Instruction: Explain the requirement of ID.RA-09.

Output: The authenticity and integrity of hardware and software are assessed prior to acquisition and use


Instruction: What outcome is expected by ID.RA-09?

Output: The authenticity and integrity of hardware and software are assessed prior to acquisition and use


Instruction: What is ID.RA-09.175? (Ex1)

Output: Assess the authenticity and cybersecurity of critical technology products and services prior to acquisition and use


Instruction: Explain ID.RA-09.175.

Output: Assess the authenticity and cybersecurity of critical technology products and services prior to acquisition and use


Instruction: What is third? (3rd)

Output: 3rd Party Risk


Instruction: Explain third.

Output: 3rd Party Risk


Instruction: What is ID.RA-10?

Output: Critical suppliers are assessed prior to acquisition


Instruction: Explain the requirement of ID.RA-10.

Output: Critical suppliers are assessed prior to acquisition


Instruction: What outcome is expected by ID.RA-10?

Output: Critical suppliers are assessed prior to acquisition


Instruction: What is ID.RA-10.176? (Ex1)

Output: Conduct supplier risk assessments against business and applicable cybersecurity requirements, including the supply chain


Instruction: Explain ID.RA-10.176.

Output: Conduct supplier risk assessments against business and applicable cybersecurity requirements, including the supply chain


Instruction: What is ID.IM? (Improvement)

Output: Improvements to organizational cybersecurity risk management processes, procedures and activities are identified across all CSF Functions


Instruction: Summarize the scope of ID.IM.

Output: Improvements to organizational cybersecurity risk management processes, procedures and activities are identified across all CSF Functions


Instruction: What does ID.IM cover?

Output: Improvements to organizational cybersecurity risk management processes, procedures and activities are identified across all CSF Functions


Instruction: What is ID.IM-01?

Output: Improvements are identified from evaluations


Instruction: Explain the requirement of ID.IM-01.

Output: Improvements are identified from evaluations


Instruction: What outcome is expected by ID.IM-01?

Output: Improvements are identified from evaluations


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is ID.IM-01.177? (Ex1)

Output: Perform self-assessments of critical services that take current threats and TTPs into consideration


Instruction: Explain ID.IM-01.177.

Output: Perform self-assessments of critical services that take current threats and TTPs into consideration


Instruction: What is ID.IM-01.178? (Ex2)

Output: Invest in third-party assessments or independent audits of the effectiveness of the organization's cybersecurity program to identify areas that need improvement


Instruction: Explain ID.IM-01.178.

Output: Invest in third-party assessments or independent audits of the effectiveness of the organization's cybersecurity program to identify areas that need improvement


Instruction: What is ID.IM-01.179? (Ex3)

Output: Constantly evaluate compliance with selected cybersecurity requirements through automated means


Instruction: Explain ID.IM-01.179.

Output: Constantly evaluate compliance with selected cybersecurity requirements through automated means


Instruction: What is ID.IM-02?

Output: Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties


Instruction: Explain the requirement of ID.IM-02.

Output: Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties


Instruction: What outcome is expected by ID.IM-02?

Output: Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is third? (3rd)

Output: 3rd Party Risk


Instruction: Explain third.

Output: 3rd Party Risk


Instruction: What is ID.IM-02.180? (Ex1)

Output: Identify improvements for future incident response activities based on findings from incident response assessments (e.g., tabletop exercises and simulations, tests, internal reviews, independent audits)


Instruction: Explain ID.IM-02.180.

Output: Identify improvements for future incident response activities based on findings from incident response assessments (e.g., tabletop exercises and simulations, tests, internal reviews, independent audits)


Instruction: What is ID.IM-02.181? (Ex2)

Output: Identify improvements for future business continuity, disaster recovery, and incident response activities based on exercises performed in coordination with critical service providers and product suppliers


Instruction: Explain ID.IM-02.181.

Output: Identify improvements for future business continuity, disaster recovery, and incident response activities based on exercises performed in coordination with critical service providers and product suppliers


Instruction: What is ID.IM-02.182? (Ex3)

Output: Involve internal stakeholders (e.g., senior executives, legal department, HR) in security tests and exercises as appropriate


Instruction: Explain ID.IM-02.182.

Output: Involve internal stakeholders (e.g., senior executives, legal department, HR) in security tests and exercises as appropriate


Instruction: What is ID.IM-02.183? (Ex4)

Output: Perform penetration testing to identify opportunities to improve the security posture of selected high-risk systems as approved by leadership


Instruction: Explain ID.IM-02.183.

Output: Perform penetration testing to identify opportunities to improve the security posture of selected high-risk systems as approved by leadership


Instruction: What is ID.IM-02.184? (Ex5)

Output: Exercise contingency plans for responding to and recovering from the discovery that products or services did not originate with the contracted supplier or partner or were altered before receipt


Instruction: Explain ID.IM-02.184.

Output: Exercise contingency plans for responding to and recovering from the discovery that products or services did not originate with the contracted supplier or partner or were altered before receipt


Instruction: What is ID.IM-02.185? (Ex6)

Output: Collect and analyze performance metrics using security tools and services to inform improvements to the cybersecurity program


Instruction: Explain ID.IM-02.185.

Output: Collect and analyze performance metrics using security tools and services to inform improvements to the cybersecurity program


Instruction: What is ID.IM-03?

Output: Improvements are identified from execution of operational processes, procedures, and activities


Instruction: Explain the requirement of ID.IM-03.

Output: Improvements are identified from execution of operational processes, procedures, and activities


Instruction: What outcome is expected by ID.IM-03?

Output: Improvements are identified from execution of operational processes, procedures, and activities


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is ID.IM-03.186? (Ex1)

Output: Conduct collaborative lessons learned sessions with suppliers


Instruction: Explain ID.IM-03.186.

Output: Conduct collaborative lessons learned sessions with suppliers


Instruction: What is ID.IM-03.187? (Ex2)

Output: Annually review cybersecurity policies, processes, and procedures to take lessons learned into account


Instruction: Explain ID.IM-03.187.

Output: Annually review cybersecurity policies, processes, and procedures to take lessons learned into account


Instruction: What is ID.IM-03.188? (Ex3)

Output: Use metrics to assess operational cybersecurity performance over time


Instruction: Explain ID.IM-03.188.

Output: Use metrics to assess operational cybersecurity performance over time


Instruction: What is ID.IM-04?

Output: Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved


Instruction: Explain the requirement of ID.IM-04.

Output: Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved


Instruction: What outcome is expected by ID.IM-04?

Output: Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is ID.IM-04.189? (Ex1)

Output: Establish contingency plans (e.g., incident response, business continuity, disaster recovery) for responding to and recovering from adverse events that can interfere with operations, expose confidential information, or otherwise endanger the organization's mission and viability


Instruction: Explain ID.IM-04.189.

Output: Establish contingency plans (e.g., incident response, business continuity, disaster recovery) for responding to and recovering from adverse events that can interfere with operations, expose confidential information, or otherwise endanger the organization's mission and viability


Instruction: What is ID.IM-04.190? (Ex2)

Output: Include contact and communication information, processes for handling common scenarios, and criteria for prioritization, escalation, and elevation in all contingency plans


Instruction: Explain ID.IM-04.190.

Output: Include contact and communication information, processes for handling common scenarios, and criteria for prioritization, escalation, and elevation in all contingency plans


Instruction: What is ID.IM-04.191? (Ex3)

Output: Create a vulnerability management plan to identify and assess all types of vulnerabilities and to prioritize, test, and implement risk responses


Instruction: Explain ID.IM-04.191.

Output: Create a vulnerability management plan to identify and assess all types of vulnerabilities and to prioritize, test, and implement risk responses


Instruction: What is ID.IM-04.192? (Ex4)

Output: Communicate cybersecurity plans (including updates) to those responsible for carrying them out and to affected parties


Instruction: Explain ID.IM-04.192.

Output: Communicate cybersecurity plans (including updates) to those responsible for carrying them out and to affected parties


Instruction: What is ID.IM-04.193? (Ex5)

Output: Review and update all cybersecurity plans annually or when a need for significant improvements is identified


Instruction: Explain ID.IM-04.193.

Output: Review and update all cybersecurity plans annually or when a need for significant improvements is identified


Instruction: What is ID.BE-01?

Output: The organization’s role in the supply chain is identified and communicated


Instruction: Explain the requirement of ID.BE-01.

Output: The organization’s role in the supply chain is identified and communicated


Instruction: What outcome is expected by ID.BE-01?

Output: The organization’s role in the supply chain is identified and communicated


Instruction: What is WR-ID.BE-01?

Output: Incorporated into GV.OC-05


Instruction: Explain WR-ID.BE-01.

Output: Incorporated into GV.OC-05


Instruction: What is ID.BE-02?

Output: The organization’s place in critical infrastructure and its industry sector is identified and communicated


Instruction: Explain the requirement of ID.BE-02.

Output: The organization’s place in critical infrastructure and its industry sector is identified and communicated


Instruction: What outcome is expected by ID.BE-02?

Output: The organization’s place in critical infrastructure and its industry sector is identified and communicated


Instruction: What is WR-ID.BE-02?

Output: Incorporated into GV.OC-01


Instruction: Explain WR-ID.BE-02.

Output: Incorporated into GV.OC-01


Instruction: What is ID.BE-03?

Output: Priorities for organizational mission, objectives, and activities are established and communicated


Instruction: Explain the requirement of ID.BE-03.

Output: Priorities for organizational mission, objectives, and activities are established and communicated


Instruction: What outcome is expected by ID.BE-03?

Output: Priorities for organizational mission, objectives, and activities are established and communicated


Instruction: What is WR-ID.BE-03?

Output: Incorporated into GV.OC-01


Instruction: Explain WR-ID.BE-03.

Output: Incorporated into GV.OC-01


Instruction: What is ID.BE-04?

Output: Dependencies and critical functions for delivery of critical services are established


Instruction: Explain the requirement of ID.BE-04.

Output: Dependencies and critical functions for delivery of critical services are established


Instruction: What outcome is expected by ID.BE-04?

Output: Dependencies and critical functions for delivery of critical services are established


Instruction: What is WR-ID.BE-04?

Output: Incorporated into GV.OC-04, GV.OC-05


Instruction: Explain WR-ID.BE-04.

Output: Incorporated into GV.OC-04, GV.OC-05


Instruction: What is ID.BE-05?

Output: Resilience requirements to support delivery of critical services are established for all operating states (e.g. under duress/attack, during recovery, normal operations)


Instruction: Explain the requirement of ID.BE-05.

Output: Resilience requirements to support delivery of critical services are established for all operating states (e.g. under duress/attack, during recovery, normal operations)


Instruction: What outcome is expected by ID.BE-05?

Output: Resilience requirements to support delivery of critical services are established for all operating states (e.g. under duress/attack, during recovery, normal operations)


Instruction: What is WR-ID.BE-05?

Output: Incorporated into GV.OC-04


Instruction: Explain WR-ID.BE-05.

Output: Incorporated into GV.OC-04


Instruction: What is WR-ID.BE?

Output: Incorporated into GV.OC


Instruction: Explain WR-ID.BE.

Output: Incorporated into GV.OC


Instruction: What is ID.GV-01?

Output: Organizational cybersecurity policy is established and communicated


Instruction: Explain the requirement of ID.GV-01.

Output: Organizational cybersecurity policy is established and communicated


Instruction: What outcome is expected by ID.GV-01?

Output: Organizational cybersecurity policy is established and communicated


Instruction: What is WR-ID.GV-01?

Output: Incorporated into GV.PO, GV.PO-01, GV.PO-02


Instruction: Explain WR-ID.GV-01.

Output: Incorporated into GV.PO, GV.PO-01, GV.PO-02


Instruction: What is ID.GV-02?

Output: Cybersecurity roles and responsibilities are coordinated and aligned with internal roles and external partners


Instruction: Explain the requirement of ID.GV-02.

Output: Cybersecurity roles and responsibilities are coordinated and aligned with internal roles and external partners


Instruction: What outcome is expected by ID.GV-02?

Output: Cybersecurity roles and responsibilities are coordinated and aligned with internal roles and external partners


Instruction: What is WR-ID.GV-02?

Output: Incorporated into GV.OC-02, GV.RR, GV.RR-02


Instruction: Explain WR-ID.GV-02.

Output: Incorporated into GV.OC-02, GV.RR, GV.RR-02


Instruction: What is ID.GV-03?

Output: Legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations, are understood and managed


Instruction: Explain the requirement of ID.GV-03.

Output: Legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations, are understood and managed


Instruction: What outcome is expected by ID.GV-03?

Output: Legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations, are understood and managed


Instruction: What is WR-ID.GV-03?

Output: Moved to GV.OC-03


Instruction: Explain WR-ID.GV-03.

Output: Moved to GV.OC-03


Instruction: What is ID.GV-04?

Output: Governance and risk management processes address cybersecurity risks


Instruction: Explain the requirement of ID.GV-04.

Output: Governance and risk management processes address cybersecurity risks


Instruction: What outcome is expected by ID.GV-04?

Output: Governance and risk management processes address cybersecurity risks


Instruction: What is WR-ID.GV-04?

Output: Moved to GV.RM-04


Instruction: Explain WR-ID.GV-04.

Output: Moved to GV.RM-04


Instruction: What is WR-ID.GV?

Output: Incorporated into GV


Instruction: Explain WR-ID.GV.

Output: Incorporated into GV


Instruction: What is ID.RM-01?

Output: Risk management processes are established, managed, and agreed to by organizational stakeholders


Instruction: Explain the requirement of ID.RM-01.

Output: Risk management processes are established, managed, and agreed to by organizational stakeholders


Instruction: What outcome is expected by ID.RM-01?

Output: Risk management processes are established, managed, and agreed to by organizational stakeholders


Instruction: What is WR-ID.RM-01?

Output: Incorporated into GV.RM-01, GV.RM-06, GV.RR-03


Instruction: Explain WR-ID.RM-01.

Output: Incorporated into GV.RM-01, GV.RM-06, GV.RR-03


Instruction: What is ID.RM-02?

Output: Organizational risk tolerance is determined and clearly expressed


Instruction: Explain the requirement of ID.RM-02.

Output: Organizational risk tolerance is determined and clearly expressed


Instruction: What outcome is expected by ID.RM-02?

Output: Organizational risk tolerance is determined and clearly expressed


Instruction: What is WR-ID.RM-02?

Output: Incorporated into GV.RM-02, GV.RM-04


Instruction: Explain WR-ID.RM-02.

Output: Incorporated into GV.RM-02, GV.RM-04


Instruction: What is ID.RM-03?

Output: The organization’s determination of risk tolerance is informed by its role in critical infrastructure and sector specific risk analysis


Instruction: Explain the requirement of ID.RM-03.

Output: The organization’s determination of risk tolerance is informed by its role in critical infrastructure and sector specific risk analysis


Instruction: What outcome is expected by ID.RM-03?

Output: The organization’s determination of risk tolerance is informed by its role in critical infrastructure and sector specific risk analysis


Instruction: What is WR-ID.RM-03?

Output: Moved into GV.RM-02


Instruction: Explain WR-ID.RM-03.

Output: Moved into GV.RM-02


Instruction: What is WR-ID.RM?

Output: Incorporated into GV.RM


Instruction: Explain WR-ID.RM.

Output: Incorporated into GV.RM


Instruction: What is ID.SC-01?

Output: Cyber supply chain risk management processes are identified, established, assessed, managed, and agreed to by organizational stakeholders


Instruction: Explain the requirement of ID.SC-01.

Output: Cyber supply chain risk management processes are identified, established, assessed, managed, and agreed to by organizational stakeholders


Instruction: What outcome is expected by ID.SC-01?

Output: Cyber supply chain risk management processes are identified, established, assessed, managed, and agreed to by organizational stakeholders


Instruction: What is WR-ID.SC-01?

Output: Incorporated into GV.RM-05, GV.SC-01, GV.SC-06, GV.SC-09, GV.SC-10


Instruction: Explain WR-ID.SC-01.

Output: Incorporated into GV.RM-05, GV.SC-01, GV.SC-06, GV.SC-09, GV.SC-10


Instruction: What is ID.SC-02?

Output: Suppliers and third party partners of information systems, components, and services are identified, prioritized, and assessed using a cyber supply chain risk assessment process


Instruction: Explain the requirement of ID.SC-02.

Output: Suppliers and third party partners of information systems, components, and services are identified, prioritized, and assessed using a cyber supply chain risk assessment process


Instruction: What outcome is expected by ID.SC-02?

Output: Suppliers and third party partners of information systems, components, and services are identified, prioritized, and assessed using a cyber supply chain risk assessment process


Instruction: What is WR-ID.SC-02?

Output: Incorporated into GV.OC-02, GV.SC-03, GV.SC-04, GV.SC-07, ID.RA-10


Instruction: Explain WR-ID.SC-02.

Output: Incorporated into GV.OC-02, GV.SC-03, GV.SC-04, GV.SC-07, ID.RA-10


Instruction: What is ID.SC-03?

Output: Contracts with suppliers and third-party partners are used to implement appropriate measures designed to meet the objectives of an organization’s cybersecurity program and Cyber Supply Chain Risk Management Plan.


Instruction: Explain the requirement of ID.SC-03.

Output: Contracts with suppliers and third-party partners are used to implement appropriate measures designed to meet the objectives of an organization’s cybersecurity program and Cyber Supply Chain Risk Management Plan.


Instruction: What outcome is expected by ID.SC-03?

Output: Contracts with suppliers and third-party partners are used to implement appropriate measures designed to meet the objectives of an organization’s cybersecurity program and Cyber Supply Chain Risk Management Plan.


Instruction: What is WR-ID.SC-03?

Output: Moved to GV.SC-05


Instruction: Explain WR-ID.SC-03.

Output: Moved to GV.SC-05


Instruction: What is ID.SC-04?

Output: Suppliers and third-party partners are routinely assessed using audits, test results, or other forms of evaluations to confirm they are meeting their contractual obligations.


Instruction: Explain the requirement of ID.SC-04.

Output: Suppliers and third-party partners are routinely assessed using audits, test results, or other forms of evaluations to confirm they are meeting their contractual obligations.


Instruction: What outcome is expected by ID.SC-04?

Output: Suppliers and third-party partners are routinely assessed using audits, test results, or other forms of evaluations to confirm they are meeting their contractual obligations.


Instruction: What is WR-ID.SC-04?

Output: Incorporated into GV.SC-07, ID.RA-10


Instruction: Explain WR-ID.SC-04.

Output: Incorporated into GV.SC-07, ID.RA-10


Instruction: What is ID.SC-05?

Output: Response and recovery planning and testing are conducted with suppliers and third-party providers


Instruction: Explain the requirement of ID.SC-05.

Output: Response and recovery planning and testing are conducted with suppliers and third-party providers


Instruction: What outcome is expected by ID.SC-05?

Output: Response and recovery planning and testing are conducted with suppliers and third-party providers


Instruction: What is WR-ID.SC-05?

Output: Incorporated into GV.SC-08, ID.IM-02


Instruction: Explain WR-ID.SC-05.

Output: Incorporated into GV.SC-08, ID.IM-02


Instruction: What is WR-ID.SC?

Output: Incorporated into GV.SC


Instruction: Explain WR-ID.SC.

Output: Incorporated into GV.SC


Instruction: What is PR? (PROTECT)

Output: Safeguards to manage the organization's cybersecurity risks are used


Instruction: Summarize the scope of PR.

Output: Safeguards to manage the organization's cybersecurity risks are used


Instruction: What does PR cover?

Output: Safeguards to manage the organization's cybersecurity risks are used


Instruction: What is PR.AA? (Identity Management, Authentication, and Access Control)

Output: Access to physical and logical assets is limited to authorized users, services, and hardware and  managed commensurate with the assessed risk of unauthorized access


Instruction: Summarize the scope of PR.AA.

Output: Access to physical and logical assets is limited to authorized users, services, and hardware and  managed commensurate with the assessed risk of unauthorized access


Instruction: What does PR.AA cover?

Output: Access to physical and logical assets is limited to authorized users, services, and hardware and  managed commensurate with the assessed risk of unauthorized access


Instruction: What is PR.AA-01?

Output: Identities and credentials for authorized users, services, and hardware are managed by the organization


Instruction: Explain the requirement of PR.AA-01.

Output: Identities and credentials for authorized users, services, and hardware are managed by the organization


Instruction: What outcome is expected by PR.AA-01?

Output: Identities and credentials for authorized users, services, and hardware are managed by the organization


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is PR.AA-01.194? (Ex1)

Output: Initiate requests for new access or additional access for employees, contractors, and others, and track, review, and fulfill the requests, with permission from system or data owners when needed


Instruction: Explain PR.AA-01.194.

Output: Initiate requests for new access or additional access for employees, contractors, and others, and track, review, and fulfill the requests, with permission from system or data owners when needed


Instruction: What is PR.AA-01.195? (Ex2)

Output: Issue, manage, and revoke cryptographic certificates and identity tokens, cryptographic keys (i.e., key management), and other credentials


Instruction: Explain PR.AA-01.195.

Output: Issue, manage, and revoke cryptographic certificates and identity tokens, cryptographic keys (i.e., key management), and other credentials


Instruction: What is PR.AA-01.196? (Ex3)

Output: Select a unique identifier for each device from immutable hardware characteristics or an identifier securely provisioned to the device


Instruction: Explain PR.AA-01.196.

Output: Select a unique identifier for each device from immutable hardware characteristics or an identifier securely provisioned to the device


Instruction: What is PR.AA-01.197? (Ex4)

Output: Physically label authorized hardware with an identifier for inventory and servicing purposes


Instruction: Explain PR.AA-01.197.

Output: Physically label authorized hardware with an identifier for inventory and servicing purposes


Instruction: What is PR.AA-02?

Output: Identities are proofed and bound to credentials based on the context of interactions


Instruction: Explain the requirement of PR.AA-02.

Output: Identities are proofed and bound to credentials based on the context of interactions


Instruction: What outcome is expected by PR.AA-02?

Output: Identities are proofed and bound to credentials based on the context of interactions


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is third? (3rd)

Output: 3rd Party Risk


Instruction: Explain third.

Output: 3rd Party Risk


Instruction: What is PR.AA-02.198? (Ex1)

Output: Verify a person's claimed identity at enrollment time using government-issued identity credentials (e.g., passport, visa, driver's license)


Instruction: Explain PR.AA-02.198.

Output: Verify a person's claimed identity at enrollment time using government-issued identity credentials (e.g., passport, visa, driver's license)


Instruction: What is PR.AA-02.199? (Ex2)

Output: Issue a different credential for each person (i.e., no credential sharing)


Instruction: Explain PR.AA-02.199.

Output: Issue a different credential for each person (i.e., no credential sharing)


Instruction: What is PR.AA-03?

Output: Users, services, and hardware are authenticated


Instruction: Explain the requirement of PR.AA-03.

Output: Users, services, and hardware are authenticated


Instruction: What outcome is expected by PR.AA-03?

Output: Users, services, and hardware are authenticated


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is PR.AA-03.200? (Ex1)

Output: Require multifactor authentication


Instruction: Explain PR.AA-03.200.

Output: Require multifactor authentication


Instruction: What is PR.AA-03.201? (Ex2)

Output: Enforce policies for the minimum strength of passwords, PINs, and similar authenticators


Instruction: Explain PR.AA-03.201.

Output: Enforce policies for the minimum strength of passwords, PINs, and similar authenticators


Instruction: What is PR.AA-03.202? (Ex3)

Output: Periodically reauthenticate users, services, and hardware based on risk (e.g., in zero trust architectures)


Instruction: Explain PR.AA-03.202.

Output: Periodically reauthenticate users, services, and hardware based on risk (e.g., in zero trust architectures)


Instruction: What is PR.AA-03.203? (Ex4)

Output: Ensure that authorized personnel can access accounts essential for protecting safety under emergency conditions


Instruction: Explain PR.AA-03.203.

Output: Ensure that authorized personnel can access accounts essential for protecting safety under emergency conditions


Instruction: What is PR.AA-04?

Output: Identity assertions are protected, conveyed, and verified


Instruction: Explain the requirement of PR.AA-04.

Output: Identity assertions are protected, conveyed, and verified


Instruction: What outcome is expected by PR.AA-04?

Output: Identity assertions are protected, conveyed, and verified


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is PR.AA-04.204? (Ex1)

Output: Protect identity assertions that are used to convey authentication and user information through single sign-on systems


Instruction: Explain PR.AA-04.204.

Output: Protect identity assertions that are used to convey authentication and user information through single sign-on systems


Instruction: What is PR.AA-04.205? (Ex2)

Output: Protect identity assertions that are used to convey authentication and user information between federated systems


Instruction: Explain PR.AA-04.205.

Output: Protect identity assertions that are used to convey authentication and user information between federated systems


Instruction: What is PR.AA-04.206? (Ex3)

Output: Implement standards-based approaches for identity assertions in all contexts, and follow all guidance for the generation (e.g., data models, metadata), protection (e.g., digital signing, encryption), and verification (e.g., signature validation) of identity assertions


Instruction: Explain PR.AA-04.206.

Output: Implement standards-based approaches for identity assertions in all contexts, and follow all guidance for the generation (e.g., data models, metadata), protection (e.g., digital signing, encryption), and verification (e.g., signature validation) of identity assertions


Instruction: What is PR.AA-05?

Output: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties


Instruction: Explain the requirement of PR.AA-05.

Output: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties


Instruction: What outcome is expected by PR.AA-05?

Output: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is PR.AA-05.207? (Ex1)

Output: Review logical and physical access privileges periodically and whenever someone changes roles or leaves the organization, and promptly rescind privileges that are no longer needed


Instruction: Explain PR.AA-05.207.

Output: Review logical and physical access privileges periodically and whenever someone changes roles or leaves the organization, and promptly rescind privileges that are no longer needed


Instruction: What is PR.AA-05.208? (Ex2)

Output: Take attributes of the requester and the requested resource into account for authorization decisions (e.g., geolocation, day/time, requester endpoint's cyber health)


Instruction: Explain PR.AA-05.208.

Output: Take attributes of the requester and the requested resource into account for authorization decisions (e.g., geolocation, day/time, requester endpoint's cyber health)


Instruction: What is PR.AA-05.209? (Ex3)

Output: Restrict access and privileges to the minimum necessary (e.g., zero trust architecture)


Instruction: Explain PR.AA-05.209.

Output: Restrict access and privileges to the minimum necessary (e.g., zero trust architecture)


Instruction: What is PR.AA-05.210? (Ex4)

Output: Periodically review the privileges associated with critical business functions to confirm proper separation of duties


Instruction: Explain PR.AA-05.210.

Output: Periodically review the privileges associated with critical business functions to confirm proper separation of duties


Instruction: What is PR.AA-06?

Output: Physical access to assets is managed, monitored, and enforced commensurate with risk


Instruction: Explain the requirement of PR.AA-06.

Output: Physical access to assets is managed, monitored, and enforced commensurate with risk


Instruction: What outcome is expected by PR.AA-06?

Output: Physical access to assets is managed, monitored, and enforced commensurate with risk


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is third? (3rd)

Output: 3rd Party Risk


Instruction: Explain third.

Output: 3rd Party Risk


Instruction: What is PR.AA-06.211? (Ex1)

Output: Use security guards, security cameras, locked entrances, alarm systems, and other physical controls to monitor facilities and restrict access


Instruction: Explain PR.AA-06.211.

Output: Use security guards, security cameras, locked entrances, alarm systems, and other physical controls to monitor facilities and restrict access


Instruction: What is PR.AA-06.212? (Ex2)

Output: Employ additional physical security controls for areas that contain high-risk assets


Instruction: Explain PR.AA-06.212.

Output: Employ additional physical security controls for areas that contain high-risk assets


Instruction: What is PR.AA-06.213? (Ex3)

Output: Escort guests, vendors, and other third parties within areas that contain business-critical assets


Instruction: Explain PR.AA-06.213.

Output: Escort guests, vendors, and other third parties within areas that contain business-critical assets


Instruction: What is PR.AT? (Awareness and Training)

Output: The organization's personnel are provided with cybersecurity awareness and training so that they can perform their cybersecurity-related tasks


Instruction: Summarize the scope of PR.AT.

Output: The organization's personnel are provided with cybersecurity awareness and training so that they can perform their cybersecurity-related tasks


Instruction: What does PR.AT cover?

Output: The organization's personnel are provided with cybersecurity awareness and training so that they can perform their cybersecurity-related tasks


Instruction: What is PR.AT-01?

Output: Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind


Instruction: Explain the requirement of PR.AT-01.

Output: Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind


Instruction: What outcome is expected by PR.AT-01?

Output: Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is PR.AT-01.214? (Ex1)

Output: Provide basic cybersecurity awareness and training to employees, contractors, partners, suppliers, and all other users of the organization's non-public resources


Instruction: Explain PR.AT-01.214.

Output: Provide basic cybersecurity awareness and training to employees, contractors, partners, suppliers, and all other users of the organization's non-public resources


Instruction: What is PR.AT-01.215? (Ex2)

Output: Train personnel to recognize social engineering attempts and other common attacks, report attacks and suspicious activity, comply with acceptable use policies, and perform basic cyber hygiene tasks (e.g., patching software, choosing passwords, protecting credentials)


Instruction: Explain PR.AT-01.215.

Output: Train personnel to recognize social engineering attempts and other common attacks, report attacks and suspicious activity, comply with acceptable use policies, and perform basic cyber hygiene tasks (e.g., patching software, choosing passwords, protecting credentials)


Instruction: What is PR.AT-01.216? (Ex3)

Output: Explain the consequences of cybersecurity policy violations, both to individual users and the organization as a whole


Instruction: Explain PR.AT-01.216.

Output: Explain the consequences of cybersecurity policy violations, both to individual users and the organization as a whole


Instruction: What is PR.AT-01.217? (Ex4)

Output: Periodically assess or test users on their understanding of basic cybersecurity practices


Instruction: Explain PR.AT-01.217.

Output: Periodically assess or test users on their understanding of basic cybersecurity practices


Instruction: What is PR.AT-01.218? (Ex5)

Output: Require annual refreshers to reinforce existing practices and introduce new practices


Instruction: Explain PR.AT-01.218.

Output: Require annual refreshers to reinforce existing practices and introduce new practices


Instruction: What is PR.AT-02?

Output: Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind


Instruction: Explain the requirement of PR.AT-02.

Output: Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind


Instruction: What outcome is expected by PR.AT-02?

Output: Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is third? (3rd)

Output: 3rd Party Risk


Instruction: Explain third.

Output: 3rd Party Risk


Instruction: What is PR.AT-02.219? (Ex1)

Output: Identify the specialized roles within the organization that require additional cybersecurity training, such as physical and cybersecurity personnel, finance personnel, senior leadership, and anyone with access to business-critical data


Instruction: Explain PR.AT-02.219.

Output: Identify the specialized roles within the organization that require additional cybersecurity training, such as physical and cybersecurity personnel, finance personnel, senior leadership, and anyone with access to business-critical data


Instruction: What is PR.AT-02.220? (Ex2)

Output: Provide role-based cybersecurity awareness and training to all those in specialized roles, including contractors, partners, suppliers, and other third parties


Instruction: Explain PR.AT-02.220.

Output: Provide role-based cybersecurity awareness and training to all those in specialized roles, including contractors, partners, suppliers, and other third parties


Instruction: What is PR.AT-02.221? (Ex3)

Output: Periodically assess or test users on their understanding of cybersecurity practices for their specialized roles


Instruction: Explain PR.AT-02.221.

Output: Periodically assess or test users on their understanding of cybersecurity practices for their specialized roles


Instruction: What is PR.AT-02.222? (Ex4)

Output: Require annual refreshers to reinforce existing practices and introduce new practices


Instruction: Explain PR.AT-02.222.

Output: Require annual refreshers to reinforce existing practices and introduce new practices


Instruction: What is PR.AT-03?

Output: Third-party stakeholders (e.g., suppliers, customers, partners) understand their roles and responsibilities


Instruction: Explain the requirement of PR.AT-03.

Output: Third-party stakeholders (e.g., suppliers, customers, partners) understand their roles and responsibilities


Instruction: What outcome is expected by PR.AT-03?

Output: Third-party stakeholders (e.g., suppliers, customers, partners) understand their roles and responsibilities


Instruction: What is WR-PR.AT-03?

Output: Incorporated into PR.AT-01, PR.AT-02


Instruction: Explain WR-PR.AT-03.

Output: Incorporated into PR.AT-01, PR.AT-02


Instruction: What is PR.AT-04?

Output: Senior executives understand their roles and responsibilities


Instruction: Explain the requirement of PR.AT-04.

Output: Senior executives understand their roles and responsibilities


Instruction: What outcome is expected by PR.AT-04?

Output: Senior executives understand their roles and responsibilities


Instruction: What is WR-PR.AT-04?

Output: Incorporated into PR.AT-02


Instruction: Explain WR-PR.AT-04.

Output: Incorporated into PR.AT-02


Instruction: What is PR.AT-05?

Output: Physical and cybersecurity personnel understand their roles and responsibilities


Instruction: Explain the requirement of PR.AT-05.

Output: Physical and cybersecurity personnel understand their roles and responsibilities


Instruction: What outcome is expected by PR.AT-05?

Output: Physical and cybersecurity personnel understand their roles and responsibilities


Instruction: What is WR-PR.AT-05?

Output: Incorporated into PR.AT-02


Instruction: Explain WR-PR.AT-05.

Output: Incorporated into PR.AT-02


Instruction: What is PR.DS? (Data Security)

Output: Data are managed consistent with the organization's risk strategy to protect the confidentiality, integrity, and availability of information


Instruction: Summarize the scope of PR.DS.

Output: Data are managed consistent with the organization's risk strategy to protect the confidentiality, integrity, and availability of information


Instruction: What does PR.DS cover?

Output: Data are managed consistent with the organization's risk strategy to protect the confidentiality, integrity, and availability of information


Instruction: What is PR.DS-01?

Output: The confidentiality, integrity, and availability of data-at-rest are protected


Instruction: Explain the requirement of PR.DS-01.

Output: The confidentiality, integrity, and availability of data-at-rest are protected


Instruction: What outcome is expected by PR.DS-01?

Output: The confidentiality, integrity, and availability of data-at-rest are protected


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is PR.DS-01.223? (Ex1)

Output: Use encryption, digital signatures, and cryptographic hashes to protect the confidentiality and integrity of stored data in files, databases, virtual machine disk images, container images, and other resources


Instruction: Explain PR.DS-01.223.

Output: Use encryption, digital signatures, and cryptographic hashes to protect the confidentiality and integrity of stored data in files, databases, virtual machine disk images, container images, and other resources


Instruction: What is PR.DS-01.224? (Ex2)

Output: Use full disk encryption to protect data stored on user endpoints


Instruction: Explain PR.DS-01.224.

Output: Use full disk encryption to protect data stored on user endpoints


Instruction: What is PR.DS-01.225? (Ex3)

Output: Confirm the integrity of software by validating signatures


Instruction: Explain PR.DS-01.225.

Output: Confirm the integrity of software by validating signatures


Instruction: What is PR.DS-01.226? (Ex4)

Output: Restrict the use of removable media to prevent data exfiltration


Instruction: Explain PR.DS-01.226.

Output: Restrict the use of removable media to prevent data exfiltration


Instruction: What is PR.DS-01.227? (Ex5)

Output: Physically secure removable media containing unencrypted sensitive information, such as within locked offices or file cabinets


Instruction: Explain PR.DS-01.227.

Output: Physically secure removable media containing unencrypted sensitive information, such as within locked offices or file cabinets


Instruction: What is PR.DS-02?

Output: The confidentiality, integrity, and availability of data-in-transit are protected


Instruction: Explain the requirement of PR.DS-02.

Output: The confidentiality, integrity, and availability of data-in-transit are protected


Instruction: What outcome is expected by PR.DS-02?

Output: The confidentiality, integrity, and availability of data-in-transit are protected


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is PR.DS-02.228? (Ex1)

Output: Use encryption, digital signatures, and cryptographic hashes to protect the confidentiality and integrity of network communications


Instruction: Explain PR.DS-02.228.

Output: Use encryption, digital signatures, and cryptographic hashes to protect the confidentiality and integrity of network communications


Instruction: What is PR.DS-02.229? (Ex2)

Output: Automatically encrypt or block outbound emails and other communications that contain sensitive data, depending on the data classification


Instruction: Explain PR.DS-02.229.

Output: Automatically encrypt or block outbound emails and other communications that contain sensitive data, depending on the data classification


Instruction: What is PR.DS-02.230? (Ex3)

Output: Block access to personal email, file sharing, file storage services, and other personal communications applications and services from organizational systems and networks


Instruction: Explain PR.DS-02.230.

Output: Block access to personal email, file sharing, file storage services, and other personal communications applications and services from organizational systems and networks


Instruction: What is PR.DS-02.231? (Ex4)

Output: Prevent reuse of sensitive data from production environments (e.g., customer records) in development, testing, and other non-production environments


Instruction: Explain PR.DS-02.231.

Output: Prevent reuse of sensitive data from production environments (e.g., customer records) in development, testing, and other non-production environments


Instruction: What is PR.DS-03?

Output: Assets are formally managed throughout removal, transfers, and disposition


Instruction: Explain the requirement of PR.DS-03.

Output: Assets are formally managed throughout removal, transfers, and disposition


Instruction: What outcome is expected by PR.DS-03?

Output: Assets are formally managed throughout removal, transfers, and disposition


Instruction: What is WR-PR.DS-03?

Output: Incorporated into ID.AM-08, PR.PS-03


Instruction: Explain WR-PR.DS-03.

Output: Incorporated into ID.AM-08, PR.PS-03


Instruction: What is PR.DS-04?

Output: Adequate capacity to ensure availability is maintained


Instruction: Explain the requirement of PR.DS-04.

Output: Adequate capacity to ensure availability is maintained


Instruction: What outcome is expected by PR.DS-04?

Output: Adequate capacity to ensure availability is maintained


Instruction: What is WR-PR.DS-04?

Output: Moved to PR.IR-04


Instruction: Explain WR-PR.DS-04.

Output: Moved to PR.IR-04


Instruction: What is PR.DS-05?

Output: Protections against data leaks are implemented


Instruction: Explain the requirement of PR.DS-05.

Output: Protections against data leaks are implemented


Instruction: What outcome is expected by PR.DS-05?

Output: Protections against data leaks are implemented


Instruction: What is WR-PR.DS-05?

Output: Incorporated into PR.DS-01, PR.DS-02, PR.DS-10


Instruction: Explain WR-PR.DS-05.

Output: Incorporated into PR.DS-01, PR.DS-02, PR.DS-10


Instruction: What is PR.DS-06?

Output: Integrity checking mechanisms are used to verify software, firmware, and information integrity


Instruction: Explain the requirement of PR.DS-06.

Output: Integrity checking mechanisms are used to verify software, firmware, and information integrity


Instruction: What outcome is expected by PR.DS-06?

Output: Integrity checking mechanisms are used to verify software, firmware, and information integrity


Instruction: What is WR-PR.DS-06?

Output: Incorporated into PR.DS-01, DE.CM-09


Instruction: Explain WR-PR.DS-06.

Output: Incorporated into PR.DS-01, DE.CM-09


Instruction: What is PR.DS-07?

Output: The development and testing environment(s) are separate from the production environment


Instruction: Explain the requirement of PR.DS-07.

Output: The development and testing environment(s) are separate from the production environment


Instruction: What outcome is expected by PR.DS-07?

Output: The development and testing environment(s) are separate from the production environment


Instruction: What is WR-PR.DS-07?

Output: Incorporated into PR.IR-01


Instruction: Explain WR-PR.DS-07.

Output: Incorporated into PR.IR-01


Instruction: What is PR.DS-08?

Output: Integrity checking mechanisms are used to verify hardware integrity


Instruction: Explain the requirement of PR.DS-08.

Output: Integrity checking mechanisms are used to verify hardware integrity


Instruction: What outcome is expected by PR.DS-08?

Output: Integrity checking mechanisms are used to verify hardware integrity


Instruction: What is WR-PR.DS-08?

Output: Incorporated into ID.RA-09, DE.CM-09


Instruction: Explain WR-PR.DS-08.

Output: Incorporated into ID.RA-09, DE.CM-09


Instruction: What is PR.DS-10?

Output: The confidentiality, integrity, and availability of data-in-use are protected


Instruction: Explain the requirement of PR.DS-10.

Output: The confidentiality, integrity, and availability of data-in-use are protected


Instruction: What outcome is expected by PR.DS-10?

Output: The confidentiality, integrity, and availability of data-in-use are protected


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is PR.DS-10.232? (Ex1)

Output: Remove data that must remain confidential (e.g., from processors and memory) as soon as it is no longer needed


Instruction: Explain PR.DS-10.232.

Output: Remove data that must remain confidential (e.g., from processors and memory) as soon as it is no longer needed


Instruction: What is PR.DS-10.233? (Ex2)

Output: Protect data in use from access by other users and processes of the same platform


Instruction: Explain PR.DS-10.233.

Output: Protect data in use from access by other users and processes of the same platform


Instruction: What is PR.DS-11?

Output: Backups of data are created, protected, maintained, and tested


Instruction: Explain the requirement of PR.DS-11.

Output: Backups of data are created, protected, maintained, and tested


Instruction: What outcome is expected by PR.DS-11?

Output: Backups of data are created, protected, maintained, and tested


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is PR.DS-11.234? (Ex1)

Output: Continuously back up critical data in near-real-time, and back up other data frequently at agreed-upon schedules


Instruction: Explain PR.DS-11.234.

Output: Continuously back up critical data in near-real-time, and back up other data frequently at agreed-upon schedules


Instruction: What is PR.DS-11.235? (Ex2)

Output: Test backups and restores for all types of data sources at least annually


Instruction: Explain PR.DS-11.235.

Output: Test backups and restores for all types of data sources at least annually


Instruction: What is PR.DS-11.236? (Ex3)

Output: Securely store some backups offline and offsite so that an incident or disaster will not damage them


Instruction: Explain PR.DS-11.236.

Output: Securely store some backups offline and offsite so that an incident or disaster will not damage them


Instruction: What is PR.DS-11.237? (Ex4)

Output: Enforce geographic separation and geolocation restrictions for data backup storage


Instruction: Explain PR.DS-11.237.

Output: Enforce geographic separation and geolocation restrictions for data backup storage


Instruction: What is PR.PS? (Platform Security)

Output: The hardware, software (e.g., firmware, operating systems, applications), and services of physical and virtual platforms are managed consistent with the organization's risk strategy to protect their confidentiality, integrity, and availability


Instruction: Summarize the scope of PR.PS.

Output: The hardware, software (e.g., firmware, operating systems, applications), and services of physical and virtual platforms are managed consistent with the organization's risk strategy to protect their confidentiality, integrity, and availability


Instruction: What does PR.PS cover?

Output: The hardware, software (e.g., firmware, operating systems, applications), and services of physical and virtual platforms are managed consistent with the organization's risk strategy to protect their confidentiality, integrity, and availability


Instruction: What is PR.PS-01?

Output: Configuration management practices are established and applied


Instruction: Explain the requirement of PR.PS-01.

Output: Configuration management practices are established and applied


Instruction: What outcome is expected by PR.PS-01?

Output: Configuration management practices are established and applied


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is PR.PS-01.238? (Ex1)

Output: Establish, test, deploy, and maintain hardened baselines that enforce the organization's cybersecurity policies and provide only essential capabilities (i.e., principle of least functionality)


Instruction: Explain PR.PS-01.238.

Output: Establish, test, deploy, and maintain hardened baselines that enforce the organization's cybersecurity policies and provide only essential capabilities (i.e., principle of least functionality)


Instruction: What is PR.PS-01.239? (Ex2)

Output: Review all default configuration settings that may potentially impact cybersecurity when installing or upgrading software


Instruction: Explain PR.PS-01.239.

Output: Review all default configuration settings that may potentially impact cybersecurity when installing or upgrading software


Instruction: What is PR.PS-01.240? (Ex3)

Output: Monitor implemented software for deviations from approved baselines


Instruction: Explain PR.PS-01.240.

Output: Monitor implemented software for deviations from approved baselines


Instruction: What is PR.PS-02?

Output: Software is maintained, replaced, and removed commensurate with risk


Instruction: Explain the requirement of PR.PS-02.

Output: Software is maintained, replaced, and removed commensurate with risk


Instruction: What outcome is expected by PR.PS-02?

Output: Software is maintained, replaced, and removed commensurate with risk


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is PR.PS-02.241? (Ex1)

Output: Perform routine and emergency patching within the timeframes specified in the vulnerability management plan


Instruction: Explain PR.PS-02.241.

Output: Perform routine and emergency patching within the timeframes specified in the vulnerability management plan


Instruction: What is PR.PS-02.242? (Ex2)

Output: Update container images, and deploy new container instances to replace rather than update existing instances


Instruction: Explain PR.PS-02.242.

Output: Update container images, and deploy new container instances to replace rather than update existing instances


Instruction: What is PR.PS-02.243? (Ex3)

Output: Replace end-of-life software and service versions with supported, maintained versions


Instruction: Explain PR.PS-02.243.

Output: Replace end-of-life software and service versions with supported, maintained versions


Instruction: What is PR.PS-02.244? (Ex4)

Output: Uninstall and remove unauthorized software and services that pose undue risks


Instruction: Explain PR.PS-02.244.

Output: Uninstall and remove unauthorized software and services that pose undue risks


Instruction: What is PR.PS-02.245? (Ex5)

Output: Uninstall and remove any unnecessary software components (e.g., operating system utilities) that attackers might misuse


Instruction: Explain PR.PS-02.245.

Output: Uninstall and remove any unnecessary software components (e.g., operating system utilities) that attackers might misuse


Instruction: What is PR.PS-02.246? (Ex6)

Output: Define and implement plans for software and service end-of-life maintenance support and obsolescence


Instruction: Explain PR.PS-02.246.

Output: Define and implement plans for software and service end-of-life maintenance support and obsolescence


Instruction: What is PR.PS-03?

Output: Hardware is maintained, replaced, and removed commensurate with risk


Instruction: Explain the requirement of PR.PS-03.

Output: Hardware is maintained, replaced, and removed commensurate with risk


Instruction: What outcome is expected by PR.PS-03?

Output: Hardware is maintained, replaced, and removed commensurate with risk


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is third? (3rd)

Output: 3rd Party Risk


Instruction: Explain third.

Output: 3rd Party Risk


Instruction: What is PR.PS-03.247? (Ex1)

Output: Replace hardware when it lacks needed security capabilities or when it cannot support software with needed security capabilities


Instruction: Explain PR.PS-03.247.

Output: Replace hardware when it lacks needed security capabilities or when it cannot support software with needed security capabilities


Instruction: What is PR.PS-03.248? (Ex2)

Output: Define and implement plans for hardware end-of-life maintenance support and obsolescence


Instruction: Explain PR.PS-03.248.

Output: Define and implement plans for hardware end-of-life maintenance support and obsolescence


Instruction: What is PR.PS-03.249? (Ex3)

Output: Perform hardware disposal in a secure, responsible, and auditable manner


Instruction: Explain PR.PS-03.249.

Output: Perform hardware disposal in a secure, responsible, and auditable manner


Instruction: What is PR.PS-04?

Output: Log records are generated and made available for continuous monitoring


Instruction: Explain the requirement of PR.PS-04.

Output: Log records are generated and made available for continuous monitoring


Instruction: What outcome is expected by PR.PS-04?

Output: Log records are generated and made available for continuous monitoring


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is PR.PS-04.250? (Ex1)

Output: Configure all operating systems, applications, and services (including cloud-based services) to generate log records


Instruction: Explain PR.PS-04.250.

Output: Configure all operating systems, applications, and services (including cloud-based services) to generate log records


Instruction: What is PR.PS-04.251? (Ex2)

Output: Configure log generators to securely share their logs with the organization's logging infrastructure systems and services


Instruction: Explain PR.PS-04.251.

Output: Configure log generators to securely share their logs with the organization's logging infrastructure systems and services


Instruction: What is PR.PS-04.252? (Ex3)

Output: Configure log generators to record the data needed by zero-trust architectures


Instruction: Explain PR.PS-04.252.

Output: Configure log generators to record the data needed by zero-trust architectures


Instruction: What is PR.PS-05?

Output: Installation and execution of unauthorized software are prevented


Instruction: Explain the requirement of PR.PS-05.

Output: Installation and execution of unauthorized software are prevented


Instruction: What outcome is expected by PR.PS-05?

Output: Installation and execution of unauthorized software are prevented


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is PR.PS-05.253? (Ex1)

Output: When risk warrants it, restrict software execution to permitted products only or deny the execution of prohibited and unauthorized software


Instruction: Explain PR.PS-05.253.

Output: When risk warrants it, restrict software execution to permitted products only or deny the execution of prohibited and unauthorized software


Instruction: What is PR.PS-05.254? (Ex2)

Output: Verify the source of new software and the software's integrity before installing it


Instruction: Explain PR.PS-05.254.

Output: Verify the source of new software and the software's integrity before installing it


Instruction: What is PR.PS-05.255? (Ex3)

Output: Configure platforms to use only approved DNS services that block access to known malicious domains


Instruction: Explain PR.PS-05.255.

Output: Configure platforms to use only approved DNS services that block access to known malicious domains


Instruction: What is PR.PS-05.256? (Ex4)

Output: Configure platforms to allow the installation of organization-approved software only


Instruction: Explain PR.PS-05.256.

Output: Configure platforms to allow the installation of organization-approved software only


Instruction: What is PR.PS-06?

Output: Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle


Instruction: Explain the requirement of PR.PS-06.

Output: Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle


Instruction: What outcome is expected by PR.PS-06?

Output: Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is PR.PS-06.257? (Ex1)

Output: Protect all components of organization-developed software from tampering and unauthorized access


Instruction: Explain PR.PS-06.257.

Output: Protect all components of organization-developed software from tampering and unauthorized access


Instruction: What is PR.PS-06.258? (Ex2)

Output: Secure all software produced by the organization, with minimal vulnerabilities in their releases


Instruction: Explain PR.PS-06.258.

Output: Secure all software produced by the organization, with minimal vulnerabilities in their releases


Instruction: What is PR.PS-06.259? (Ex3)

Output: Maintain the software used in production environments, and securely dispose of software once it is no longer needed


Instruction: Explain PR.PS-06.259.

Output: Maintain the software used in production environments, and securely dispose of software once it is no longer needed


Instruction: What is PR.IR? (Technology Infrastructure Resilience)

Output: Security architectures are managed with the organization's risk strategy to protect asset confidentiality, integrity, and availability, and organizational resilience


Instruction: Summarize the scope of PR.IR.

Output: Security architectures are managed with the organization's risk strategy to protect asset confidentiality, integrity, and availability, and organizational resilience


Instruction: What does PR.IR cover?

Output: Security architectures are managed with the organization's risk strategy to protect asset confidentiality, integrity, and availability, and organizational resilience


Instruction: What is PR.IR-01?

Output: Networks and environments are protected from unauthorized logical access and usage


Instruction: Explain the requirement of PR.IR-01.

Output: Networks and environments are protected from unauthorized logical access and usage


Instruction: What outcome is expected by PR.IR-01?

Output: Networks and environments are protected from unauthorized logical access and usage


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is third? (3rd)

Output: 3rd Party Risk


Instruction: Explain third.

Output: 3rd Party Risk


Instruction: What is PR.IR-01.260? (Ex1)

Output: Logically segment organization networks and cloud-based platforms according to trust boundaries and platform types (e.g., IT, IoT, OT, mobile, guests), and permit required communications only between segments


Instruction: Explain PR.IR-01.260.

Output: Logically segment organization networks and cloud-based platforms according to trust boundaries and platform types (e.g., IT, IoT, OT, mobile, guests), and permit required communications only between segments


Instruction: What is PR.IR-01.261? (Ex2)

Output: Logically segment organization networks from external networks, and permit only necessary communications to enter the organization's networks from the external networks


Instruction: Explain PR.IR-01.261.

Output: Logically segment organization networks from external networks, and permit only necessary communications to enter the organization's networks from the external networks


Instruction: What is PR.IR-01.262? (Ex3)

Output: Implement zero trust architectures to restrict network access to each resource to the minimum necessary


Instruction: Explain PR.IR-01.262.

Output: Implement zero trust architectures to restrict network access to each resource to the minimum necessary


Instruction: What is PR.IR-01.263? (Ex4)

Output: Check the cyber health of endpoints before allowing them to access and use production resources


Instruction: Explain PR.IR-01.263.

Output: Check the cyber health of endpoints before allowing them to access and use production resources


Instruction: What is PR.IR-02?

Output: The organization's technology assets are protected from environmental threats


Instruction: Explain the requirement of PR.IR-02.

Output: The organization's technology assets are protected from environmental threats


Instruction: What outcome is expected by PR.IR-02?

Output: The organization's technology assets are protected from environmental threats


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is third? (3rd)

Output: 3rd Party Risk


Instruction: Explain third.

Output: 3rd Party Risk


Instruction: What is PR.IR-02.264? (Ex1)

Output: Protect organizational equipment from known environmental threats, such as flooding, fire, wind, and excessive heat and humidity


Instruction: Explain PR.IR-02.264.

Output: Protect organizational equipment from known environmental threats, such as flooding, fire, wind, and excessive heat and humidity


Instruction: What is PR.IR-02.265? (Ex2)

Output: Include protection from environmental threats and provisions for adequate operating infrastructure in requirements for service providers that operate systems on the organization's behalf


Instruction: Explain PR.IR-02.265.

Output: Include protection from environmental threats and provisions for adequate operating infrastructure in requirements for service providers that operate systems on the organization's behalf


Instruction: What is PR.IR-03?

Output: Mechanisms are implemented to achieve resilience requirements in normal and adverse situations


Instruction: Explain the requirement of PR.IR-03.

Output: Mechanisms are implemented to achieve resilience requirements in normal and adverse situations


Instruction: What outcome is expected by PR.IR-03?

Output: Mechanisms are implemented to achieve resilience requirements in normal and adverse situations


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is PR.IR-03.266? (Ex1)

Output: Avoid single points of failure in systems and infrastructure


Instruction: Explain PR.IR-03.266.

Output: Avoid single points of failure in systems and infrastructure


Instruction: What is PR.IR-03.267? (Ex2)

Output: Use load balancing to increase capacity and improve reliability


Instruction: Explain PR.IR-03.267.

Output: Use load balancing to increase capacity and improve reliability


Instruction: What is PR.IR-03.268? (Ex3)

Output: Use high-availability components like redundant storage and power supplies to improve system reliability


Instruction: Explain PR.IR-03.268.

Output: Use high-availability components like redundant storage and power supplies to improve system reliability


Instruction: What is PR.IR-04?

Output: Adequate resource capacity to ensure availability is maintained


Instruction: Explain the requirement of PR.IR-04.

Output: Adequate resource capacity to ensure availability is maintained


Instruction: What outcome is expected by PR.IR-04?

Output: Adequate resource capacity to ensure availability is maintained


Instruction: What is PR.IR-04.269? (Ex1)

Output: Monitor usage of storage, power, compute, network bandwidth, and other resources


Instruction: Explain PR.IR-04.269.

Output: Monitor usage of storage, power, compute, network bandwidth, and other resources


Instruction: What is PR.IR-04.270? (Ex2)

Output: Forecast future needs, and scale resources accordingly


Instruction: Explain PR.IR-04.270.

Output: Forecast future needs, and scale resources accordingly


Instruction: What is PR.AC-01?

Output: Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users and processes


Instruction: Explain the requirement of PR.AC-01.

Output: Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users and processes


Instruction: What outcome is expected by PR.AC-01?

Output: Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users and processes


Instruction: What is WR-PR.AC-01?

Output: Incorporated into PR.AA-01, PR.AA-05


Instruction: Explain WR-PR.AC-01.

Output: Incorporated into PR.AA-01, PR.AA-05


Instruction: What is PR.AC-02?

Output: Physical access to assets is managed and protected


Instruction: Explain the requirement of PR.AC-02.

Output: Physical access to assets is managed and protected


Instruction: What outcome is expected by PR.AC-02?

Output: Physical access to assets is managed and protected


Instruction: What is WR-PR.AC-02?

Output: Moved to PR.AA-06


Instruction: Explain WR-PR.AC-02.

Output: Moved to PR.AA-06


Instruction: What is PR.AC-03?

Output: Remote access is managed


Instruction: Explain the requirement of PR.AC-03.

Output: Remote access is managed


Instruction: What outcome is expected by PR.AC-03?

Output: Remote access is managed


Instruction: What is WR-PR.AC-03?

Output: Incorporated into PR.AA-03, PR.AA-05, PR.IR-01


Instruction: Explain WR-PR.AC-03.

Output: Incorporated into PR.AA-03, PR.AA-05, PR.IR-01


Instruction: What is PR.AC-04?

Output: Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties


Instruction: Explain the requirement of PR.AC-04.

Output: Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties


Instruction: What outcome is expected by PR.AC-04?

Output: Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties


Instruction: What is WR-PR.AC-04?

Output: Moved to PR.AA-05


Instruction: Explain WR-PR.AC-04.

Output: Moved to PR.AA-05


Instruction: What is PR.AC-05?

Output: Network integrity is protected (e.g., network segregation, network segmentation)


Instruction: Explain the requirement of PR.AC-05.

Output: Network integrity is protected (e.g., network segregation, network segmentation)


Instruction: What outcome is expected by PR.AC-05?

Output: Network integrity is protected (e.g., network segregation, network segmentation)


Instruction: What is WR-PR.AC-05?

Output: Incorporated into PR.IR-01


Instruction: Explain WR-PR.AC-05.

Output: Incorporated into PR.IR-01


Instruction: What is PR.AC-06?

Output: Identities are proofed and bound to credentials and asserted in interactions


Instruction: Explain the requirement of PR.AC-06.

Output: Identities are proofed and bound to credentials and asserted in interactions


Instruction: What outcome is expected by PR.AC-06?

Output: Identities are proofed and bound to credentials and asserted in interactions


Instruction: What is WR-PR.AC-06?

Output: Moved to PR.AA-02


Instruction: Explain WR-PR.AC-06.

Output: Moved to PR.AA-02


Instruction: What is PR.AC-07?

Output: Users, devices, and other assets are authenticated (e.g., single-factor, multi-factor) commensurate with the risk of the transaction (e.g., individuals’ security and privacy risks and other organizational risks)


Instruction: Explain the requirement of PR.AC-07.

Output: Users, devices, and other assets are authenticated (e.g., single-factor, multi-factor) commensurate with the risk of the transaction (e.g., individuals’ security and privacy risks and other organizational risks)


Instruction: What outcome is expected by PR.AC-07?

Output: Users, devices, and other assets are authenticated (e.g., single-factor, multi-factor) commensurate with the risk of the transaction (e.g., individuals’ security and privacy risks and other organizational risks)


Instruction: What is WR-PR.AC-07?

Output: Moved to PR.AA-03


Instruction: Explain WR-PR.AC-07.

Output: Moved to PR.AA-03


Instruction: What is WR-PR.AC?

Output: Moved to PR.AA


Instruction: Explain WR-PR.AC.

Output: Moved to PR.AA


Instruction: What is PR.IP-01?

Output: A baseline configuration of information technology/industrial control systems is created and maintained incorporating security principles (e.g. concept of least functionality)


Instruction: Explain the requirement of PR.IP-01.

Output: A baseline configuration of information technology/industrial control systems is created and maintained incorporating security principles (e.g. concept of least functionality)


Instruction: What outcome is expected by PR.IP-01?

Output: A baseline configuration of information technology/industrial control systems is created and maintained incorporating security principles (e.g. concept of least functionality)


Instruction: What is WR-PR.IP-01?

Output: Incorporated into PR.PS-01


Instruction: Explain WR-PR.IP-01.

Output: Incorporated into PR.PS-01


Instruction: What is PR.IP-02?

Output: A System Development Life Cycle to manage systems is implemented


Instruction: Explain the requirement of PR.IP-02.

Output: A System Development Life Cycle to manage systems is implemented


Instruction: What outcome is expected by PR.IP-02?

Output: A System Development Life Cycle to manage systems is implemented


Instruction: What is WR-PR.IP-02?

Output: Incorporated into ID.AM-08, PR.PS-06


Instruction: Explain WR-PR.IP-02.

Output: Incorporated into ID.AM-08, PR.PS-06


Instruction: What is PR.IP-03?

Output: Configuration change control processes are in place


Instruction: Explain the requirement of PR.IP-03.

Output: Configuration change control processes are in place


Instruction: What outcome is expected by PR.IP-03?

Output: Configuration change control processes are in place


Instruction: What is WR-PR.IP-03?

Output: Incorporated into PR.PS-01, ID.RA-07


Instruction: Explain WR-PR.IP-03.

Output: Incorporated into PR.PS-01, ID.RA-07


Instruction: What is PR.IP-04?

Output: Backups of information are conducted, maintained, and tested


Instruction: Explain the requirement of PR.IP-04.

Output: Backups of information are conducted, maintained, and tested


Instruction: What outcome is expected by PR.IP-04?

Output: Backups of information are conducted, maintained, and tested


Instruction: What is WR-PR.IP-04?

Output: Moved to PR.DS-11


Instruction: Explain WR-PR.IP-04.

Output: Moved to PR.DS-11


Instruction: What is PR.IP-05?

Output: Policy and regulations regarding the physical operating environment for organizational assets are met


Instruction: Explain the requirement of PR.IP-05.

Output: Policy and regulations regarding the physical operating environment for organizational assets are met


Instruction: What outcome is expected by PR.IP-05?

Output: Policy and regulations regarding the physical operating environment for organizational assets are met


Instruction: What is WR-PR.IP-05?

Output: Moved to PR.IR-02


Instruction: Explain WR-PR.IP-05.

Output: Moved to PR.IR-02


Instruction: What is PR.IP-06?

Output: Data is destroyed according to policy


Instruction: Explain the requirement of PR.IP-06.

Output: Data is destroyed according to policy


Instruction: What outcome is expected by PR.IP-06?

Output: Data is destroyed according to policy


Instruction: What is WR-PR.IP-06?

Output: Incorporated into ID.AM-08


Instruction: Explain WR-PR.IP-06.

Output: Incorporated into ID.AM-08


Instruction: What is PR.IP-07?

Output: Protection processes are improved


Instruction: Explain the requirement of PR.IP-07.

Output: Protection processes are improved


Instruction: What outcome is expected by PR.IP-07?

Output: Protection processes are improved


Instruction: What is WR-PR.IP-07?

Output: Incorporated into ID.IM, ID.IM-03


Instruction: Explain WR-PR.IP-07.

Output: Incorporated into ID.IM, ID.IM-03


Instruction: What is PR.IP-08?

Output: Effectiveness of protection technologies is shared


Instruction: Explain the requirement of PR.IP-08.

Output: Effectiveness of protection technologies is shared


Instruction: What outcome is expected by PR.IP-08?

Output: Effectiveness of protection technologies is shared


Instruction: What is WR-PR.IP-08?

Output: Moved to ID.IM-03


Instruction: Explain WR-PR.IP-08.

Output: Moved to ID.IM-03


Instruction: What is PR.IP-09?

Output: Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed


Instruction: Explain the requirement of PR.IP-09.

Output: Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed


Instruction: What outcome is expected by PR.IP-09?

Output: Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed


Instruction: What is WR-PR.IP-09?

Output: Moved to ID.IM-04


Instruction: Explain WR-PR.IP-09.

Output: Moved to ID.IM-04


Instruction: What is PR.IP-10?

Output: Response and recovery plans are tested


Instruction: Explain the requirement of PR.IP-10.

Output: Response and recovery plans are tested


Instruction: What outcome is expected by PR.IP-10?

Output: Response and recovery plans are tested


Instruction: What is WR-PR.IP-10?

Output: Incorporated into ID.IM-02, ID.IM-04


Instruction: Explain WR-PR.IP-10.

Output: Incorporated into ID.IM-02, ID.IM-04


Instruction: What is PR.IP-11?

Output: Cybersecurity is included in human resources practices (e.g., deprovisioning, personnel screening)


Instruction: Explain the requirement of PR.IP-11.

Output: Cybersecurity is included in human resources practices (e.g., deprovisioning, personnel screening)


Instruction: What outcome is expected by PR.IP-11?

Output: Cybersecurity is included in human resources practices (e.g., deprovisioning, personnel screening)


Instruction: What is WR-PR.IP-11?

Output: Moved to GV.RR-04


Instruction: Explain WR-PR.IP-11.

Output: Moved to GV.RR-04


Instruction: What is PR.IP-12?

Output: A vulnerability management plan is developed and implemented


Instruction: Explain the requirement of PR.IP-12.

Output: A vulnerability management plan is developed and implemented


Instruction: What outcome is expected by PR.IP-12?

Output: A vulnerability management plan is developed and implemented


Instruction: What is WR-PR.IP-12?

Output: Incorporated into ID.RA-01, PR.PS-02


Instruction: Explain WR-PR.IP-12.

Output: Incorporated into ID.RA-01, PR.PS-02


Instruction: What is WR-PR.IP?

Output: Incorporated into other Categories and Functions


Instruction: Explain WR-PR.IP.

Output: Incorporated into other Categories and Functions


Instruction: What is PR.MA-01?

Output: Maintenance and repair of organizational assets are performed and logged, with approved and controlled tools


Instruction: Explain the requirement of PR.MA-01.

Output: Maintenance and repair of organizational assets are performed and logged, with approved and controlled tools


Instruction: What outcome is expected by PR.MA-01?

Output: Maintenance and repair of organizational assets are performed and logged, with approved and controlled tools


Instruction: What is WR-PR.MA-01?

Output: Incorporated into ID.AM-08, PR.PS-03


Instruction: Explain WR-PR.MA-01.

Output: Incorporated into ID.AM-08, PR.PS-03


Instruction: What is PR.MA-02?

Output: Remote maintenance of organizational assets is approved, logged, and performed in a manner that prevents unauthorized access


Instruction: Explain the requirement of PR.MA-02.

Output: Remote maintenance of organizational assets is approved, logged, and performed in a manner that prevents unauthorized access


Instruction: What outcome is expected by PR.MA-02?

Output: Remote maintenance of organizational assets is approved, logged, and performed in a manner that prevents unauthorized access


Instruction: What is WR-PR.MA-02?

Output: Incorporated into ID.AM-08, PR.PS-02


Instruction: Explain WR-PR.MA-02.

Output: Incorporated into ID.AM-08, PR.PS-02


Instruction: What is WR-PR.MA?

Output: Incorporated into ID.AM-08


Instruction: Explain WR-PR.MA.

Output: Incorporated into ID.AM-08


Instruction: What is PR.PT-01?

Output: Audit/log records are determined, documented, implemented, and reviewed in accordance with policy


Instruction: Explain the requirement of PR.PT-01.

Output: Audit/log records are determined, documented, implemented, and reviewed in accordance with policy


Instruction: What outcome is expected by PR.PT-01?

Output: Audit/log records are determined, documented, implemented, and reviewed in accordance with policy


Instruction: What is WR-PR.PT-01?

Output: Incorporated into PR.PS-04


Instruction: Explain WR-PR.PT-01.

Output: Incorporated into PR.PS-04


Instruction: What is PR.PT-02?

Output: Removable media is protected and its use restricted according to policy


Instruction: Explain the requirement of PR.PT-02.

Output: Removable media is protected and its use restricted according to policy


Instruction: What outcome is expected by PR.PT-02?

Output: Removable media is protected and its use restricted according to policy


Instruction: What is WR-PR.PT-02?

Output: Incorporated into PR.DS-01, PR.PS-01


Instruction: Explain WR-PR.PT-02.

Output: Incorporated into PR.DS-01, PR.PS-01


Instruction: What is PR.PT-03?

Output: The principle of least functionality is incorporated by configuring systems to provide only essential capabilities


Instruction: Explain the requirement of PR.PT-03.

Output: The principle of least functionality is incorporated by configuring systems to provide only essential capabilities


Instruction: What outcome is expected by PR.PT-03?

Output: The principle of least functionality is incorporated by configuring systems to provide only essential capabilities


Instruction: What is WR-PR.PT-03?

Output: Incorporated into PR.PS-01


Instruction: Explain WR-PR.PT-03.

Output: Incorporated into PR.PS-01


Instruction: What is PR.PT-04?

Output: Communications and control networks are protected


Instruction: Explain the requirement of PR.PT-04.

Output: Communications and control networks are protected


Instruction: What outcome is expected by PR.PT-04?

Output: Communications and control networks are protected


Instruction: What is WR-PR.PT-04?

Output: Incorporated into PR.AA-06, PR.IR-01


Instruction: Explain WR-PR.PT-04.

Output: Incorporated into PR.AA-06, PR.IR-01


Instruction: What is PR.PT-05?

Output: Mechanisms (e.g., failsafe, load balancing, hot swap) are implemented to achieve resilience requirements in normal and adverse situations


Instruction: Explain the requirement of PR.PT-05.

Output: Mechanisms (e.g., failsafe, load balancing, hot swap) are implemented to achieve resilience requirements in normal and adverse situations


Instruction: What outcome is expected by PR.PT-05?

Output: Mechanisms (e.g., failsafe, load balancing, hot swap) are implemented to achieve resilience requirements in normal and adverse situations


Instruction: What is WR-PR.PT-05?

Output: Moved to PR.IR-03


Instruction: Explain WR-PR.PT-05.

Output: Moved to PR.IR-03


Instruction: What is WR-PR.PT?

Output: Incorporated into other Protect Categories


Instruction: Explain WR-PR.PT.

Output: Incorporated into other Protect Categories


Instruction: What is DE? (DETECT)

Output: Possible cybersecurity attacks and compromises are found and analyzed


Instruction: Summarize the scope of DE.

Output: Possible cybersecurity attacks and compromises are found and analyzed


Instruction: What does DE cover?

Output: Possible cybersecurity attacks and compromises are found and analyzed


Instruction: What is DE.CM? (Continuous Monitoring)

Output: Assets are monitored to find anomalies, indicators of compromise, and other potentially adverse events


Instruction: Summarize the scope of DE.CM.

Output: Assets are monitored to find anomalies, indicators of compromise, and other potentially adverse events


Instruction: What does DE.CM cover?

Output: Assets are monitored to find anomalies, indicators of compromise, and other potentially adverse events


Instruction: What is DE.CM-01?

Output: Networks and network services are monitored to find potentially adverse events


Instruction: Explain the requirement of DE.CM-01.

Output: Networks and network services are monitored to find potentially adverse events


Instruction: What outcome is expected by DE.CM-01?

Output: Networks and network services are monitored to find potentially adverse events


Instruction: What is DE.CM-01.271? (Ex1)

Output: Monitor DNS, BGP, and other network services for adverse events


Instruction: Explain DE.CM-01.271.

Output: Monitor DNS, BGP, and other network services for adverse events


Instruction: What is DE.CM-01.272? (Ex2)

Output: Monitor wired and wireless networks for connections from unauthorized endpoints


Instruction: Explain DE.CM-01.272.

Output: Monitor wired and wireless networks for connections from unauthorized endpoints


Instruction: What is DE.CM-01.273? (Ex3)

Output: Monitor facilities for unauthorized or rogue wireless networks


Instruction: Explain DE.CM-01.273.

Output: Monitor facilities for unauthorized or rogue wireless networks


Instruction: What is DE.CM-01.274? (Ex4)

Output: Compare actual network flows against baselines to detect deviations


Instruction: Explain DE.CM-01.274.

Output: Compare actual network flows against baselines to detect deviations


Instruction: What is DE.CM-01.275? (Ex5)

Output: Monitor network communications to identify changes in security postures for zero trust purposes


Instruction: Explain DE.CM-01.275.

Output: Monitor network communications to identify changes in security postures for zero trust purposes


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is DE.CM-02?

Output: The physical environment is monitored to find potentially adverse events


Instruction: Explain the requirement of DE.CM-02.

Output: The physical environment is monitored to find potentially adverse events


Instruction: What outcome is expected by DE.CM-02?

Output: The physical environment is monitored to find potentially adverse events


Instruction: What is DE.CM-02.276? (Ex1)

Output: Monitor logs from physical access control systems (e.g., badge readers) to find unusual access patterns (e.g., deviations from the norm) and failed access attempts


Instruction: Explain DE.CM-02.276.

Output: Monitor logs from physical access control systems (e.g., badge readers) to find unusual access patterns (e.g., deviations from the norm) and failed access attempts


Instruction: What is DE.CM-02.277? (Ex2)

Output: Review and monitor physical access records (e.g., from visitor registration, sign-in sheets)


Instruction: Explain DE.CM-02.277.

Output: Review and monitor physical access records (e.g., from visitor registration, sign-in sheets)


Instruction: What is DE.CM-02.278? (Ex3)

Output: Monitor physical access controls (e.g., locks, latches, hinge pins, alarms) for signs of tampering


Instruction: Explain DE.CM-02.278.

Output: Monitor physical access controls (e.g., locks, latches, hinge pins, alarms) for signs of tampering


Instruction: What is DE.CM-02.279? (Ex4)

Output: Monitor the physical environment using alarm systems, cameras, and security guards


Instruction: Explain DE.CM-02.279.

Output: Monitor the physical environment using alarm systems, cameras, and security guards


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is DE.CM-03?

Output: Personnel activity and technology usage are monitored to find potentially adverse events


Instruction: Explain the requirement of DE.CM-03.

Output: Personnel activity and technology usage are monitored to find potentially adverse events


Instruction: What outcome is expected by DE.CM-03?

Output: Personnel activity and technology usage are monitored to find potentially adverse events


Instruction: What is DE.CM-03.280? (Ex1)

Output: Use behavior analytics software to detect anomalous user activity to mitigate insider threats


Instruction: Explain DE.CM-03.280.

Output: Use behavior analytics software to detect anomalous user activity to mitigate insider threats


Instruction: What is DE.CM-03.281? (Ex2)

Output: Monitor logs from logical access control systems to find unusual access patterns and failed access attempts


Instruction: Explain DE.CM-03.281.

Output: Monitor logs from logical access control systems to find unusual access patterns and failed access attempts


Instruction: What is DE.CM-03.282? (Ex3)

Output: Continuously monitor deception technology, including user accounts, for any usage


Instruction: Explain DE.CM-03.282.

Output: Continuously monitor deception technology, including user accounts, for any usage


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is DE.CM-04?

Output: Malicious code is detected


Instruction: Explain the requirement of DE.CM-04.

Output: Malicious code is detected


Instruction: What outcome is expected by DE.CM-04?

Output: Malicious code is detected


Instruction: What is WR-DE.CM-04?

Output: Incorporated into DE.CM-01, DE.CM-09


Instruction: Explain WR-DE.CM-04.

Output: Incorporated into DE.CM-01, DE.CM-09


Instruction: What is DE.CM-05?

Output: Unauthorized mobile code is detected


Instruction: Explain the requirement of DE.CM-05.

Output: Unauthorized mobile code is detected


Instruction: What outcome is expected by DE.CM-05?

Output: Unauthorized mobile code is detected


Instruction: What is WR-DE.CM-05?

Output: Incorporated into DE.CM-01, DE.CM-09


Instruction: Explain WR-DE.CM-05.

Output: Incorporated into DE.CM-01, DE.CM-09


Instruction: What is DE.CM-06?

Output: External service provider activities and services are monitored to find potentially adverse events


Instruction: Explain the requirement of DE.CM-06.

Output: External service provider activities and services are monitored to find potentially adverse events


Instruction: What outcome is expected by DE.CM-06?

Output: External service provider activities and services are monitored to find potentially adverse events


Instruction: What is DE.CM-06.283? (Ex1)

Output: Monitor remote and onsite administration and maintenance activities that external providers perform on organizational systems


Instruction: Explain DE.CM-06.283.

Output: Monitor remote and onsite administration and maintenance activities that external providers perform on organizational systems


Instruction: What is DE.CM-06.284? (Ex2)

Output: Monitor activity from cloud-based services, internet service providers, and other service providers for deviations from expected behavior


Instruction: Explain DE.CM-06.284.

Output: Monitor activity from cloud-based services, internet service providers, and other service providers for deviations from expected behavior


Instruction: What is third? (3rd)

Output: 3rd Party Risk


Instruction: Explain third.

Output: 3rd Party Risk


Instruction: What is DE.CM-07?

Output: Monitoring for unauthorized personnel, connections, devices, and software is performed


Instruction: Explain the requirement of DE.CM-07.

Output: Monitoring for unauthorized personnel, connections, devices, and software is performed


Instruction: What outcome is expected by DE.CM-07?

Output: Monitoring for unauthorized personnel, connections, devices, and software is performed


Instruction: What is WR-DE.CM-07?

Output: Incorporated into DE.CM-01, DE.CM-03, DE.CM-06, DE.CM-09


Instruction: Explain WR-DE.CM-07.

Output: Incorporated into DE.CM-01, DE.CM-03, DE.CM-06, DE.CM-09


Instruction: What is DE.CM-08?

Output: Vulnerability scans are performed


Instruction: Explain the requirement of DE.CM-08.

Output: Vulnerability scans are performed


Instruction: What outcome is expected by DE.CM-08?

Output: Vulnerability scans are performed


Instruction: What is WR-DE.CM-08?

Output: Incorporated into ID.RA-01


Instruction: Explain WR-DE.CM-08.

Output: Incorporated into ID.RA-01


Instruction: What is DE.CM-09?

Output: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events


Instruction: Explain the requirement of DE.CM-09.

Output: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events


Instruction: What outcome is expected by DE.CM-09?

Output: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events


Instruction: What is DE.CM-09.285? (Ex1)

Output: Monitor email, web, file sharing, collaboration services, and other common attack vectors to detect malware, phishing, data leaks and exfiltration, and other adverse events


Instruction: Explain DE.CM-09.285.

Output: Monitor email, web, file sharing, collaboration services, and other common attack vectors to detect malware, phishing, data leaks and exfiltration, and other adverse events


Instruction: What is DE.CM-09.286? (Ex2)

Output: Monitor authentication attempts to identify attacks against credentials and unauthorized credential reuse


Instruction: Explain DE.CM-09.286.

Output: Monitor authentication attempts to identify attacks against credentials and unauthorized credential reuse


Instruction: What is DE.CM-09.287? (Ex3)

Output: Monitor software configurations for deviations from security baselines


Instruction: Explain DE.CM-09.287.

Output: Monitor software configurations for deviations from security baselines


Instruction: What is DE.CM-09.288? (Ex4)

Output: Monitor hardware and software for signs of tampering


Instruction: Explain DE.CM-09.288.

Output: Monitor hardware and software for signs of tampering


Instruction: What is DE.CM-09.289? (Ex5)

Output: Use technologies with a presence on endpoints to detect cyber health issues (e.g., missing patches, malware infections, unauthorized software), and redirect the endpoints to a remediation environment before access is authorized


Instruction: Explain DE.CM-09.289.

Output: Use technologies with a presence on endpoints to detect cyber health issues (e.g., missing patches, malware infections, unauthorized software), and redirect the endpoints to a remediation environment before access is authorized


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is DE.AE? (Adverse Event Analysis)

Output: Anomalies, indicators of compromise, and other potentially adverse events are analyzed to characterize the events and detect cybersecurity incidents


Instruction: Summarize the scope of DE.AE.

Output: Anomalies, indicators of compromise, and other potentially adverse events are analyzed to characterize the events and detect cybersecurity incidents


Instruction: What does DE.AE cover?

Output: Anomalies, indicators of compromise, and other potentially adverse events are analyzed to characterize the events and detect cybersecurity incidents


Instruction: What is DE.AE-01?

Output: A baseline of network operations and expected data flows for users and systems is established and managed


Instruction: Explain the requirement of DE.AE-01.

Output: A baseline of network operations and expected data flows for users and systems is established and managed


Instruction: What outcome is expected by DE.AE-01?

Output: A baseline of network operations and expected data flows for users and systems is established and managed


Instruction: What is WR-DE.AE-01?

Output: Incorporated into ID.AM-03


Instruction: Explain WR-DE.AE-01.

Output: Incorporated into ID.AM-03


Instruction: What is DE.AE-02?

Output: Potentially adverse events are analyzed to better understand associated activities


Instruction: Explain the requirement of DE.AE-02.

Output: Potentially adverse events are analyzed to better understand associated activities


Instruction: What outcome is expected by DE.AE-02?

Output: Potentially adverse events are analyzed to better understand associated activities


Instruction: What is DE.AE-02.290? (Ex1)

Output: Use security information and event management (SIEM) or other tools to continuously monitor log events for known malicious and suspicious activity


Instruction: Explain DE.AE-02.290.

Output: Use security information and event management (SIEM) or other tools to continuously monitor log events for known malicious and suspicious activity


Instruction: What is DE.AE-02.291? (Ex2)

Output: Utilize up-to-date cyber threat intelligence in log analysis tools to improve detection accuracy and characterize threat actors, their methods, and indicators of compromise


Instruction: Explain DE.AE-02.291.

Output: Utilize up-to-date cyber threat intelligence in log analysis tools to improve detection accuracy and characterize threat actors, their methods, and indicators of compromise


Instruction: What is DE.AE-02.292? (Ex3)

Output: Regularly conduct manual reviews of log events for technologies that cannot be sufficiently monitored through automation


Instruction: Explain DE.AE-02.292.

Output: Regularly conduct manual reviews of log events for technologies that cannot be sufficiently monitored through automation