their products and services for the life of the product or the term of service


Instruction: Explain GV.SC-05.089.

Output: Contractually require suppliers to disclose cybersecurity features, functions, and vulnerabilities of their products and services for the life of the product or the term of service


Instruction: What is GV.SC-05.090? (Ex7)

Output: Contractually require suppliers to provide and maintain a current component inventory (e.g., software or hardware bill of materials) for critical products


Instruction: Explain GV.SC-05.090.

Output: Contractually require suppliers to provide and maintain a current component inventory (e.g., software or hardware bill of materials) for critical products


Instruction: What is GV.SC-05.091? (Ex8)

Output: Contractually require suppliers to vet their employees and guard against insider threats


Instruction: Explain GV.SC-05.091.

Output: Contractually require suppliers to vet their employees and guard against insider threats


Instruction: What is GV.SC-05.092? (Ex9)

Output: Contractually require suppliers to provide evidence of performing acceptable security practices through, for example, self-attestation, conformance to known standards, certifications, or inspections


Instruction: Explain GV.SC-05.092.

Output: Contractually require suppliers to provide evidence of performing acceptable security practices through, for example, self-attestation, conformance to known standards, certifications, or inspections


Instruction: What is GV.SC-05.093? (Ex10)

Output: Specify in contracts and other agreements the rights and responsibilities of the organization, its suppliers, and their supply chains, with respect to potential cybersecurity risks


Instruction: Explain GV.SC-05.093.

Output: Specify in contracts and other agreements the rights and responsibilities of the organization, its suppliers, and their supply chains, with respect to potential cybersecurity risks


Instruction: What is third? (3rd)

Output: 3rd Party Risk


Instruction: Explain third.

Output: 3rd Party Risk


Instruction: What is GV.SC-06?

Output: Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships


Instruction: Explain the requirement of GV.SC-06.

Output: Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships


Instruction: What outcome is expected by GV.SC-06?

Output: Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships


Instruction: What is GV.SC-06.094? (Ex1)

Output: Perform thorough due diligence on prospective suppliers that is consistent with procurement planning and commensurate with the level of risk, criticality, and complexity of each supplier relationship


Instruction: Explain GV.SC-06.094.

Output: Perform thorough due diligence on prospective suppliers that is consistent with procurement planning and commensurate with the level of risk, criticality, and complexity of each supplier relationship


Instruction: What is GV.SC-06.095? (Ex2)

Output: Assess the suitability of the technology and cybersecurity capabilities and the risk management practices of prospective suppliers


Instruction: Explain GV.SC-06.095.

Output: Assess the suitability of the technology and cybersecurity capabilities and the risk management practices of prospective suppliers


Instruction: What is GV.SC-06.096? (Ex3)

Output: Conduct supplier risk assessments against business and applicable cybersecurity requirements


Instruction: Explain GV.SC-06.096.

Output: Conduct supplier risk assessments against business and applicable cybersecurity requirements


Instruction: What is GV.SC-06.097? (Ex4)

Output: Assess the authenticity, integrity, and security of critical products prior to acquisition and use


Instruction: Explain GV.SC-06.097.

Output: Assess the authenticity, integrity, and security of critical products prior to acquisition and use


Instruction: What is third? (3rd)

Output: 3rd Party Risk


Instruction: Explain third.

Output: 3rd Party Risk


Instruction: What is GV.SC-07?

Output: The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship


Instruction: Explain the requirement of GV.SC-07.

Output: The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship


Instruction: What outcome is expected by GV.SC-07?

Output: The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship


Instruction: What is GV.SC-07.098? (Ex1)

Output: Adjust assessment formats and frequencies based on the third party's reputation and the criticality of the products or services they provide


Instruction: Explain GV.SC-07.098.

Output: Adjust assessment formats and frequencies based on the third party's reputation and the criticality of the products or services they provide


Instruction: What is GV.SC-07.099? (Ex2)

Output: Evaluate third parties' evidence of compliance with contractual cybersecurity requirements, such as self-attestations, warranties, certifications, and other artifacts


Instruction: Explain GV.SC-07.099.

Output: Evaluate third parties' evidence of compliance with contractual cybersecurity requirements, such as self-attestations, warranties, certifications, and other artifacts


Instruction: What is GV.SC-07.100? (Ex3)

Output: Monitor critical suppliers to ensure that they are fulfilling their security obligations throughout the supplier relationship lifecycle using a variety of methods and techniques, such as inspections, audits, tests, or other forms of evaluation


Instruction: Explain GV.SC-07.100.

Output: Monitor critical suppliers to ensure that they are fulfilling their security obligations throughout the supplier relationship lifecycle using a variety of methods and techniques, such as inspections, audits, tests, or other forms of evaluation


Instruction: What is GV.SC-07.101? (Ex4)

Output: Monitor critical suppliers, services, and products for changes to their risk profiles, and reevaluate supplier criticality and risk impact accordingly


Instruction: Explain GV.SC-07.101.

Output: Monitor critical suppliers, services, and products for changes to their risk profiles, and reevaluate supplier criticality and risk impact accordingly


Instruction: What is GV.SC-07.102? (Ex5)

Output: Plan for unexpected supplier and supply chain-related interruptions to ensure business continuity


Instruction: Explain GV.SC-07.102.

Output: Plan for unexpected supplier and supply chain-related interruptions to ensure business continuity


Instruction: What is third? (3rd)

Output: 3rd Party Risk


Instruction: Explain third.

Output: 3rd Party Risk


Instruction: What is GV.SC-08?

Output: Relevant suppliers and other third parties are included in incident planning, response, and recovery activities


Instruction: Explain the requirement of GV.SC-08.

Output: Relevant suppliers and other third parties are included in incident planning, response, and recovery activities


Instruction: What outcome is expected by GV.SC-08?

Output: Relevant suppliers and other third parties are included in incident planning, response, and recovery activities


Instruction: What is GV.SC-08.103? (Ex1)

Output: Define and use rules and protocols for reporting incident response and recovery activities and the status between the organization and its suppliers


Instruction: Explain GV.SC-08.103.

Output: Define and use rules and protocols for reporting incident response and recovery activities and the status between the organization and its suppliers


Instruction: What is GV.SC-08.104? (Ex2)

Output: Identify and document the roles and responsibilities of the organization and its suppliers for incident response


Instruction: Explain GV.SC-08.104.

Output: Identify and document the roles and responsibilities of the organization and its suppliers for incident response


Instruction: What is GV.SC-08.105? (Ex3)

Output: Include critical suppliers in incident response exercises and simulations


Instruction: Explain GV.SC-08.105.

Output: Include critical suppliers in incident response exercises and simulations


Instruction: What is GV.SC-08.106? (Ex4)

Output: Define and coordinate crisis communication methods and protocols between the organization and its critical suppliers


Instruction: Explain GV.SC-08.106.

Output: Define and coordinate crisis communication methods and protocols between the organization and its critical suppliers


Instruction: What is GV.SC-08.107? (Ex5)

Output: Conduct collaborative lessons learned sessions with critical suppliers


Instruction: Explain GV.SC-08.107.

Output: Conduct collaborative lessons learned sessions with critical suppliers


Instruction: What is third? (3rd)

Output: 3rd Party Risk


Instruction: Explain third.

Output: 3rd Party Risk


Instruction: What is GV.SC-09?

Output: Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle


Instruction: Explain the requirement of GV.SC-09.

Output: Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle


Instruction: What outcome is expected by GV.SC-09?

Output: Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle


Instruction: What is GV.SC-09.108? (Ex1)

Output: Policies and procedures require provenance records for all acquired technology products and services


Instruction: Explain GV.SC-09.108.

Output: Policies and procedures require provenance records for all acquired technology products and services


Instruction: What is GV.SC-09.109? (Ex2)

Output: Periodically provide risk reporting to leaders about how acquired components are proven to be untampered and authentic


Instruction: Explain GV.SC-09.109.

Output: Periodically provide risk reporting to leaders about how acquired components are proven to be untampered and authentic


Instruction: What is GV.SC-09.110? (Ex3)

Output: Communicate regularly among cybersecurity risk managers and operations personnel about the need to acquire software patches, updates, and upgrades only from authenticated and trustworthy software providers


Instruction: Explain GV.SC-09.110.

Output: Communicate regularly among cybersecurity risk managers and operations personnel about the need to acquire software patches, updates, and upgrades only from authenticated and trustworthy software providers


Instruction: What is GV.SC-09.111? (Ex4)

Output: Review policies to ensure that they require approved supplier personnel to perform maintenance on supplier products


Instruction: Explain GV.SC-09.111.

Output: Review policies to ensure that they require approved supplier personnel to perform maintenance on supplier products


Instruction: What is GV.SC-09.112? (Ex5)

Output: Policies and procedure require checking upgrades to critical hardware for unauthorized changes


Instruction: Explain GV.SC-09.112.

Output: Policies and procedure require checking upgrades to critical hardware for unauthorized changes


Instruction: What is third? (3rd)

Output: 3rd Party Risk


Instruction: Explain third.

Output: 3rd Party Risk


Instruction: What is GV.SC-10?

Output: Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement


Instruction: Explain the requirement of GV.SC-10.

Output: Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement


Instruction: What outcome is expected by GV.SC-10?

Output: Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement


Instruction: What is GV.SC-10.113? (Ex1)

Output: Establish processes for terminating critical relationships under both normal and adverse circumstances


Instruction: Explain GV.SC-10.113.

Output: Establish processes for terminating critical relationships under both normal and adverse circumstances


Instruction: What is GV.SC-10.114? (Ex2)

Output: Define and implement plans for component end-of-life maintenance support and obsolescence


Instruction: Explain GV.SC-10.114.

Output: Define and implement plans for component end-of-life maintenance support and obsolescence


Instruction: What is GV.SC-10.115? (Ex3)

Output: Verify that supplier access to organization resources is deactivated promptly when it is no longer needed


Instruction: Explain GV.SC-10.115.

Output: Verify that supplier access to organization resources is deactivated promptly when it is no longer needed


Instruction: What is GV.SC-10.116? (Ex4)

Output: Verify that assets containing the organization's data are returned or properly disposed of in a timely, controlled, and safe manner


Instruction: Explain GV.SC-10.116.

Output: Verify that assets containing the organization's data are returned or properly disposed of in a timely, controlled, and safe manner


Instruction: What is GV.SC-10.117? (Ex5)

Output: Develop and execute a plan for terminating or transitioning supplier relationships that takes supply chain security risk and resiliency into account


Instruction: Explain GV.SC-10.117.

Output: Develop and execute a plan for terminating or transitioning supplier relationships that takes supply chain security risk and resiliency into account


Instruction: What is GV.SC-10.118? (Ex6)

Output: Mitigate risks to data and systems created by supplier termination


Instruction: Explain GV.SC-10.118.

Output: Mitigate risks to data and systems created by supplier termination


Instruction: What is GV.SC-10.119? (Ex7)

Output: Manage data leakage risks associated with supplier termination


Instruction: Explain GV.SC-10.119.

Output: Manage data leakage risks associated with supplier termination


Instruction: What is third? (3rd)

Output: 3rd Party Risk


Instruction: Explain third.

Output: 3rd Party Risk


Instruction: What is ID? (IDENTIFY)

Output: The organization's current cybersecurity risks are understood


Instruction: Summarize the scope of ID.

Output: The organization's current cybersecurity risks are understood


Instruction: What does ID cover?

Output: The organization's current cybersecurity risks are understood


Instruction: What is ID.AM? (Asset Management)

Output: Assets (e.g., data, hardware, software, systems, facilities, services, people) that enable the organization to achieve business purposes are identified and managed consistent with their relative importance to organizational objectives and the organization's risk strategy


Instruction: Summarize the scope of ID.AM.

Output: Assets (e.g., data, hardware, software, systems, facilities, services, people) that enable the organization to achieve business purposes are identified and managed consistent with their relative importance to organizational objectives and the organization's risk strategy


Instruction: What does ID.AM cover?

Output: Assets (e.g., data, hardware, software, systems, facilities, services, people) that enable the organization to achieve business purposes are identified and managed consistent with their relative importance to organizational objectives and the organization's risk strategy


Instruction: What is ID.AM-01?

Output: Inventories of hardware managed by the organization are maintained


Instruction: Explain the requirement of ID.AM-01.

Output: Inventories of hardware managed by the organization are maintained


Instruction: What outcome is expected by ID.AM-01?

Output: Inventories of hardware managed by the organization are maintained


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is ID.AM-01.120? (Ex1)

Output: Maintain inventories for all types of hardware, including IT, IoT, OT, and mobile devices


Instruction: Explain ID.AM-01.120.

Output: Maintain inventories for all types of hardware, including IT, IoT, OT, and mobile devices


Instruction: What is ID.AM-01.121? (Ex2)

Output: Constantly monitor networks to detect new hardware and automatically update inventories


Instruction: Explain ID.AM-01.121.

Output: Constantly monitor networks to detect new hardware and automatically update inventories


Instruction: What is ID.AM-02?

Output: Inventories of software, services, and systems managed by the organization are maintained


Instruction: Explain the requirement of ID.AM-02.

Output: Inventories of software, services, and systems managed by the organization are maintained


Instruction: What outcome is expected by ID.AM-02?

Output: Inventories of software, services, and systems managed by the organization are maintained


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is ID.AM-02.122? (Ex1)

Output: Maintain inventories for all types of software and services, including commercial-off-the-shelf, open-source, custom applications, API services, and cloud-based applications and services


Instruction: Explain ID.AM-02.122.

Output: Maintain inventories for all types of software and services, including commercial-off-the-shelf, open-source, custom applications, API services, and cloud-based applications and services


Instruction: What is ID.AM-02.123? (Ex2)

Output: Constantly monitor all platforms, including containers and virtual machines, for software and service inventory changes


Instruction: Explain ID.AM-02.123.

Output: Constantly monitor all platforms, including containers and virtual machines, for software and service inventory changes


Instruction: What is ID.AM-02.124? (Ex3)

Output: Maintain an inventory of the organization's systems


Instruction: Explain ID.AM-02.124.

Output: Maintain an inventory of the organization's systems


Instruction: What is ID.AM-03?

Output: Representations of the organization's authorized network communication and internal and external network data flows are maintained


Instruction: Explain the requirement of ID.AM-03.

Output: Representations of the organization's authorized network communication and internal and external network data flows are maintained


Instruction: What outcome is expected by ID.AM-03?

Output: Representations of the organization's authorized network communication and internal and external network data flows are maintained


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is third? (3rd)

Output: 3rd Party Risk


Instruction: Explain third.

Output: 3rd Party Risk


Instruction: What is ID.AM-03.125? (Ex1)

Output: Maintain baselines of communication and data flows within the organization's wired and wireless networks


Instruction: Explain ID.AM-03.125.

Output: Maintain baselines of communication and data flows within the organization's wired and wireless networks


Instruction: What is ID.AM-03.126? (Ex2)

Output: Maintain baselines of communication and data flows between the organization and third parties


Instruction: Explain ID.AM-03.126.

Output: Maintain baselines of communication and data flows between the organization and third parties


Instruction: What is ID.AM-03.127? (Ex3)

Output: Maintain baselines of communication and data flows for the organization's infrastructure-as-a-service (IaaS) usage


Instruction: Explain ID.AM-03.127.

Output: Maintain baselines of communication and data flows for the organization's infrastructure-as-a-service (IaaS) usage


Instruction: What is ID.AM-03.128? (Ex4)

Output: Maintain documentation of expected network ports, protocols, and services that are typically used among authorized systems


Instruction: Explain ID.AM-03.128.

Output: Maintain documentation of expected network ports, protocols, and services that are typically used among authorized systems


Instruction: What is ID.AM-04?

Output: Inventories of services provided by suppliers are maintained


Instruction: Explain the requirement of ID.AM-04.

Output: Inventories of services provided by suppliers are maintained


Instruction: What outcome is expected by ID.AM-04?

Output: Inventories of services provided by suppliers are maintained


Instruction: What is ID.AM-04.129? (Ex1)

Output: Inventory all external services used by the organization, including third-party infrastructure-as-a-service (IaaS), platform-as-a-service (PaaS), and software-as-a-service (SaaS) offerings; APIs; and other externally hosted application services


Instruction: Explain ID.AM-04.129.

Output: Inventory all external services used by the organization, including third-party infrastructure-as-a-service (IaaS), platform-as-a-service (PaaS), and software-as-a-service (SaaS) offerings; APIs; and other externally hosted application services


Instruction: What is ID.AM-04.130? (Ex2)

Output: Update the inventory when a new external service is going to be utilized to ensure adequate cybersecurity risk management monitoring of the organization's use of that service


Instruction: Explain ID.AM-04.130.

Output: Update the inventory when a new external service is going to be utilized to ensure adequate cybersecurity risk management monitoring of the organization's use of that service


Instruction: What is third? (3rd)

Output: 3rd Party Risk


Instruction: Explain third.

Output: 3rd Party Risk


Instruction: What is ID.AM-05?

Output: Assets are prioritized based on classification, criticality, resources, and impact on the mission


Instruction: Explain the requirement of ID.AM-05.

Output: Assets are prioritized based on classification, criticality, resources, and impact on the mission


Instruction: What outcome is expected by ID.AM-05?

Output: Assets are prioritized based on classification, criticality, resources, and impact on the mission


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is ID.AM-05.131? (Ex1)

Output: Define criteria for prioritizing each class of assets


Instruction: Explain ID.AM-05.131.

Output: Define criteria for prioritizing each class of assets


Instruction: What is ID.AM-05.132? (Ex2)

Output: Apply the prioritization criteria to assets


Instruction: Explain ID.AM-05.132.

Output: Apply the prioritization criteria to assets


Instruction: What is ID.AM-05.133? (Ex3)

Output: Track the asset priorities and update them periodically or when significant changes to the organization occur


Instruction: Explain ID.AM-05.133.

Output: Track the asset priorities and update them periodically or when significant changes to the organization occur


Instruction: What is ID.AM-06?

Output: Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established


Instruction: Explain the requirement of ID.AM-06.

Output: Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established


Instruction: What outcome is expected by ID.AM-06?

Output: Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established


Instruction: What is WR-ID.AM-06?

Output: Incorporated into GV.RR-02, GV.SC-02


Instruction: Explain WR-ID.AM-06.

Output: Incorporated into GV.RR-02, GV.SC-02


Instruction: What is ID.AM-07?

Output: Inventories of data and corresponding metadata for designated data types are maintained


Instruction: Explain the requirement of ID.AM-07.

Output: Inventories of data and corresponding metadata for designated data types are maintained


Instruction: What outcome is expected by ID.AM-07?

Output: Inventories of data and corresponding metadata for designated data types are maintained


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is ID.AM-07.134? (Ex1)

Output: Maintain a list of the designated data types of interest (e.g., personally identifiable information, protected health information, financial account numbers, organization intellectual property, operational technology data)


Instruction: Explain ID.AM-07.134.

Output: Maintain a list of the designated data types of interest (e.g., personally identifiable information, protected health information, financial account numbers, organization intellectual property, operational technology data)


Instruction: What is ID.AM-07.135? (Ex2)

Output: Continuously discover and analyze ad hoc data to identify new instances of designated data types


Instruction: Explain ID.AM-07.135.

Output: Continuously discover and analyze ad hoc data to identify new instances of designated data types


Instruction: What is ID.AM-07.136? (Ex3)

Output: Assign data classifications to designated data types through tags or labels


Instruction: Explain ID.AM-07.136.

Output: Assign data classifications to designated data types through tags or labels


Instruction: What is ID.AM-07.137? (Ex4)

Output: Track the provenance, data owner, and geolocation of each instance of designated data types


Instruction: Explain ID.AM-07.137.

Output: Track the provenance, data owner, and geolocation of each instance of designated data types


Instruction: What is ID.AM-08?

Output: Systems, hardware, software, services, and data are managed throughout their life cycles


Instruction: Explain the requirement of ID.AM-08.

Output: Systems, hardware, software, services, and data are managed throughout their life cycles


Instruction: What outcome is expected by ID.AM-08?

Output: Systems, hardware, software, services, and data are managed throughout their life cycles


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is third? (3rd)

Output: 3rd Party Risk


Instruction: Explain third.

Output: 3rd Party Risk


Instruction: What is ID.AM-08.138? (Ex1)

Output: Integrate cybersecurity considerations throughout the life cycles of systems, hardware, software, and services


Instruction: Explain ID.AM-08.138.

Output: Integrate cybersecurity considerations throughout the life cycles of systems, hardware, software, and services


Instruction: What is ID.AM-08.139? (Ex2)

Output: Integrate cybersecurity considerations into product life cycles


Instruction: Explain ID.AM-08.139.

Output: Integrate cybersecurity considerations into product life cycles


Instruction: What is ID.AM-08.140? (Ex3)

Output: Identify unofficial uses of technology to meet mission objectives (i.e., shadow IT)


Instruction: Explain ID.AM-08.140.

Output: Identify unofficial uses of technology to meet mission objectives (i.e., shadow IT)


Instruction: What is ID.AM-08.141? (Ex4)

Output: Periodically identify redundant systems, hardware, software, and services that unnecessarily increase the organization's attack surface


Instruction: Explain ID.AM-08.141.

Output: Periodically identify redundant systems, hardware, software, and services that unnecessarily increase the organization's attack surface


Instruction: What is ID.AM-08.142? (Ex5)

Output: Properly configure and secure systems, hardware, software, and services prior to their deployment in production


Instruction: Explain ID.AM-08.142.

Output: Properly configure and secure systems, hardware, software, and services prior to their deployment in production


Instruction: What is ID.AM-08.143? (Ex6)

Output: Update inventories when systems, hardware, software, and services are moved or transferred within the organization


Instruction: Explain ID.AM-08.143.

Output: Update inventories when systems, hardware, software, and services are moved or transferred within the organization


Instruction: What is ID.AM-08.144? (Ex7)

Output: Securely destroy stored data based on the organization's data retention policy using the prescribed destruction method, and keep and manage a record of the destructions


Instruction: Explain ID.AM-08.144.

Output: Securely destroy stored data based on the organization's data retention policy using the prescribed destruction method, and keep and manage a record of the destructions


Instruction: What is ID.AM-08.145? (Ex8)

Output: Securely sanitize data storage when hardware is being retired, decommissioned, reassigned, or sent for repairs or replacement


Instruction: Explain ID.AM-08.145.

Output: Securely sanitize data storage when hardware is being retired, decommissioned, reassigned, or sent for repairs or replacement


Instruction: What is ID.AM-08.146? (Ex9)

Output: Offer methods for destroying paper, storage media, and other physical forms of data storage


Instruction: Explain ID.AM-08.146.

Output: Offer methods for destroying paper, storage media, and other physical forms of data storage


Instruction: What is ID.RA? (Risk Assessment)

Output: The cybersecurity risk to the organization, assets, and individuals is understood by the organization


Instruction: Summarize the scope of ID.RA.

Output: The cybersecurity risk to the organization, assets, and individuals is understood by the organization


Instruction: What does ID.RA cover?

Output: The cybersecurity risk to the organization, assets, and individuals is understood by the organization


Instruction: What is ID.RA-01?

Output: Vulnerabilities in assets are identified, validated, and recorded


Instruction: Explain the requirement of ID.RA-01.

Output: Vulnerabilities in assets are identified, validated, and recorded


Instruction: What outcome is expected by ID.RA-01?

Output: Vulnerabilities in assets are identified, validated, and recorded


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is ID.RA-01.147? (Ex1)

Output: Use vulnerability management technologies to identify unpatched and misconfigured software


Instruction: Explain ID.RA-01.147.

Output: Use vulnerability management technologies to identify unpatched and misconfigured software


Instruction: What is ID.RA-01.148? (Ex2)

Output: Assess network and system architectures for design and implementation weaknesses that affect cybersecurity


Instruction: Explain ID.RA-01.148.

Output: Assess network and system architectures for design and implementation weaknesses that affect cybersecurity


Instruction: What is ID.RA-01.149? (Ex3)

Output: Review, analyze, or test organization-developed software to identify design, coding, and default configuration vulnerabilities


Instruction: Explain ID.RA-01.149.

Output: Review, analyze, or test organization-developed software to identify design, coding, and default configuration vulnerabilities


Instruction: What is ID.RA-01.150? (Ex4)

Output: Assess facilities that house critical computing assets for physical vulnerabilities and resilience issues


Instruction: Explain ID.RA-01.150.

Output: Assess facilities that house critical computing assets for physical vulnerabilities and resilience issues


Instruction: What is ID.RA-01.151? (Ex5)

Output: Monitor sources of cyber threat intelligence for information on new vulnerabilities in products and services


Instruction: Explain ID.RA-01.151.

Output: Monitor sources of cyber threat intelligence for information on new vulnerabilities in products and services


Instruction: What is ID.RA-01.152? (Ex6)

Output: Review processes and procedures for weaknesses that could be exploited to affect cybersecurity


Instruction: Explain ID.RA-01.152.

Output: Review processes and procedures for weaknesses that could be exploited to affect cybersecurity


Instruction: What is ID.RA-02?

Output: Cyber threat intelligence is received from information sharing forums and sources


Instruction: Explain the requirement of ID.RA-02.

Output: Cyber threat intelligence is received from information sharing forums and sources


Instruction: What outcome is expected by ID.RA-02?

Output: Cyber threat intelligence is received from information sharing forums and sources


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is ID.RA-02.153? (Ex1)

Output: Configure cybersecurity tools and technologies with detection or response capabilities to securely ingest cyber threat intelligence feeds


Instruction: Explain ID.RA-02.153.

Output: Configure cybersecurity tools and technologies with detection or response capabilities to securely ingest cyber threat intelligence feeds


Instruction: What is ID.RA-02.154? (Ex2)

Output: Receive and review advisories from reputable third parties on current threat actors and their tactics, techniques, and procedures (TTPs)


Instruction: Explain ID.RA-02.154.

Output: Receive and review advisories from reputable third parties on current threat actors and their tactics, techniques, and procedures (TTPs)


Instruction: What is ID.RA-02.155? (Ex3)

Output: Monitor sources of cyber threat intelligence for information on the types of vulnerabilities that emerging technologies may have


Instruction: Explain ID.RA-02.155.

Output: Monitor sources of cyber threat intelligence for information on the types of vulnerabilities that emerging technologies may have


Instruction: What is ID.RA-03?

Output: Internal and external threats to the organization are identified and recorded


Instruction: Explain the requirement of ID.RA-03.

Output: Internal and external threats to the organization are identified and recorded


Instruction: What outcome is expected by ID.RA-03?

Output: Internal and external threats to the organization are identified and recorded


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is third? (3rd)

Output: 3rd Party Risk


Instruction: Explain third.

Output: 3rd Party Risk


Instruction: What is ID.RA-03.156? (Ex1)

Output: Use cyber threat intelligence to maintain awareness of the types of threat actors likely to target the organization and the TTPs they are likely to use


Instruction: Explain ID.RA-03.156.

Output: Use cyber threat intelligence to maintain awareness of the types of threat actors likely to target the organization and the TTPs they are likely to use


Instruction: What is ID.RA-03.157? (Ex2)

Output: Perform threat hunting to look for signs of threat actors within the environment


Instruction: Explain ID.RA-03.157.

Output: Perform threat hunting to look for signs of threat actors within the environment


Instruction: What is ID.RA-03.158? (Ex3)

Output: Implement processes for identifying internal threat actors


Instruction: Explain ID.RA-03.158.

Output: Implement processes for identifying internal threat actors


Instruction: What is ID.RA-04?

Output: Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded


Instruction: Explain the requirement of ID.RA-04.

Output: Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded


Instruction: What outcome is expected by ID.RA-04?

Output: Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is ID.RA-04.159? (Ex1)

Output: Business leaders and cybersecurity risk management practitioners work together to estimate the likelihood and impact of risk scenarios and record them in risk registers


Instruction: Explain ID.RA-04.159.

Output: Business leaders and cybersecurity risk management practitioners work together to estimate the likelihood and impact of risk scenarios and record them in risk registers


Instruction: What is ID.RA-04.160? (Ex2)

Output: Enumerate the potential business impacts of unauthorized access to the organization's communications, systems, and data processed in or by those systems


Instruction: Explain ID.RA-04.160.

Output: Enumerate the potential business impacts of unauthorized access to the organization's communications, systems, and data processed in or by those systems


Instruction: What is ID.RA-04.161? (Ex3)

Output: Account for the potential impacts of cascading failures for systems of systems


Instruction: Explain ID.RA-04.161.

Output: Account for the potential impacts of cascading failures for systems of systems


Instruction: What is ID.RA-05?

Output: Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization


Instruction: Explain the requirement of ID.RA-05.

Output: Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization


Instruction: What outcome is expected by ID.RA-05?

Output: Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is ID.RA-05.162? (Ex1)

Output: Develop threat models to better understand risks to the data and identify appropriate risk responses


Instruction: Explain ID.RA-05.162.

Output: Develop threat models to better understand risks to the data and identify appropriate risk responses


Instruction: What is ID.RA-05.163? (Ex2)

Output: Prioritize cybersecurity resource allocations and investments based on estimated likelihoods and impacts


Instruction: Explain ID.RA-05.163.

Output: Prioritize cybersecurity resource allocations and investments based on estimated likelihoods and impacts


Instruction: What is ID.RA-06?

Output: Risk responses are chosen, prioritized, planned, tracked, and communicated


Instruction: Explain the requirement of ID.RA-06.

Output: Risk responses are chosen, prioritized, planned, tracked, and communicated


Instruction: What outcome is expected by ID.RA-06?

Output: Risk responses are chosen, prioritized, planned, tracked, and communicated


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is ID.RA-06.164? (Ex1)

Output: Apply the vulnerability management plan's criteria for deciding whether to accept, transfer, mitigate, or avoid risk


Instruction: Explain ID.RA-06.164.

Output: Apply the vulnerability management plan's criteria for deciding whether to accept, transfer, mitigate, or avoid risk


Instruction: What is ID.RA-06.165? (Ex2)

Output: Apply the vulnerability management plan's criteria for selecting compensating controls to mitigate risk


Instruction: Explain ID.RA-06.165.

Output: Apply the vulnerability management plan's criteria for selecting compensating controls to mitigate risk


Instruction: What is ID.RA-06.166? (Ex3)

Output: Track the progress of risk response implementation (e.g., plan of action and milestones [POA&M], risk register, risk detail report)


Instruction: Explain ID.RA-06.166.

Output: Track the progress of risk response implementation (e.g., plan of action and milestones [POA&M], risk register, risk detail report)


Instruction: What is ID.RA-06.167? (Ex4)

Output: Use risk assessment findings to inform risk response decisions and actions


Instruction: Explain ID.RA-06.167.

Output: Use risk assessment findings to inform risk response decisions and actions


Instruction: What is ID.RA-06.168? (Ex5)

Output: Communicate planned risk responses to affected stakeholders in priority order


Instruction: Explain ID.RA-06.168.

Output: Communicate planned risk responses to affected stakeholders in priority order


Instruction: What is ID.RA-07?

Output: Changes and exceptions are managed, assessed for risk impact, recorded, and tracked


Instruction: Explain the requirement of ID.RA-07.

Output: Changes and exceptions are managed, assessed for risk impact, recorded, and tracked


Instruction: What outcome is expected by ID.RA-07?

Output: Changes and exceptions are managed, assessed for risk impact, recorded, and tracked


Instruction: What is ID.RA-07.169? (Ex1)

Output: Implement and follow procedures for the formal documentation, review, testing, and approval of proposed changes and requested exceptions


Instruction: Explain ID.RA-07.169.

Output: Implement and follow procedures for the formal documentation, review, testing, and approval of proposed changes and requested exceptions


Instruction: What is ID.RA-07.170? (Ex2)

Output: Document the possible risks of making or not making each proposed change, and provide guidance on rolling back changes


Instruction: Explain ID.RA-07.170.

Output: Document the possible risks of making or not making each proposed change, and provide guidance on rolling back changes


Instruction: What is ID.RA-07.171? (Ex3)

Output: Document the risks related to each requested exception and the plan for responding to those risks


Instruction: Explain ID.RA-07.171.

Output: Document the risks related to each requested exception and the plan for responding to those risks


Instruction: What is ID.RA-07.172? (Ex4)

Output: Periodically review risks that were accepted based upon planned future actions or milestones


Instruction: Explain ID.RA-07.172.

Output: Periodically review risks that were accepted based upon planned future actions or milestones


Instruction: What is ID.RA-08?

Output: Processes for receiving, analyzing, and responding to vulnerability disclosures are established


Instruction: Explain the requirement of ID.RA-08.

Output: Processes for receiving, analyzing, and responding to vulnerability disclosures are established


Instruction: What outcome is expected by ID.RA-08?

Output: Processes for receiving, analyzing, and responding to vulnerability disclosures are established


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is third? (3rd)

Output: 3rd Party Risk


Instruction: Explain third.

Output: 3rd Party Risk


Instruction: What is ID.RA-08.173? (Ex1)

Output: Conduct vulnerability information sharing between the organization and its suppliers following the rules and protocols defined in contracts


Instruction: Explain ID.RA-08.173.

Output: Conduct vulnerability information sharing between the organization and its suppliers following the rules and protocols defined in contracts


Instruction: What is ID.RA-08.174? (Ex2)

Output: Assign responsibilities and verify the execution of procedures for processing, analyzing the impact of, and responding to cybersecurity threat, vulnerability, or incident disclosures by suppliers, customers, partners, and government cybersecurity organizations


Instruction: Explain ID.RA-08.174.

Output: Assign responsibilities and verify the execution of procedures for processing, analyzing the impact of, and responding to cybersecurity threat, vulnerability, or incident disclosures by suppliers, customers, partners, and government cybersecurity organizations


Instruction: What is ID.RA-09?

Output: The authenticity and integrity of hardware and software are assessed prior to acquisition and use