Instruction: Explain GV.SC-05.088.

Output: Define security requirements in service-level agreements (SLAs) for monitoring suppliers for acceptable security performance throughout the supplier relationship lifecycle


Instruction: What is GV.SC-05.089? (Ex6)

Output: Contractually require suppliers to disclose cybersecurity features, functions, and vulnerabilities of their products and services for the life of the product or the term of service


Instruction: Explain GV.SC-05.089.

Output: Contractually require suppliers to disclose cybersecurity features, functions, and vulnerabilities of their products and services for the life of the product or the term of service


Instruction: What is GV.SC-05.090? (Ex7)

Output: Contractually require suppliers to provide and maintain a current component inventory (e.g., software or hardware bill of materials) for critical products


Instruction: Explain GV.SC-05.090.

Output: Contractually require suppliers to provide and maintain a current component inventory (e.g., software or hardware bill of materials) for critical products


Instruction: What is GV.SC-05.091? (Ex8)

Output: Contractually require suppliers to vet their employees and guard against insider threats


Instruction: Explain GV.SC-05.091.

Output: Contractually require suppliers to vet their employees and guard against insider threats


Instruction: What is GV.SC-05.092? (Ex9)

Output: Contractually require suppliers to provide evidence of performing acceptable security practices through, for example, self-attestation, conformance to known standards, certifications, or inspections


Instruction: Explain GV.SC-05.092.

Output: Contractually require suppliers to provide evidence of performing acceptable security practices through, for example, self-attestation, conformance to known standards, certifications, or inspections


Instruction: What is GV.SC-05.093? (Ex10)

Output: Specify in contracts and other agreements the rights and responsibilities of the organization, its suppliers, and their supply chains, with respect to potential cybersecurity risks


Instruction: Explain GV.SC-05.093.

Output: Specify in contracts and other agreements the rights and responsibilities of the organization, its suppliers, and their supply chains, with respect to potential cybersecurity risks


Instruction: What is GV.SC-06.094? (Ex1)

Output: Perform thorough due diligence on prospective suppliers that is consistent with procurement planning and commensurate with the level of risk, criticality, and complexity of each supplier relationship


Instruction: Explain GV.SC-06.094.

Output: Perform thorough due diligence on prospective suppliers that is consistent with procurement planning and commensurate with the level of risk, criticality, and complexity of each supplier relationship


Instruction: What is GV.SC-06.095? (Ex2)

Output: Assess the suitability of the technology and cybersecurity capabilities and the risk management practices of prospective suppliers


Instruction: Explain GV.SC-06.095.

Output: Assess the suitability of the technology and cybersecurity capabilities and the risk management practices of prospective suppliers


Instruction: What is GV.SC-06.096? (Ex3)

Output: Conduct supplier risk assessments against business and applicable cybersecurity requirements


Instruction: Explain GV.SC-06.096.

Output: Conduct supplier risk assessments against business and applicable cybersecurity requirements


Instruction: What is GV.SC-06.097? (Ex4)

Output: Assess the authenticity, integrity, and security of critical products prior to acquisition and use


Instruction: Explain GV.SC-06.097.

Output: Assess the authenticity, integrity, and security of critical products prior to acquisition and use


Instruction: What is GV.SC-07.098? (Ex1)

Output: Adjust assessment formats and frequencies based on the third party's reputation and the criticality of the products or services they provide


Instruction: Explain GV.SC-07.098.

Output: Adjust assessment formats and frequencies based on the third party's reputation and the criticality of the products or services they provide


Instruction: What is GV.SC-07.099? (Ex2)

Output: Evaluate third parties' evidence of compliance with contractual cybersecurity requirements, such as self-attestations, warranties, certifications, and other artifacts


Instruction: Explain GV.SC-07.099.

Output: Evaluate third parties' evidence of compliance with contractual cybersecurity requirements, such as self-attestations, warranties, certifications, and other artifacts


Instruction: What is GV.SC-07.100? (Ex3)

Output: Monitor critical suppliers to ensure that they are fulfilling their security obligations throughout the supplier relationship lifecycle using a variety of methods and techniques, such as inspections, audits, tests, or other forms of evaluation


Instruction: Explain GV.SC-07.100.

Output: Monitor critical suppliers to ensure that they are fulfilling their security obligations throughout the supplier relationship lifecycle using a variety of methods and techniques, such as inspections, audits, tests, or other forms of evaluation


Instruction: What is GV.SC-07.101? (Ex4)

Output: Monitor critical suppliers, services, and products for changes to their risk profiles, and reevaluate supplier criticality and risk impact accordingly


Instruction: Explain GV.SC-07.101.

Output: Monitor critical suppliers, services, and products for changes to their risk profiles, and reevaluate supplier criticality and risk impact accordingly


Instruction: What is GV.SC-07.102? (Ex5)

Output: Plan for unexpected supplier and supply chain-related interruptions to ensure business continuity


Instruction: Explain GV.SC-07.102.

Output: Plan for unexpected supplier and supply chain-related interruptions to ensure business continuity


Instruction: What is GV.SC-08.103? (Ex1)

Output: Define and use rules and protocols for reporting incident response and recovery activities and the status between the organization and its suppliers


Instruction: Explain GV.SC-08.103.

Output: Define and use rules and protocols for reporting incident response and recovery activities and the status between the organization and its suppliers


Instruction: What is GV.SC-08.104? (Ex2)

Output: Identify and document the roles and responsibilities of the organization and its suppliers for incident response


Instruction: Explain GV.SC-08.104.

Output: Identify and document the roles and responsibilities of the organization and its suppliers for incident response


Instruction: What is GV.SC-08.105? (Ex3)

Output: Include critical suppliers in incident response exercises and simulations


Instruction: Explain GV.SC-08.105.

Output: Include critical suppliers in incident response exercises and simulations


Instruction: What is GV.SC-08.106? (Ex4)

Output: Define and coordinate crisis communication methods and protocols between the organization and its critical suppliers


Instruction: Explain GV.SC-08.106.

Output: Define and coordinate crisis communication methods and protocols between the organization and its critical suppliers


Instruction: What is GV.SC-08.107? (Ex5)

Output: Conduct collaborative lessons learned sessions with critical suppliers


Instruction: Explain GV.SC-08.107.

Output: Conduct collaborative lessons learned sessions with critical suppliers


Instruction: What is GV.SC-09.108? (Ex1)

Output: Policies and procedures require provenance records for all acquired technology products and services


Instruction: Explain GV.SC-09.108.

Output: Policies and procedures require provenance records for all acquired technology products and services


Instruction: What is GV.SC-09.109? (Ex2)

Output: Periodically provide risk reporting to leaders about how acquired components are proven to be untampered and authentic


Instruction: Explain GV.SC-09.109.

Output: Periodically provide risk reporting to leaders about how acquired components are proven to be untampered and authentic


Instruction: What is GV.SC-09.110? (Ex3)

Output: Communicate regularly among cybersecurity risk managers and operations personnel about the need to acquire software patches, updates, and upgrades only from authenticated and trustworthy software providers


Instruction: Explain GV.SC-09.110.

Output: Communicate regularly among cybersecurity risk managers and operations personnel about the need to acquire software patches, updates, and upgrades only from authenticated and trustworthy software providers


Instruction: What is GV.SC-09.111? (Ex4)

Output: Review policies to ensure that they require approved supplier personnel to perform maintenance on supplier products


Instruction: Explain GV.SC-09.111.

Output: Review policies to ensure that they require approved supplier personnel to perform maintenance on supplier products


Instruction: What is GV.SC-09.112? (Ex5)

Output: Policies and procedure require checking upgrades to critical hardware for unauthorized changes


Instruction: Explain GV.SC-09.112.

Output: Policies and procedure require checking upgrades to critical hardware for unauthorized changes


Instruction: What is GV.SC-10.113? (Ex1)

Output: Establish processes for terminating critical relationships under both normal and adverse circumstances


Instruction: Explain GV.SC-10.113.

Output: Establish processes for terminating critical relationships under both normal and adverse circumstances


Instruction: What is GV.SC-10.114? (Ex2)

Output: Define and implement plans for component end-of-life maintenance support and obsolescence


Instruction: Explain GV.SC-10.114.

Output: Define and implement plans for component end-of-life maintenance support and obsolescence


Instruction: What is GV.SC-10.115? (Ex3)

Output: Verify that supplier access to organization resources is deactivated promptly when it is no longer needed


Instruction: Explain GV.SC-10.115.

Output: Verify that supplier access to organization resources is deactivated promptly when it is no longer needed


Instruction: What is GV.SC-10.116? (Ex4)

Output: Verify that assets containing the organization's data are returned or properly disposed of in a timely, controlled, and safe manner


Instruction: Explain GV.SC-10.116.

Output: Verify that assets containing the organization's data are returned or properly disposed of in a timely, controlled, and safe manner


Instruction: What is GV.SC-10.117? (Ex5)

Output: Develop and execute a plan for terminating or transitioning supplier relationships that takes supply chain security risk and resiliency into account


Instruction: Explain GV.SC-10.117.

Output: Develop and execute a plan for terminating or transitioning supplier relationships that takes supply chain security risk and resiliency into account


Instruction: What is GV.SC-10.118? (Ex6)

Output: Mitigate risks to data and systems created by supplier termination


Instruction: Explain GV.SC-10.118.

Output: Mitigate risks to data and systems created by supplier termination


Instruction: What is GV.SC-10.119? (Ex7)

Output: Manage data leakage risks associated with supplier termination


Instruction: Explain GV.SC-10.119.

Output: Manage data leakage risks associated with supplier termination


Instruction: What is ID.AM-01.120? (Ex1)

Output: Maintain inventories for all types of hardware, including IT, IoT, OT, and mobile devices


Instruction: Explain ID.AM-01.120.

Output: Maintain inventories for all types of hardware, including IT, IoT, OT, and mobile devices


Instruction: What is ID.AM-01.121? (Ex2)

Output: Constantly monitor networks to detect new hardware and automatically update inventories


Instruction: Explain ID.AM-01.121.

Output: Constantly monitor networks to detect new hardware and automatically update inventories


Instruction: What is ID.AM-02.122? (Ex1)

Output: Maintain inventories for all types of software and services, including commercial-off-the-shelf, open-source, custom applications, API services, and cloud-based applications and services


Instruction: Explain ID.AM-02.122.

Output: Maintain inventories for all types of software and services, including commercial-off-the-shelf, open-source, custom applications, API services, and cloud-based applications and services


Instruction: What is ID.AM-02.123? (Ex2)

Output: Constantly monitor all platforms, including containers and virtual machines, for software and service inventory changes


Instruction: Explain ID.AM-02.123.

Output: Constantly monitor all platforms, including containers and virtual machines, for software and service inventory changes


Instruction: What is ID.AM-02.124? (Ex3)

Output: Maintain an inventory of the organization's systems


Instruction: Explain ID.AM-02.124.

Output: Maintain an inventory of the organization's systems


Instruction: What is ID.AM-03.125? (Ex1)

Output: Maintain baselines of communication and data flows within the organization's wired and wireless networks


Instruction: Explain ID.AM-03.125.

Output: Maintain baselines of communication and data flows within the organization's wired and wireless networks


Instruction: What is ID.AM-03.126? (Ex2)

Output: Maintain baselines of communication and data flows between the organization and third parties


Instruction: Explain ID.AM-03.126.

Output: Maintain baselines of communication and data flows between the organization and third parties


Instruction: What is ID.AM-03.127? (Ex3)

Output: Maintain baselines of communication and data flows for the organization's infrastructure-as-a-service (IaaS) usage


Instruction: Explain ID.AM-03.127.

Output: Maintain baselines of communication and data flows for the organization's infrastructure-as-a-service (IaaS) usage


Instruction: What is ID.AM-03.128? (Ex4)

Output: Maintain documentation of expected network ports, protocols, and services that are typically used among authorized systems


Instruction: Explain ID.AM-03.128.

Output: Maintain documentation of expected network ports, protocols, and services that are typically used among authorized systems


Instruction: What is ID.AM-04.129? (Ex1)

Output: Inventory all external services used by the organization, including third-party infrastructure-as-a-service (IaaS), platform-as-a-service (PaaS), and software-as-a-service (SaaS) offerings; APIs; and other externally hosted application services


Instruction: Explain ID.AM-04.129.

Output: Inventory all external services used by the organization, including third-party infrastructure-as-a-service (IaaS), platform-as-a-service (PaaS), and software-as-a-service (SaaS) offerings; APIs; and other externally hosted application services


Instruction: What is ID.AM-04.130? (Ex2)

Output: Update the inventory when a new external service is going to be utilized to ensure adequate cybersecurity risk management monitoring of the organization's use of that service


Instruction: Explain ID.AM-04.130.

Output: Update the inventory when a new external service is going to be utilized to ensure adequate cybersecurity risk management monitoring of the organization's use of that service


Instruction: What is ID.AM-05.131? (Ex1)

Output: Define criteria for prioritizing each class of assets


Instruction: Explain ID.AM-05.131.

Output: Define criteria for prioritizing each class of assets


Instruction: What is ID.AM-05.132? (Ex2)

Output: Apply the prioritization criteria to assets


Instruction: Explain ID.AM-05.132.

Output: Apply the prioritization criteria to assets


Instruction: What is ID.AM-05.133? (Ex3)

Output: Track the asset priorities and update them periodically or when significant changes to the organization occur


Instruction: Explain ID.AM-05.133.

Output: Track the asset priorities and update them periodically or when significant changes to the organization occur


Instruction: What is ID.AM-07.134? (Ex1)

Output: Maintain a list of the designated data types of interest (e.g., personally identifiable information, protected health information, financial account numbers, organization intellectual property, operational technology data)


Instruction: Explain ID.AM-07.134.

Output: Maintain a list of the designated data types of interest (e.g., personally identifiable information, protected health information, financial account numbers, organization intellectual property, operational technology data)


Instruction: What is ID.AM-07.135? (Ex2)

Output: Continuously discover and analyze ad hoc data to identify new instances of designated data types


Instruction: Explain ID.AM-07.135.

Output: Continuously discover and analyze ad hoc data to identify new instances of designated data types


Instruction: What is ID.AM-07.136? (Ex3)

Output: Assign data classifications to designated data types through tags or labels


Instruction: Explain ID.AM-07.136.

Output: Assign data classifications to designated data types through tags or labels


Instruction: What is ID.AM-07.137? (Ex4)

Output: Track the provenance, data owner, and geolocation of each instance of designated data types


Instruction: Explain ID.AM-07.137.

Output: Track the provenance, data owner, and geolocation of each instance of designated data types


Instruction: What is ID.AM-08.138? (Ex1)

Output: Integrate cybersecurity considerations throughout the life cycles of systems, hardware, software, and services


Instruction: Explain ID.AM-08.138.

Output: Integrate cybersecurity considerations throughout the life cycles of systems, hardware, software, and services


Instruction: What is ID.AM-08.139? (Ex2)

Output: Integrate cybersecurity considerations into product life cycles


Instruction: Explain ID.AM-08.139.

Output: Integrate cybersecurity considerations into product life cycles


Instruction: What is ID.AM-08.140? (Ex3)

Output: Identify unofficial uses of technology to meet mission objectives (i.e., shadow IT)


Instruction: Explain ID.AM-08.140.

Output: Identify unofficial uses of technology to meet mission objectives (i.e., shadow IT)


Instruction: What is ID.AM-08.141? (Ex4)

Output: Periodically identify redundant systems, hardware, software, and services that unnecessarily increase the organization's attack surface


Instruction: Explain ID.AM-08.141.

Output: Periodically identify redundant systems, hardware, software, and services that unnecessarily increase the organization's attack surface


Instruction: What is ID.AM-08.142? (Ex5)

Output: Properly configure and secure systems, hardware, software, and services prior to their deployment in production


Instruction: Explain ID.AM-08.142.

Output: Properly configure and secure systems, hardware, software, and services prior to their deployment in production


Instruction: What is ID.AM-08.143? (Ex6)

Output: Update inventories when systems, hardware, software, and services are moved or transferred within the organization


Instruction: Explain ID.AM-08.143.

Output: Update inventories when systems, hardware, software, and services are moved or transferred within the organization


Instruction: What is ID.AM-08.144? (Ex7)

Output: Securely destroy stored data based on the organization's data retention policy using the prescribed destruction method, and keep and manage a record of the destructions


Instruction: Explain ID.AM-08.144.

Output: Securely destroy stored data based on the organization's data retention policy using the prescribed destruction method, and keep and manage a record of the destructions


Instruction: What is ID.AM-08.145? (Ex8)

Output: Securely sanitize data storage when hardware is being retired, decommissioned, reassigned, or sent for repairs or replacement


Instruction: Explain ID.AM-08.145.

Output: Securely sanitize data storage when hardware is being retired, decommissioned, reassigned, or sent for repairs or replacement


Instruction: What is ID.AM-08.146? (Ex9)

Output: Offer methods for destroying paper, storage media, and other physical forms of data storage


Instruction: Explain ID.AM-08.146.

Output: Offer methods for destroying paper, storage media, and other physical forms of data storage


Instruction: What is ID.RA-01.147? (Ex1)

Output: Use vulnerability management technologies to identify unpatched and misconfigured software


Instruction: Explain ID.RA-01.147.

Output: Use vulnerability management technologies to identify unpatched and misconfigured software


Instruction: What is ID.RA-01.148? (Ex2)

Output: Assess network and system architectures for design and implementation weaknesses that affect cybersecurity


Instruction: Explain ID.RA-01.148.

Output: Assess network and system architectures for design and implementation weaknesses that affect cybersecurity


Instruction: What is ID.RA-01.149? (Ex3)

Output: Review, analyze, or test organization-developed software to identify design, coding, and default configuration vulnerabilities


Instruction: Explain ID.RA-01.149.

Output: Review, analyze, or test organization-developed software to identify design, coding, and default configuration vulnerabilities


Instruction: What is ID.RA-01.150? (Ex4)

Output: Assess facilities that house critical computing assets for physical vulnerabilities and resilience issues


Instruction: Explain ID.RA-01.150.

Output: Assess facilities that house critical computing assets for physical vulnerabilities and resilience issues


Instruction: What is ID.RA-01.151? (Ex5)

Output: Monitor sources of cyber threat intelligence for information on new vulnerabilities in products and services


Instruction: Explain ID.RA-01.151.

Output: Monitor sources of cyber threat intelligence for information on new vulnerabilities in products and services


Instruction: What is ID.RA-01.152? (Ex6)

Output: Review processes and procedures for weaknesses that could be exploited to affect cybersecurity


Instruction: Explain ID.RA-01.152.

Output: Review processes and procedures for weaknesses that could be exploited to affect cybersecurity


Instruction: What is ID.RA-02.153? (Ex1)

Output: Configure cybersecurity tools and technologies with detection or response capabilities to securely ingest cyber threat intelligence feeds


Instruction: Explain ID.RA-02.153.

Output: Configure cybersecurity tools and technologies with detection or response capabilities to securely ingest cyber threat intelligence feeds


Instruction: What is ID.RA-02.154? (Ex2)

Output: Receive and review advisories from reputable third parties on current threat actors and their tactics, techniques, and procedures (TTPs)


Instruction: Explain ID.RA-02.154.

Output: Receive and review advisories from reputable third parties on current threat actors and their tactics, techniques, and procedures (TTPs)


Instruction: What is ID.RA-02.155? (Ex3)

Output: Monitor sources of cyber threat intelligence for information on the types of vulnerabilities that emerging technologies may have


Instruction: Explain ID.RA-02.155.

Output: Monitor sources of cyber threat intelligence for information on the types of vulnerabilities that emerging technologies may have


Instruction: What is ID.RA-03.156? (Ex1)

Output: Use cyber threat intelligence to maintain awareness of the types of threat actors likely to target the organization and the TTPs they are likely to use


Instruction: Explain ID.RA-03.156.

Output: Use cyber threat intelligence to maintain awareness of the types of threat actors likely to target the organization and the TTPs they are likely to use


Instruction: What is ID.RA-03.157? (Ex2)

Output: Perform threat hunting to look for signs of threat actors within the environment


Instruction: Explain ID.RA-03.157.

Output: Perform threat hunting to look for signs of threat actors within the environment


Instruction: What is ID.RA-03.158? (Ex3)

Output: Implement processes for identifying internal threat actors


Instruction: Explain ID.RA-03.158.

Output: Implement processes for identifying internal threat actors


Instruction: What is ID.RA-04.159? (Ex1)

Output: Business leaders and cybersecurity risk management practitioners work together to estimate the likelihood and impact of risk scenarios and record them in risk registers


Instruction: Explain ID.RA-04.159.

Output: Business leaders and cybersecurity risk management practitioners work together to estimate the likelihood and impact of risk scenarios and record them in risk registers


Instruction: What is ID.RA-04.160? (Ex2)

Output: Enumerate the potential business impacts of unauthorized access to the organization's communications, systems, and data processed in or by those systems


Instruction: Explain ID.RA-04.160.

Output: Enumerate the potential business impacts of unauthorized access to the organization's communications, systems, and data processed in or by those systems


Instruction: What is ID.RA-04.161? (Ex3)

Output: Account for the potential impacts of cascading failures for systems of systems


Instruction: Explain ID.RA-04.161.

Output: Account for the potential impacts of cascading failures for systems of systems


Instruction: What is ID.RA-05.162? (Ex1)

Output: Develop threat models to better understand risks to the data and identify appropriate risk responses


Instruction: Explain ID.RA-05.162.

Output: Develop threat models to better understand risks to the data and identify appropriate risk responses


Instruction: What is ID.RA-05.163? (Ex2)

Output: Prioritize cybersecurity resource allocations and investments based on estimated likelihoods and impacts


Instruction: Explain ID.RA-05.163.

Output: Prioritize cybersecurity resource allocations and investments based on estimated likelihoods and impacts


Instruction: What is ID.RA-06.164? (Ex1)

Output: Apply the vulnerability management plan's criteria for deciding whether to accept, transfer, mitigate, or avoid risk


Instruction: Explain ID.RA-06.164.

Output: Apply the vulnerability management plan's criteria for deciding whether to accept, transfer, mitigate, or avoid risk


Instruction: What is ID.RA-06.165? (Ex2)

Output: Apply the vulnerability management plan's criteria for selecting compensating controls to mitigate risk


Instruction: Explain ID.RA-06.165.

Output: Apply the vulnerability management plan's criteria for selecting compensating controls to mitigate risk


Instruction: What is ID.RA-06.166? (Ex3)

Output: Track the progress of risk response implementation (e.g., plan of action and milestones [POA&M], risk register, risk detail report)


Instruction: Explain ID.RA-06.166.

Output: Track the progress of risk response implementation (e.g., plan of action and milestones [POA&M], risk register, risk detail report)


Instruction: What is ID.RA-06.167? (Ex4)

Output: Use risk assessment findings to inform risk response decisions and actions


Instruction: Explain ID.RA-06.167.

Output: Use risk assessment findings to inform risk response decisions and actions


Instruction: What is ID.RA-06.168? (Ex5)

Output: Communicate planned risk responses to affected stakeholders in priority order


Instruction: Explain ID.RA-06.168.

Output: Communicate planned risk responses to affected stakeholders in priority order


Instruction: What is ID.RA-07.169? (Ex1)

Output: Implement and follow procedures for the formal documentation, review, testing, and approval of proposed changes and requested exceptions


Instruction: Explain ID.RA-07.169.

Output: Implement and follow procedures for the formal documentation, review, testing, and approval of proposed changes and requested exceptions


Instruction: What is ID.RA-07.170? (Ex2)

Output: Document the possible risks of making or not making each proposed change, and provide guidance on rolling back changes


Instruction: Explain ID.RA-07.170.

Output: Document the possible risks of making or not making each proposed change, and provide guidance on rolling back changes


Instruction: What is ID.RA-07.171? (Ex3)

Output: Document the risks related to each requested exception and the plan for responding to those risks


Instruction: Explain ID.RA-07.171.

Output: Document the risks related to each requested exception and the plan for responding to those risks


Instruction: What is ID.RA-07.172? (Ex4)

Output: Periodically review risks that were accepted based upon planned future actions or milestones


Instruction: Explain ID.RA-07.172.

Output: Periodically review risks that were accepted based upon planned future actions or milestones


Instruction: What is ID.RA-08.173? (Ex1)

Output: Conduct vulnerability information sharing between the organization and its suppliers following the rules and protocols defined in contracts


Instruction: Explain ID.RA-08.173.

Output: Conduct vulnerability information sharing between the organization and its suppliers following the rules and protocols defined in contracts


Instruction: What is ID.RA-08.174? (Ex2)

Output: Assign responsibilities and verify the execution of procedures for processing, analyzing the impact of, and responding to cybersecurity threat, vulnerability, or incident disclosures by suppliers, customers, partners, and government cybersecurity organizations


Instruction: Explain ID.RA-08.174.

Output: Assign responsibilities and verify the execution of procedures for processing, analyzing the impact of, and responding to cybersecurity threat, vulnerability, or incident disclosures by suppliers, customers, partners, and government cybersecurity organizations


Instruction: What is ID.RA-09.175? (Ex1)

Output: Assess the authenticity and cybersecurity of critical technology products and services prior to acquisition and use


Instruction: Explain ID.RA-09.175.

Output: Assess the authenticity and cybersecurity of critical technology products and services prior to acquisition and use


Instruction: What is ID.RA-10.176? (Ex1)

Output: Conduct supplier risk assessments against business and applicable cybersecurity requirements, including the supply chain


Instruction: Explain ID.RA-10.176.

Output: Conduct supplier risk assessments against business and applicable cybersecurity requirements, including the supply chain


Instruction: What is ID.IM-01.177? (Ex1)

Output: Perform self-assessments of critical services that take current threats and TTPs into consideration


Instruction: Explain ID.IM-01.177.

Output: Perform self-assessments of critical services that take current threats and TTPs into consideration


Instruction: What is ID.IM-01.178? (Ex2)

Output: Invest in third-party assessments or independent audits of the effectiveness of the organization's cybersecurity program to identify areas that need improvement


Instruction: Explain ID.IM-01.178.

Output: Invest in third-party assessments or independent audits of the effectiveness of the organization's cybersecurity program to identify areas that need improvement


Instruction: What is ID.IM-01.179? (Ex3)

Output: Constantly evaluate compliance with selected cybersecurity requirements through automated means


Instruction: Explain ID.IM-01.179.

Output: Constantly evaluate compliance with selected cybersecurity requirements through automated means


Instruction: What is ID.IM-02.180? (Ex1)

Output: Identify improvements for future incident response activities based on findings from incident response assessments (e.g., tabletop exercises and simulations, tests, internal reviews, independent audits)


Instruction: Explain ID.IM-02.180.

Output: Identify improvements for future incident response activities based on findings from incident response assessments (e.g., tabletop exercises and simulations, tests, internal reviews, independent audits)


Instruction: What is ID.IM-02.181? (Ex2)

Output: Identify improvements for future business continuity, disaster recovery, and incident response activities based on exercises performed in coordination with critical service providers and product suppliers


Instruction: Explain ID.IM-02.181.

Output: Identify improvements for future business continuity, disaster recovery, and incident response activities based on exercises performed in coordination with critical service providers and product suppliers


Instruction: What is ID.IM-02.182? (Ex3)

Output: Involve internal stakeholders (e.g., senior executives, legal department, HR) in security tests and exercises as appropriate


Instruction: Explain ID.IM-02.182.

Output: Involve internal stakeholders (e.g., senior executives, legal department, HR) in security tests and exercises as appropriate


Instruction: What is ID.IM-02.183? (Ex4)

Output: Perform penetration testing to identify opportunities to improve the security posture of selected high-risk systems as approved by leadership


Instruction: Explain ID.IM-02.183.

Output: Perform penetration testing to identify opportunities to improve the security posture of selected high-risk systems as approved by leadership


Instruction: What is ID.IM-02.184? (Ex5)

Output: Exercise contingency plans for responding to and recovering from the discovery that products or services did not originate with the contracted supplier or partner or were altered before receipt


Instruction: Explain ID.IM-02.184.

Output: Exercise contingency plans for responding to and recovering from the discovery that products or services did not originate with the contracted supplier or partner or were altered before receipt


Instruction: What is ID.IM-02.185? (Ex6)

Output: Collect and analyze performance metrics using security tools and services to inform improvements to the cybersecurity program


Instruction: Explain ID.IM-02.185.

Output: Collect and analyze performance metrics using security tools and services to inform improvements to the cybersecurity program


Instruction: What is ID.IM-03.186? (Ex1)

Output: Conduct collaborative lessons learned sessions with suppliers


Instruction: Explain ID.IM-03.186.

Output: Conduct collaborative lessons learned sessions with suppliers


Instruction: What is ID.IM-03.187? (Ex2)

Output: Annually review cybersecurity policies, processes, and procedures to take lessons learned into account


Instruction: Explain ID.IM-03.187.

Output: Annually review cybersecurity policies, processes, and procedures to take lessons learned into account


Instruction: What is ID.IM-03.188? (Ex3)

Output: Use metrics to assess operational cybersecurity performance over time


Instruction: Explain ID.IM-03.188.

Output: Use metrics to assess operational cybersecurity performance over time


Instruction: What is ID.IM-04.189? (Ex1)

Output: Establish contingency plans (e.g., incident response, business continuity, disaster recovery) for responding to and recovering from adverse events that can interfere with operations, expose confidential information, or otherwise endanger the organization's mission and viability


Instruction: Explain ID.IM-04.189.

Output: Establish contingency plans (e.g., incident response, business continuity, disaster recovery) for responding to and recovering from adverse events that can interfere with operations, expose confidential information, or otherwise endanger the organization's mission and viability


Instruction: What is ID.IM-04.190? (Ex2)

Output: Include contact and communication information, processes for handling common scenarios, and criteria for prioritization, escalation, and elevation in all contingency plans


Instruction: Explain ID.IM-04.190.

Output: Include contact and communication information, processes for handling common scenarios, and criteria for prioritization, escalation, and elevation in all contingency plans


Instruction: What is ID.IM-04.191? (Ex3)

Output: Create a vulnerability management plan to identify and assess all types of vulnerabilities and to prioritize, test, and implement risk responses


Instruction: Explain ID.IM-04.191.

Output: Create a vulnerability management plan to identify and assess all types of vulnerabilities and to prioritize, test, and implement risk responses


Instruction: What is ID.IM-04.192? (Ex4)

Output: Communicate cybersecurity plans (including updates) to those responsible for carrying them out and to affected parties


Instruction: Explain ID.IM-04.192.

Output: Communicate cybersecurity plans (including updates) to those responsible for carrying them out and to affected parties


Instruction: What is ID.IM-04.193? (Ex5)

Output: Review and update all cybersecurity plans annually or when a need for significant improvements is identified


Instruction: Explain ID.IM-04.193.

Output: Review and update all cybersecurity plans annually or when a need for significant improvements is identified


Instruction: What is PR.AA-01.194? (Ex1)

Output: Initiate requests for new access or additional access for employees, contractors, and others, and track, review, and fulfill the requests, with permission from system or data owners when needed


Instruction: Explain PR.AA-01.194.

Output: Initiate requests for new access or additional access for employees, contractors, and others, and track, review, and fulfill the requests, with permission from system or data owners when needed


Instruction: What is PR.AA-01.195? (Ex2)

Output: Issue, manage, and revoke cryptographic certificates and identity tokens, cryptographic keys (i.e., key management), and other credentials


Instruction: Explain PR.AA-01.195.

Output: Issue, manage, and revoke cryptographic certificates and identity tokens, cryptographic keys (i.e., key management), and other credentials


Instruction: What is PR.AA-01.196? (Ex3)

Output: Select a unique identifier for each device from immutable hardware characteristics or an identifier securely provisioned to the device


Instruction: Explain PR.AA-01.196.

Output: Select a unique identifier for each device from immutable hardware characteristics or an identifier securely provisioned to the device


Instruction: What is PR.AA-01.197? (Ex4)

Output: Physically label authorized hardware with an identifier for inventory and servicing purposes


Instruction: Explain PR.AA-01.197.

Output: Physically label authorized hardware with an identifier for inventory and servicing purposes


Instruction: What is PR.AA-02.198? (Ex1)

Output: Verify a person's claimed identity at enrollment time using government-issued identity credentials (e.g., passport, visa, driver's license)


Instruction: Explain PR.AA-02.198.

Output: Verify a person's claimed identity at enrollment time using government-issued identity credentials (e.g., passport, visa, driver's license)


Instruction: What is PR.AA-02.199? (Ex2)

Output: Issue a different credential for each person (i.e., no credential sharing)


Instruction: Explain PR.AA-02.199.

Output: Issue a different credential for each person (i.e., no credential sharing)


Instruction: What is PR.AA-03.200? (Ex1)

Output: Require multifactor authentication


Instruction: Explain PR.AA-03.200.

Output: Require multifactor authentication


Instruction: What is PR.AA-03.201? (Ex2)

Output: Enforce policies for the minimum strength of passwords, PINs, and similar authenticators


Instruction: Explain PR.AA-03.201.

Output: Enforce policies for the minimum strength of passwords, PINs, and similar authenticators


Instruction: What is PR.AA-03.202? (Ex3)

Output: Periodically reauthenticate users, services, and hardware based on risk (e.g., in zero trust architectures)


Instruction: Explain PR.AA-03.202.

Output: Periodically reauthenticate users, services, and hardware based on risk (e.g., in zero trust architectures)


Instruction: What is PR.AA-03.203? (Ex4)

Output: Ensure that authorized personnel can access accounts essential for protecting safety under emergency conditions


Instruction: Explain PR.AA-03.203.

Output: Ensure that authorized personnel can access accounts essential for protecting safety under emergency conditions


Instruction: What is PR.AA-04.204? (Ex1)

Output: Protect identity assertions that are used to convey authentication and user information through single sign-on systems


Instruction: Explain PR.AA-04.204.

Output: Protect identity assertions that are used to convey authentication and user information through single sign-on systems


Instruction: What is PR.AA-04.205? (Ex2)

Output: Protect identity assertions that are used to convey authentication and user information between federated systems


Instruction: Explain PR.AA-04.205.

Output: Protect identity assertions that are used to convey authentication and user information between federated systems


Instruction: What is PR.AA-04.206? (Ex3)

Output: Implement standards-based approaches for identity assertions in all contexts, and follow all guidance for the generation (e.g., data models, metadata), protection (e.g., digital signing, encryption), and verification (e.g., signature validation) of identity assertions


Instruction: Explain PR.AA-04.206.

Output: Implement standards-based approaches for identity assertions in all contexts, and follow all guidance for the generation (e.g., data models, metadata), protection (e.g., digital signing, encryption), and verification (e.g., signature validation) of identity assertions


Instruction: What is PR.AA-05.207? (Ex1)

Output: Review logical and physical access privileges periodically and whenever someone changes roles or leaves the organization, and promptly rescind privileges that are no longer needed


Instruction: Explain PR.AA-05.207.

Output: Review logical and physical access privileges periodically and whenever someone changes roles or leaves the organization, and promptly rescind privileges that are no longer needed


Instruction: What is PR.AA-05.208? (Ex2)

Output: Take attributes of the requester and the requested resource into account for authorization decisions (e.g., geolocation, day/time, requester endpoint's cyber health)


Instruction: Explain PR.AA-05.208.

Output: Take attributes of the requester and the requested resource into account for authorization decisions (e.g., geolocation, day/time, requester endpoint's cyber health)


Instruction: What is PR.AA-05.209? (Ex3)

Output: Restrict access and privileges to the minimum necessary (e.g., zero trust architecture)


Instruction: Explain PR.AA-05.209.

Output: Restrict access and privileges to the minimum necessary (e.g., zero trust architecture)


Instruction: What is PR.AA-05.210? (Ex4)

Output: Periodically review the privileges associated with critical business functions to confirm proper separation of duties


Instruction: Explain PR.AA-05.210.

Output: Periodically review the privileges associated with critical business functions to confirm proper separation of duties


Instruction: What is PR.AA-06.211? (Ex1)

Output: Use security guards, security cameras, locked entrances, alarm systems, and other physical controls to monitor facilities and restrict access


Instruction: Explain PR.AA-06.211.

Output: Use security guards, security cameras, locked entrances, alarm systems, and other physical controls to monitor facilities and restrict access


Instruction: What is PR.AA-06.212? (Ex2)

Output: Employ additional physical security controls for areas that contain high-risk assets


Instruction: Explain PR.AA-06.212.

Output: Employ additional physical security controls for areas that contain high-risk assets


Instruction: What is PR.AA-06.213? (Ex3)

Output: Escort guests, vendors, and other third parties within areas that contain business-critical assets


Instruction: Explain PR.AA-06.213.

Output: Escort guests, vendors, and other third parties within areas that contain business-critical assets


Instruction: What is PR.AT-01.214? (Ex1)

Output: Provide basic cybersecurity awareness and training to employees, contractors, partners, suppliers, and all other users of the organization's non-public resources


Instruction: Explain PR.AT-01.214.

Output: Provide basic cybersecurity awareness and training to employees, contractors, partners, suppliers, and all other users of the organization's non-public resources


Instruction: What is PR.AT-01.215? (Ex2)

Output: Train personnel to recognize social engineering attempts and other common attacks, report attacks and suspicious activity, comply with acceptable use policies, and perform basic cyber hygiene tasks (e.g., patching software, choosing passwords, protecting credentials)


Instruction: Explain PR.AT-01.215.

Output: Train personnel to recognize social engineering attempts and other common attacks, report attacks and suspicious activity, comply with acceptable use policies, and perform basic cyber hygiene tasks (e.g., patching software, choosing passwords, protecting credentials)


Instruction: What is PR.AT-01.216? (Ex3)

Output: Explain the consequences of cybersecurity policy violations, both to individual users and the organization as a whole


Instruction: Explain PR.AT-01.216.

Output: Explain the consequences of cybersecurity policy violations, both to individual users and the organization as a whole


Instruction: What is PR.AT-01.217? (Ex4)

Output: Periodically assess or test users on their understanding of basic cybersecurity practices


Instruction: Explain PR.AT-01.217.

Output: Periodically assess or test users on their understanding of basic cybersecurity practices


Instruction: What is PR.AT-01.218? (Ex5)

Output: Require annual refreshers to reinforce existing practices and introduce new practices


Instruction: Explain PR.AT-01.218.

Output: Require annual refreshers to reinforce existing practices and introduce new practices


Instruction: What is PR.AT-02.219? (Ex1)

Output: Identify the specialized roles within the organization that require additional cybersecurity training, such as physical and cybersecurity personnel, finance personnel, senior leadership, and anyone with access to business-critical data


Instruction: Explain PR.AT-02.219.

Output: Identify the specialized roles within the organization that require additional cybersecurity training, such as physical and cybersecurity personnel, finance personnel, senior leadership, and anyone with access to business-critical data


Instruction: What is PR.AT-02.220? (Ex2)

Output: Provide role-based cybersecurity awareness and training to all those in specialized roles, including contractors, partners, suppliers, and other third parties


Instruction: Explain PR.AT-02.220.

Output: Provide role-based cybersecurity awareness and training to all those in specialized roles, including contractors, partners, suppliers, and other third parties


Instruction: What is PR.AT-02.221? (Ex3)

Output: Periodically assess or test users on their understanding of cybersecurity practices for their specialized roles


Instruction: Explain PR.AT-02.221.

Output: Periodically assess or test users on their understanding of cybersecurity practices for their specialized roles


Instruction: What is PR.AT-02.222? (Ex4)

Output: Require annual refreshers to reinforce existing practices and introduce new practices


Instruction: Explain PR.AT-02.222.

Output: Require annual refreshers to reinforce existing practices and introduce new practices


Instruction: What is PR.DS-01.223? (Ex1)

Output: Use encryption, digital signatures, and cryptographic hashes to protect the confidentiality and integrity of stored data in files, databases, virtual machine disk images, container images, and other resources


Instruction: Explain PR.DS-01.223.

Output: Use encryption, digital signatures, and cryptographic hashes to protect the confidentiality and integrity of stored data in files, databases, virtual machine disk images, container images, and other resources


Instruction: What is PR.DS-01.224? (Ex2)

Output: Use full disk encryption to protect data stored on user endpoints


Instruction: Explain PR.DS-01.224.

Output: Use full disk encryption to protect data stored on user endpoints


Instruction: What is PR.DS-01.225? (Ex3)

Output: Confirm the integrity of software by validating signatures


Instruction: Explain PR.DS-01.225.

Output: Confirm the integrity of software by validating signatures


Instruction: What is PR.DS-01.226? (Ex4)

Output: Restrict the use of removable media to prevent data exfiltration


Instruction: Explain PR.DS-01.226.

Output: Restrict the use of removable media to prevent data exfiltration


Instruction: What is PR.DS-01.227? (Ex5)

Output: Physically secure removable media containing unencrypted sensitive information, such as within locked offices or file cabinets


Instruction: Explain PR.DS-01.227.

Output: Physically secure removable media containing unencrypted sensitive information, such as within locked offices or file cabinets


Instruction: What is PR.DS-02.228? (Ex1)

Output: Use encryption, digital signatures, and cryptographic hashes to protect the confidentiality and integrity of network communications


Instruction: Explain PR.DS-02.228.

Output: Use encryption, digital signatures, and cryptographic hashes to protect the confidentiality and integrity of network communications


Instruction: What is PR.DS-02.229? (Ex2)

Output: Automatically encrypt or block outbound emails and other communications that contain sensitive data, depending on the data classification


Instruction: Explain PR.DS-02.229.

Output: Automatically encrypt or block outbound emails and other communications that contain sensitive data, depending on the data classification


Instruction: What is PR.DS-02.230? (Ex3)

Output: Block access to personal email, file sharing, file storage services, and other personal communications applications and services from organizational systems and networks


Instruction: Explain PR.DS-02.230.

Output: Block access to personal email, file sharing, file storage services, and other personal communications applications and services from organizational systems and networks


Instruction: What is PR.DS-02.231? (Ex4)

Output: Prevent reuse of sensitive data from production environments (e.g., customer records) in development, testing, and other non-production environments


Instruction: Explain PR.DS-02.231.

Output: Prevent reuse of sensitive data from production environments (e.g., customer records) in development, testing, and other non-production environments


Instruction: What is PR.DS-10.232? (Ex1)

Output: Remove data that must remain confidential (e.g., from processors and memory) as soon as it is no longer needed


Instruction: Explain PR.DS-10.232.

Output: Remove data that must remain confidential (e.g., from processors and memory) as soon as it is no longer needed


Instruction: What is PR.DS-10.233? (Ex2)

Output: Protect data in use from access by other users and processes of the same platform


Instruction: Explain PR.DS-10.233.

Output: Protect data in use from access by other users and processes of the same platform


Instruction: What is PR.DS-11.234? (Ex1)

Output: Continuously back up critical data in near-real-time, and back up other data frequently at agreed-upon schedules


Instruction: Explain PR.DS-11.234.

Output: Continuously back up critical data in near-real-time, and back up other data frequently at agreed-upon schedules


Instruction: What is PR.DS-11.235? (Ex2)

Output: Test backups and restores for all types of data sources at least annually


Instruction: Explain PR.DS-11.235.

Output: Test backups and restores for all types of data sources at least annually


Instruction: What is PR.DS-11.236? (Ex3)

Output: Securely store some backups offline and offsite so that an incident or disaster will not damage them


Instruction: Explain PR.DS-11.236.

Output: Securely store some backups offline and offsite so that an incident or disaster will not damage them


Instruction: What is PR.DS-11.237? (Ex4)

Output: Enforce geographic separation and geolocation restrictions for data backup storage


Instruction: Explain PR.DS-11.237.

Output: Enforce geographic separation and geolocation restrictions for data backup storage


Instruction: What is PR.PS-01.238? (Ex1)

Output: Establish, test, deploy, and maintain hardened baselines that enforce the organization's cybersecurity policies and provide only essential capabilities (i.e., principle of least functionality)


Instruction: Explain PR.PS-01.238.

Output: Establish, test, deploy, and maintain hardened baselines that enforce the organization's cybersecurity policies and provide only essential capabilities (i.e., principle of least functionality)


Instruction: What is PR.PS-01.239? (Ex2)

Output: Review all default configuration settings that may potentially impact cybersecurity when installing or upgrading software


Instruction: Explain PR.PS-01.239.

Output: Review all default configuration settings that may potentially impact cybersecurity when installing or upgrading software


Instruction: What is PR.PS-01.240? (Ex3)

Output: Monitor implemented software for deviations from approved baselines


Instruction: Explain PR.PS-01.240.

Output: Monitor implemented software for deviations from approved baselines


Instruction: What is PR.PS-02.241? (Ex1)

Output: Perform routine and emergency patching within the timeframes specified in the vulnerability management plan


Instruction: Explain PR.PS-02.241.

Output: Perform routine and emergency patching within the timeframes specified in the vulnerability management plan


Instruction: What is PR.PS-02.242? (Ex2)

Output: Update container images, and deploy new container instances to replace rather than update existing instances


Instruction: Explain PR.PS-02.242.

Output: Update container images, and deploy new container instances to replace rather than update existing instances


Instruction: What is PR.PS-02.243? (Ex3)

Output: Replace end-of-life software and service versions with supported, maintained versions


Instruction: Explain PR.PS-02.243.

Output: Replace end-of-life software and service versions with supported, maintained versions


Instruction: What is PR.PS-02.244? (Ex4)

Output: Uninstall and remove unauthorized software and services that pose undue risks


Instruction: Explain PR.PS-02.244.

Output: Uninstall and remove unauthorized software and services that pose undue risks


Instruction: What is PR.PS-02.245? (Ex5)

Output: Uninstall and remove any unnecessary software components (e.g., operating system utilities) that attackers might misuse


Instruction: Explain PR.PS-02.245.

Output: Uninstall and remove any unnecessary software components (e.g., operating system utilities) that attackers might misuse


Instruction: What is PR.PS-02.246? (Ex6)

Output: Define and implement plans for software and service end-of-life maintenance support and obsolescence


Instruction: Explain PR.PS-02.246.

Output: Define and implement plans for software and service end-of-life maintenance support and obsolescence


Instruction: What is PR.PS-03.247? (Ex1)

Output: Replace hardware when it lacks needed security capabilities or when it cannot support software with needed security capabilities


Instruction: Explain PR.PS-03.247.

Output: Replace hardware when it lacks needed security capabilities or when it cannot support software with needed security capabilities


Instruction: What is PR.PS-03.248? (Ex2)

Output: Define and implement plans for hardware end-of-life maintenance support and obsolescence


Instruction: Explain PR.PS-03.248.

Output: Define and implement plans for hardware end-of-life maintenance support and obsolescence


Instruction: What is PR.PS-03.249? (Ex3)

Output: Perform hardware disposal in a secure, responsible, and auditable manner


Instruction: Explain PR.PS-03.249.

Output: Perform hardware disposal in a secure, responsible, and auditable manner


Instruction: What is PR.PS-04.250? (Ex1)

Output: Configure all operating systems, applications, and services (including cloud-based services) to generate log records


Instruction: Explain PR.PS-04.250.

Output: Configure all operating systems, applications, and services (including cloud-based services) to generate log records


Instruction: What is PR.PS-04.251? (Ex2)

Output: Configure log generators to securely share their logs with the organization's logging infrastructure systems and services


Instruction: Explain PR.PS-04.251.

Output: Configure log generators to securely share their logs with the organization's logging infrastructure systems and services


Instruction: What is PR.PS-04.252? (Ex3)

Output: Configure log generators to record the data needed by zero-trust architectures


Instruction: Explain PR.PS-04.252.

Output: Configure log generators to record the data needed by zero-trust architectures


Instruction: What is PR.PS-05.253? (Ex1)

Output: When risk warrants it, restrict software execution to permitted products only or deny the execution of prohibited and unauthorized software


Instruction: Explain PR.PS-05.253.

Output: When risk warrants it, restrict software execution to permitted products only or deny the execution of prohibited and unauthorized software


Instruction: What is PR.PS-05.254? (Ex2)

Output: Verify the source of new software and the software's integrity before installing it


Instruction: Explain PR.PS-05.254.

Output: Verify the source of new software and the software's integrity before installing it


Instruction: What is PR.PS-05.255? (Ex3)

Output: Configure platforms to use only approved DNS services that block access to known malicious domains


Instruction: Explain PR.PS-05.255.

Output: Configure platforms to use only approved DNS services that block access to known malicious domains


Instruction: What is PR.PS-05.256? (Ex4)

Output: Configure platforms to allow the installation of organization-approved software only


Instruction: Explain PR.PS-05.256.

Output: Configure platforms to allow the installation of organization-approved software only


Instruction: What is PR.PS-06.257? (Ex1)

Output: Protect all components of organization-developed software from tampering and unauthorized access


Instruction: Explain PR.PS-06.257.

Output: Protect all components of organization-developed software from tampering and unauthorized access


Instruction: What is PR.PS-06.258? (Ex2)

Output: Secure all software produced by the organization, with minimal vulnerabilities in their releases


Instruction: Explain PR.PS-06.258.

Output: Secure all software produced by the organization, with minimal vulnerabilities in their releases


Instruction: What is PR.PS-06.259? (Ex3)

Output: Maintain the software used in production environments, and securely dispose of software once it is no longer needed


Instruction: Explain PR.PS-06.259.

Output: Maintain the software used in production environments, and securely dispose of software once it is no longer needed


Instruction: What is PR.IR-01.260? (Ex1)

Output: Logically segment organization networks and cloud-based platforms according to trust boundaries and platform types (e.g., IT, IoT, OT, mobile, guests), and permit required communications only between segments


Instruction: Explain PR.IR-01.260.

Output: Logically segment organization networks and cloud-based platforms according to trust boundaries and platform types (e.g., IT, IoT, OT, mobile, guests), and permit required communications only between segments


Instruction: What is PR.IR-01.261? (Ex2)

Output: Logically segment organization networks from external networks, and permit only necessary communications to enter the organization's networks from the external networks


Instruction: Explain PR.IR-01.261.

Output: Logically segment organization networks from external networks, and permit only necessary communications to enter the organization's networks from the external networks


Instruction: What is PR.IR-01.262? (Ex3)

Output: Implement zero trust architectures to restrict network access to each resource to the minimum necessary


Instruction: Explain PR.IR-01.262.

Output: Implement zero trust architectures to restrict network access to each resource to the minimum necessary


Instruction: What is PR.IR-01.263? (Ex4)

Output: Check the cyber health of endpoints before allowing them to access and use production resources


Instruction: Explain PR.IR-01.263.

Output: Check the cyber health of endpoints before allowing them to access and use production resources


Instruction: What is PR.IR-02.264? (Ex1)

Output: Protect organizational equipment from known environmental threats, such as flooding, fire, wind, and excessive heat and humidity


Instruction: Explain PR.IR-02.264.

Output: Protect organizational equipment from known environmental threats, such as flooding, fire, wind, and excessive heat and humidity


Instruction: What is PR.IR-02.265? (Ex2)

Output: Include protection from environmental threats and provisions for adequate operating infrastructure in requirements for service providers that operate systems on the organization's behalf


Instruction: Explain PR.IR-02.265.

Output: Include protection from environmental threats and provisions for adequate operating infrastructure in requirements for service providers that operate systems on the organization's behalf


Instruction: What is PR.IR-03.266? (Ex1)

Output: Avoid single points of failure in systems and infrastructure


Instruction: Explain PR.IR-03.266.

Output: Avoid single points of failure in systems and infrastructure


Instruction: What is PR.IR-03.267? (Ex2)

Output: Use load balancing to increase capacity and improve reliability


Instruction: Explain PR.IR-03.267.

Output: Use load balancing to increase capacity and improve reliability


Instruction: What is PR.IR-03.268? (Ex3)

Output: Use high-availability components like redundant storage and power supplies to improve system reliability


Instruction: Explain PR.IR-03.268.

Output: Use high-availability components like redundant storage and power supplies to improve system reliability


Instruction: What is PR.IR-04.269? (Ex1)

Output: Monitor usage of storage, power, compute, network bandwidth, and other resources


Instruction: Explain PR.IR-04.269.

Output: Monitor usage of storage, power, compute, network bandwidth, and other resources


Instruction: What is PR.IR-04.270? (Ex2)

Output: Forecast future needs, and scale resources accordingly


Instruction: Explain PR.IR-04.270.

Output: Forecast future needs, and scale resources accordingly


Instruction: What is DE.CM-01.271? (Ex1)

Output: Monitor DNS, BGP, and other network services for adverse events


Instruction: Explain DE.CM-01.271.

Output: Monitor DNS, BGP, and other network services for adverse events


Instruction: What is DE.CM-01.272? (Ex2)

Output: Monitor wired and wireless networks for connections from unauthorized endpoints


Instruction: Explain DE.CM-01.272.

Output: Monitor wired and wireless networks for connections from unauthorized endpoints


Instruction: What is DE.CM-01.273? (Ex3)

Output: Monitor facilities for unauthorized or rogue wireless networks


Instruction: Explain DE.CM-01.273.

Output: Monitor facilities for unauthorized or rogue wireless networks


Instruction: What is DE.CM-01.274? (Ex4)

Output: Compare actual network flows against baselines to detect deviations


Instruction: Explain DE.CM-01.274.

Output: Compare actual network flows against baselines to detect deviations


Instruction: What is DE.CM-01.275? (Ex5)

Output: Monitor network communications to identify changes in security postures for zero trust purposes


Instruction: Explain DE.CM-01.275.

Output: Monitor network communications to identify changes in security postures for zero trust purposes


Instruction: What is DE.CM-02.276? (Ex1)

Output: Monitor logs from physical access control systems (e.g., badge readers) to find unusual access patterns (e.g., deviations from the norm) and failed access attempts


Instruction: Explain DE.CM-02.276.

Output: Monitor logs from physical access control systems (e.g., badge readers) to find unusual access patterns (e.g., deviations from the norm) and failed access attempts


Instruction: What is DE.CM-02.277? (Ex2)

Output: Review and monitor physical access records (e.g., from visitor registration, sign-in sheets)


Instruction: Explain DE.CM-02.277.

Output: Review and monitor physical access records (e.g., from visitor registration, sign-in sheets)


Instruction: What is DE.CM-02.278? (Ex3)

Output: Monitor physical access controls (e.g., locks, latches, hinge pins, alarms) for signs of tampering


Instruction: Explain DE.CM-02.278.

Output: Monitor physical access controls (e.g., locks, latches, hinge pins, alarms) for signs of tampering


Instruction: What is DE.CM-02.279? (Ex4)

Output: Monitor the physical environment using alarm systems, cameras, and security guards


Instruction: Explain DE.CM-02.279.

Output: Monitor the physical environment using alarm systems, cameras, and security guards


Instruction: What is DE.CM-03.280? (Ex1)

Output: Use behavior analytics software to detect anomalous user activity to mitigate insider threats


Instruction: Explain DE.CM-03.280.

Output: Use behavior analytics software to detect anomalous user activity to mitigate insider threats


Instruction: What is DE.CM-03.281? (Ex2)

Output: Monitor logs from logical access control systems to find unusual access patterns and failed access attempts


Instruction: Explain DE.CM-03.281.

Output: Monitor logs from logical access control systems to find unusual access patterns and failed access attempts


Instruction: What is DE.CM-03.282? (Ex3)

Output: Continuously monitor deception technology, including user accounts, for any usage


Instruction: Explain DE.CM-03.282.

Output: Continuously monitor deception technology, including user accounts, for any usage


Instruction: What is DE.CM-06.283? (Ex1)

Output: Monitor remote and onsite administration and maintenance activities that external providers perform on organizational systems


Instruction: Explain DE.CM-06.283.

Output: Monitor remote and onsite administration and maintenance activities that external providers perform on organizational systems


Instruction: What is DE.CM-06.284? (Ex2)

Output: Monitor activity from cloud-based services, internet service providers, and other service providers for deviations from expected behavior


Instruction: Explain DE.CM-06.284.

Output: Monitor activity from cloud-based services, internet service providers, and other service providers for deviations from expected behavior


Instruction: What is DE.CM-09.285? (Ex1)

Output: Monitor email, web, file sharing, collaboration services, and other common attack vectors to detect malware, phishing, data leaks and exfiltration, and other adverse events


Instruction: Explain DE.CM-09.285.

Output: Monitor email, web, file sharing, collaboration services, and other common attack vectors to detect malware, phishing, data leaks and exfiltration, and other adverse events


Instruction: What is DE.CM-09.286? (Ex2)

Output: Monitor authentication attempts to identify attacks against credentials and unauthorized credential reuse


Instruction: Explain DE.CM-09.286.

Output: Monitor authentication attempts to identify attacks against credentials and unauthorized credential reuse


Instruction: What is DE.CM-09.287? (Ex3)

Output: Monitor software configurations for deviations from security baselines


Instruction: Explain DE.CM-09.287.

Output: Monitor software configurations for deviations from security baselines


Instruction: What is DE.CM-09.288? (Ex4)

Output: Monitor hardware and software for signs of tampering


Instruction: Explain DE.CM-09.288.

Output: Monitor hardware and software for signs of tampering


Instruction: What is DE.CM-09.289? (Ex5)

Output: Use technologies with a presence on endpoints to detect cyber health issues (e.g., missing patches, malware infections, unauthorized software), and redirect the endpoints to a remediation environment before access is authorized


Instruction: Explain DE.CM-09.289.

Output: Use technologies with a presence on endpoints to detect cyber health issues (e.g., missing patches, malware infections, unauthorized software), and redirect the endpoints to a remediation environment before access is authorized


Instruction: What is DE.AE-02.290? (Ex1)

Output: Use security information and event management (SIEM) or other tools to continuously monitor log events for known malicious and suspicious activity


Instruction: Explain DE.AE-02.290.

Output: Use security information and event management (SIEM) or other tools to continuously monitor log events for known malicious and suspicious activity


Instruction: What is DE.AE-02.291? (Ex2)

Output: Utilize up-to-date cyber threat intelligence in log analysis tools to improve detection accuracy and characterize threat actors, their methods, and indicators of compromise


Instruction: Explain DE.AE-02.291.

Output: Utilize up-to-date cyber threat intelligence in log analysis tools to improve detection accuracy and characterize threat actors, their methods, and indicators of compromise


Instruction: What is DE.AE-02.292? (Ex3)

Output: Regularly conduct manual reviews of log events for technologies that cannot be sufficiently monitored through automation


Instruction: Explain DE.AE-02.292.

Output: Regularly conduct manual reviews of log events for technologies that cannot be sufficiently monitored through automation


Instruction: What is DE.AE-02.293? (Ex4)

Output: Use log analysis tools to generate reports on their findings


Instruction: Explain DE.AE-02.293.

Output: Use log analysis tools to generate reports on their findings


Instruction: What is DE.AE-03.294? (Ex1)

Output: Constantly transfer log data generated by other sources to a relatively small number of log servers


Instruction: Explain DE.AE-03.294.

Output: Constantly transfer log data generated by other sources to a relatively small number of log servers


Instruction: What is DE.AE-03.295? (Ex2)

Output: Use event correlation technology (e.g., SIEM) to collect information captured by multiple sources


Instruction: Explain DE.AE-03.295.

Output: Use event correlation technology (e.g., SIEM) to collect information captured by multiple sources


Instruction: What is DE.AE-03.296? (Ex3)

Output: Utilize cyber threat intelligence to help correlate events among log sources


Instruction: Explain DE.AE-03.296.

Output: Utilize cyber threat intelligence to help correlate events among log sources


Instruction: What is DE.AE-04.297? (Ex1)

Output: Use SIEMs or other tools to estimate impact and scope, and review and refine the estimates


Instruction: Explain DE.AE-04.297.

Output: Use SIEMs or other tools to estimate impact and scope, and review and refine the estimates


Instruction: What is DE.AE-04.298? (Ex2)

Output: A person creates their own estimates of impact and scope


Instruction: Explain DE.AE-04.298.

Output: A person creates their own estimates of impact and scope


Instruction: What is DE.AE-06.299? (Ex1)

Output: Use cybersecurity software to generate alerts and provide them to the security operations center (SOC), incident responders, and incident response tools


Instruction: Explain DE.AE-06.299.

Output: Use cybersecurity software to generate alerts and provide them to the security operations center (SOC), incident responders, and incident response tools


Instruction: What is DE.AE-06.300? (Ex2)

Output: Incident responders and other authorized personnel can access log analysis findings at all times


Instruction: Explain DE.AE-06.300.

Output: Incident responders and other authorized personnel can access log analysis findings at all times


Instruction: What is DE.AE-06.301? (Ex3)

Output: Automatically create and assign tickets in the organization's ticketing system when certain types of alerts occur


Instruction: Explain DE.AE-06.301.

Output: Automatically create and assign tickets in the organization's ticketing system when certain types of alerts occur


Instruction: What is DE.AE-06.302? (Ex4)

Output: Manually create and assign tickets in the organization's ticketing system when technical staff discover indicators of compromise


Instruction: Explain DE.AE-06.302.

Output: Manually create and assign tickets in the organization's ticketing system when technical staff discover indicators of compromise


Instruction: What is DE.AE-07.303? (Ex1)

Output: Securely provide cyber threat intelligence feeds to detection technologies, processes, and personnel


Instruction: Explain DE.AE-07.303.

Output: Securely provide cyber threat intelligence feeds to detection technologies, processes, and personnel


Instruction: What is DE.AE-07.304? (Ex2)

Output: Securely provide information from asset inventories to detection technologies, processes, and personnel


Instruction: Explain DE.AE-07.304.

Output: Securely provide information from asset inventories to detection technologies, processes, and personnel


Instruction: What is DE.AE-07.305? (Ex3)

Output: Rapidly acquire and analyze vulnerability disclosures for the organization's technologies from suppliers, vendors, and third-party security advisories


Instruction: Explain DE.AE-07.305.

Output: Rapidly acquire and analyze vulnerability disclosures for the organization's technologies from suppliers, vendors, and third-party security advisories


Instruction: What is DE.AE-08.306? (Ex1)

Output: Apply incident criteria to known and assumed characteristics of activity in order to determine whether an incident should be declared


Instruction: Explain DE.AE-08.306.

Output: Apply incident criteria to known and assumed characteristics of activity in order to determine whether an incident should be declared


Instruction: What is DE.AE-08.307? (Ex2)

Output: Take known false positives into account when applying incident criteria


Instruction: Explain DE.AE-08.307.

Output: Take known false positives into account when applying incident criteria


Instruction: What is RS.MA-01.308? (Ex1)

Output: Detection technologies automatically report confirmed incidents


Instruction: Explain RS.MA-01.308.

Output: Detection technologies automatically report confirmed incidents


Instruction: What is RS.MA-01.309? (Ex2)

Output: Request incident response assistance from the organization's incident response outsourcer


Instruction: Explain RS.MA-01.309.

Output: Request incident response assistance from the organization's incident response outsourcer


Instruction: What is RS.MA-01.310? (Ex3)

Output: Designate an incident lead for each incident


Instruction: Explain RS.MA-01.310.

Output: Designate an incident lead for each incident


Instruction: What is RS.MA-01.311? (Ex4)

Output: Initiate execution of additional cybersecurity plans as needed to support incident response (for example, business continuity and disaster recovery)


Instruction: Explain RS.MA-01.311.

Output: Initiate execution of additional cybersecurity plans as needed to support incident response (for example, business continuity and disaster recovery)


Instruction: What is RS.MA-02.312? (Ex1)

Output: Preliminarily review incident reports to confirm that they are cybersecurity-related and necessitate incident response activities


Instruction: Explain RS.MA-02.312.

Output: Preliminarily review incident reports to confirm that they are cybersecurity-related and necessitate incident response activities


Instruction: What is RS.MA-02.313? (Ex2)

Output: Apply criteria to estimate the severity of an incident


Instruction: Explain RS.MA-02.313.

Output: Apply criteria to estimate the severity of an incident


Instruction: What is RS.MA-03.314? (Ex1)

Output: Further review and categorize incidents based on the type of incident (e.g., data breach, ransomware, DDoS, account compromise)


Instruction: Explain RS.MA-03.314.

Output: Further review and categorize incidents based on the type of incident (e.g., data breach, ransomware, DDoS, account compromise)


Instruction: What is RS.MA-03.315? (Ex2)

Output: Prioritize incidents based on their scope, likely impact, and time-critical nature


Instruction: Explain RS.MA-03.315.

Output: Prioritize incidents based on their scope, likely impact, and time-critical nature


Instruction: What is RS.MA-03.316? (Ex3)

Output: Select incident response strategies for active incidents by balancing the need to quickly recover from an incident with the need to observe the attacker or conduct a more thorough investigation


Instruction: Explain RS.MA-03.316.

Output: Select incident response strategies for active incidents by balancing the need to quickly recover from an incident with the need to observe the attacker or conduct a more thorough investigation


Instruction: What is RS.MA-04.317? (Ex1)

Output: Track and validate the status of all ongoing incidents


Instruction: Explain RS.MA-04.317.

Output: Track and validate the status of all ongoing incidents


Instruction: What is RS.MA-04.318? (Ex2)

Output: Coordinate incident escalation or elevation with designated internal and external stakeholders


Instruction: Explain RS.MA-04.318.

Output: Coordinate incident escalation or elevation with designated internal and external stakeholders


Instruction: What is RS.MA-05.319? (Ex1)

Output: Apply incident recovery criteria to known and assumed characteristics of the incident to determine whether incident recovery processes should be initiated


Instruction: Explain RS.MA-05.319.

Output: Apply incident recovery criteria to known and assumed characteristics of the incident to determine whether incident recovery processes should be initiated


Instruction: What is RS.MA-05.320? (Ex2)

Output: Take the possible operational disruption of incident recovery activities into account


Instruction: Explain RS.MA-05.320.

Output: Take the possible operational disruption of incident recovery activities into account


Instruction: What is RS.AN-03.321? (Ex1)

Output: Determine the sequence of events that occurred during the incident and which assets and resources were involved in each event


Instruction: Explain RS.AN-03.321.

Output: Determine the sequence of events that occurred during the incident and which assets and resources were involved in each event


Instruction: What is RS.AN-03.322? (Ex2)

Output: Attempt to determine what vulnerabilities, threats, and threat actors were directly or indirectly involved in the incident


Instruction: Explain RS.AN-03.322.

Output: Attempt to determine what vulnerabilities, threats, and threat actors were directly or indirectly involved in the incident


Instruction: What is RS.AN-03.323? (Ex3)

Output: Analyze the incident to find the underlying, systemic root causes


Instruction: Explain RS.AN-03.323.

Output: Analyze the incident to find the underlying, systemic root causes


Instruction: What is RS.AN-03.324? (Ex4)

Output: Check any cyber deception technology for additional information on attacker behavior


Instruction: Explain RS.AN-03.324.

Output: Check any cyber deception technology for additional information on attacker behavior


Instruction: What is RS.AN-06.325? (Ex1)

Output: Require each incident responder and others (e.g., system administrators, cybersecurity engineers) who perform incident response tasks to record their actions and make the record immutable


Instruction: Explain RS.AN-06.325.

Output: Require each incident responder and others (e.g., system administrators, cybersecurity engineers) who perform incident response tasks to record their actions and make the record immutable


Instruction: What is RS.AN-06.326? (Ex2)

Output: Require the incident lead to document the incident in detail and be responsible for preserving the integrity of the documentation and the sources of all information being reported


Instruction: Explain RS.AN-06.326.

Output: Require the incident lead to document the incident in detail and be responsible for preserving the integrity of the documentation and the sources of all information being reported


Instruction: What is RS.AN-07.327? (Ex1)

Output: Collect, preserve, and safeguard the integrity of all pertinent incident data and metadata (e.g., data source, date/time of collection) based on evidence preservation and chain-of-custody procedures


Instruction: Explain RS.AN-07.327.

Output: Collect, preserve, and safeguard the integrity of all pertinent incident data and metadata (e.g., data source, date/time of collection) based on evidence preservation and chain-of-custody procedures


Instruction: What is RS.AN-08.328? (Ex1)

Output: Review other potential targets of the incident to search for indicators of compromise and evidence of persistence


Instruction: Explain RS.AN-08.328.

Output: Review other potential targets of the incident to search for indicators of compromise and evidence of persistence


Instruction: What is RS.AN-08.329? (Ex2)

Output: Automatically run tools on targets to look for indicators of compromise and evidence of persistence


Instruction: Explain RS.AN-08.329.

Output: Automatically run tools on targets to look for indicators of compromise and evidence of persistence


Instruction: What is RS.CO-02.330? (Ex1)

Output: Follow the organization's breach notification procedures after discovering a data breach incident, including notifying affected customers


Instruction: Explain RS.CO-02.330.

Output: Follow the organization's breach notification procedures after discovering a data breach incident, including notifying affected customers


Instruction: What is RS.CO-02.331? (Ex2)

Output: Notify business partners and customers of incidents in accordance with contractual requirements


Instruction: Explain RS.CO-02.331.

Output: Notify business partners and customers of incidents in accordance with contractual requirements


Instruction: What is RS.CO-02.332? (Ex3)

Output: Notify law enforcement agencies and regulatory bodies of incidents based on criteria in the incident response plan and management approval


Instruction: Explain RS.CO-02.332.

Output: Notify law enforcement agencies and regulatory bodies of incidents based on criteria in the incident response plan and management approval


Instruction: What is RS.CO-03.333? (Ex1)

Output: Securely share information consistent with response plans and information sharing agreements


Instruction: Explain RS.CO-03.333.

Output: Securely share information consistent with response plans and information sharing agreements


Instruction: What is RS.CO-03.334? (Ex2)

Output: Voluntarily share information about an attacker's observed TTPs, with all sensitive data removed, with an Information Sharing and Analysis Center (ISAC)


Instruction: Explain RS.CO-03.334.

Output: Voluntarily share information about an attacker's observed TTPs, with all sensitive data removed, with an Information Sharing and Analysis Center (ISAC)


Instruction: What is RS.CO-03.335? (Ex3)

Output: Notify HR when malicious insider activity occurs


Instruction: Explain RS.CO-03.335.

Output: Notify HR when malicious insider activity occurs


Instruction: What is RS.CO-03.336? (Ex4)

Output: Regularly update senior leadership on the status of major incidents


Instruction: Explain RS.CO-03.336.

Output: Regularly update senior leadership on the status of major incidents


Instruction: What is RS.CO-03.337? (Ex5)

Output: Follow the rules and protocols defined in contracts for incident information sharing between the organization and its suppliers


Instruction: Explain RS.CO-03.337.

Output: Follow the rules and protocols defined in contracts for incident information sharing between the organization and its suppliers


Instruction: What is RS.CO-03.338? (Ex6)

Output: Coordinate crisis communication methods between the organization and its critical suppliers


Instruction: Explain RS.CO-03.338.

Output: Coordinate crisis communication methods between the organization and its critical suppliers


Instruction: What is RS.MI-01.339? (Ex1)

Output: Cybersecurity technologies (e.g., antivirus software) and cybersecurity features of other technologies (e.g., operating systems, network infrastructure devices) automatically perform containment actions


Instruction: Explain RS.MI-01.339.

Output: Cybersecurity technologies (e.g., antivirus software) and cybersecurity features of other technologies (e.g., operating systems, network infrastructure devices) automatically perform containment actions


Instruction: What is RS.MI-01.340? (Ex2)

Output: Allow incident responders to manually select and perform containment actions


Instruction: Explain RS.MI-01.340.

Output: Allow incident responders to manually select and perform containment actions


Instruction: What is RS.MI-01.341? (Ex3)

Output: Allow a third party (e.g., internet service provider, managed security service provider) to perform containment actions on behalf of the organization


Instruction: Explain RS.MI-01.341.

Output: Allow a third party (e.g., internet service provider, managed security service provider) to perform containment actions on behalf of the organization


Instruction: What is RS.MI-01.342? (Ex4)

Output: Automatically transfer compromised endpoints to a remediation virtual local area network (VLAN)


Instruction: Explain RS.MI-01.342.

Output: Automatically transfer compromised endpoints to a remediation virtual local area network (VLAN)


Instruction: What is RS.MI-02.343? (Ex1)

Output: Cybersecurity technologies and cybersecurity features of other technologies (e.g., operating systems, network infrastructure devices) automatically perform eradication actions


Instruction: Explain RS.MI-02.343.

Output: Cybersecurity technologies and cybersecurity features of other technologies (e.g., operating systems, network infrastructure devices) automatically perform eradication actions


Instruction: What is RS.MI-02.344? (Ex2)

Output: Allow incident responders to manually select and perform eradication actions


Instruction: Explain RS.MI-02.344.

Output: Allow incident responders to manually select and perform eradication actions


Instruction: What is RS.MI-02.345? (Ex3)

Output: Allow a third party (e.g., managed security service provider) to perform eradication actions on behalf of the organization


Instruction: Explain RS.MI-02.345.

Output: Allow a third party (e.g., managed security service provider) to perform eradication actions on behalf of the organization


Instruction: What is RC.RP-01.346? (Ex1)

Output: Begin recovery procedures during or after incident response processes


Instruction: Explain RC.RP-01.346.

Output: Begin recovery procedures during or after incident response processes


Instruction: What is RC.RP-01.347? (Ex2)

Output: Make all individuals with recovery responsibilities aware of the plans for recovery and the authorizations required to implement each aspect of the plans


Instruction: Explain RC.RP-01.347.

Output: Make all individuals with recovery responsibilities aware of the plans for recovery and the authorizations required to implement each aspect of the plans


Instruction: What is RC.RP-02.348? (Ex1)

Output: Select recovery actions based on the criteria defined in the incident response plan and available resources


Instruction: Explain RC.RP-02.348.

Output: Select recovery actions based on the criteria defined in the incident response plan and available resources


Instruction: What is RC.RP-02.349? (Ex2)

Output: Change planned recovery actions based on a reassessment of organizational needs and resources


Instruction: Explain RC.RP-02.349.

Output: Change planned recovery actions based on a reassessment of organizational needs and resources


Instruction: What is RC.RP-03.350? (Ex1)

Output: Check restoration assets for indicators of compromise, file corruption, and other integrity issues before use


Instruction: Explain RC.RP-03.350.

Output: Check restoration assets for indicators of compromise, file corruption, and other integrity issues before use


Instruction: What is RC.RP-04.351? (Ex1)

Output: Use business impact and system categorization records (including service delivery objectives) to validate that essential services are restored in the appropriate order


Instruction: Explain RC.RP-04.351.

Output: Use business impact and system categorization records (including service delivery objectives) to validate that essential services are restored in the appropriate order


Instruction: What is RC.RP-04.352? (Ex2)

Output: Work with system owners to confirm the successful restoration of systems and the return to normal operations


Instruction: Explain RC.RP-04.352.

Output: Work with system owners to confirm the successful restoration of systems and the return to normal operations


Instruction: What is RC.RP-04.353? (Ex3)

Output: Monitor the performance of restored systems to verify the adequacy of the restoration


Instruction: Explain RC.RP-04.353.

Output: Monitor the performance of restored systems to verify the adequacy of the restoration


Instruction: What is RC.RP-05.354? (Ex1)

Output: Check restored assets for indicators of compromise and remediation of root causes of the incident before production use


Instruction: Explain RC.RP-05.354.

Output: Check restored assets for indicators of compromise and remediation of root causes of the incident before production use


Instruction: What is RC.RP-05.355? (Ex2)

Output: Verify the correctness and adequacy of the restoration actions taken before putting a restored system online


Instruction: Explain RC.RP-05.355.

Output: Verify the correctness and adequacy of the restoration actions taken before putting a restored system online


Instruction: What is RC.RP-06.356? (Ex1)

Output: Prepare an after-action report that documents the incident itself, the response and recovery actions taken, and lessons learned


Instruction: Explain RC.RP-06.356.

Output: Prepare an after-action report that documents the incident itself, the response and recovery actions taken, and lessons learned


Instruction: What is RC.RP-06.357? (Ex2)

Output: Declare the end of incident recovery once the criteria are met


Instruction: Explain RC.RP-06.357.

Output: Declare the end of incident recovery once the criteria are met


Instruction: What is RC.CO-03.358? (Ex1)

Output: Securely share recovery information, including restoration progress, consistent with response plans and information sharing agreements


Instruction: Explain RC.CO-03.358.

Output: Securely share recovery information, including restoration progress, consistent with response plans and information sharing agreements


Instruction: What is RC.CO-03.359? (Ex2)

Output: Regularly update senior leadership on recovery status and restoration progress for major incidents


Instruction: Explain RC.CO-03.359.

Output: Regularly update senior leadership on recovery status and restoration progress for major incidents


Instruction: What is RC.CO-03.360? (Ex3)

Output: Follow the rules and protocols defined in contracts for incident information sharing between the organization and its suppliers


Instruction: Explain RC.CO-03.360.

Output: Follow the rules and protocols defined in contracts for incident information sharing between the organization and its suppliers


Instruction: What is RC.CO-03.361? (Ex4)

Output: Coordinate crisis communication between the organization and its critical suppliers


Instruction: Explain RC.CO-03.361.

Output: Coordinate crisis communication between the organization and its critical suppliers


Instruction: What is RC.CO-04.362? (Ex1)

Output: Follow the organization's breach notification procedures for recovering from a data breach incident


Instruction: Explain RC.CO-04.362.

Output: Follow the organization's breach notification procedures for recovering from a data breach incident


Instruction: What is RC.CO-04.363? (Ex2)

Output: Explain the steps being taken to recover from the incident and to prevent a recurrence


Instruction: Explain RC.CO-04.363.

Output: Explain the steps being taken to recover from the incident and to prevent a recurrence


Instruction: What is GV.OC-01?

Output: The organizational mission is understood and informs cybersecurity risk management


Instruction: Explain the requirement of GV.OC-01.

Output: The organizational mission is understood and informs cybersecurity risk management


Instruction: What outcome is expected by GV.OC-01?

Output: The organizational mission is understood and informs cybersecurity risk management


Instruction: What is GV.OC-02?

Output: Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered


Instruction: Explain the requirement of GV.OC-02.

Output: Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered


Instruction: What outcome is expected by GV.OC-02?

Output: Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered


Instruction: What is GV.OC-03?

Output: Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed


Instruction: Explain the requirement of GV.OC-03.

Output: Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed


Instruction: What outcome is expected by GV.OC-03?

Output: Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed


Instruction: What is GV.OC-04?

Output: Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated


Instruction: Explain the requirement of GV.OC-04.

Output: Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated


Instruction: What outcome is expected by GV.OC-04?

Output: Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated


Instruction: What is GV.OC-05?

Output: Outcomes, capabilities, and services that the organization depends on are understood and communicated


Instruction: Explain the requirement of GV.OC-05.

Output: Outcomes, capabilities, and services that the organization depends on are understood and communicated


Instruction: What outcome is expected by GV.OC-05?

Output: Outcomes, capabilities, and services that the organization depends on are understood and communicated


Instruction: What is GV.RM-01?

Output: Risk management objectives are established and agreed to by organizational stakeholders


Instruction: Explain the requirement of GV.RM-01.

Output: Risk management objectives are established and agreed to by organizational stakeholders


Instruction: What outcome is expected by GV.RM-01?

Output: Risk management objectives are established and agreed to by organizational stakeholders


Instruction: What is GV.RM-02?

Output: Risk appetite and risk tolerance statements are established, communicated, and maintained


Instruction: Explain the requirement of GV.RM-02.

Output: Risk appetite and risk tolerance statements are established, communicated, and maintained


Instruction: What outcome is expected by GV.RM-02?

Output: Risk appetite and risk tolerance statements are established, communicated, and maintained


Instruction: What is GV.RM-03?

Output: Cybersecurity risk management activities and outcomes are included in enterprise risk management processes


Instruction: Explain the requirement of GV.RM-03.

Output: Cybersecurity risk management activities and outcomes are included in enterprise risk management processes


Instruction: What outcome is expected by GV.RM-03?

Output: Cybersecurity risk management activities and outcomes are included in enterprise risk management processes


Instruction: What is GV.RM-04?

Output: Strategic direction that describes appropriate risk response options is established and communicated


Instruction: Explain the requirement of GV.RM-04.

Output: Strategic direction that describes appropriate risk response options is established and communicated


Instruction: What outcome is expected by GV.RM-04?

Output: Strategic direction that describes appropriate risk response options is established and communicated


Instruction: What is GV.RM-05?

Output: Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties


Instruction: Explain the requirement of GV.RM-05.

Output: Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties


Instruction: What outcome is expected by GV.RM-05?

Output: Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties


Instruction: What is GV.RM-06?

Output: A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated


Instruction: Explain the requirement of GV.RM-06.

Output: A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated


Instruction: What outcome is expected by GV.RM-06?

Output: A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated


Instruction: What is GV.RM-07?

Output: Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions


Instruction: Explain the requirement of GV.RM-07.

Output: Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions


Instruction: What outcome is expected by GV.RM-07?

Output: Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions


Instruction: What is GV.RR-01?

Output: Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving


Instruction: Explain the requirement of GV.RR-01.

Output: Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving


Instruction: What outcome is expected by GV.RR-01?

Output: Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving


Instruction: What is GV.RR-02?

Output: Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced


Instruction: Explain the requirement of GV.RR-02.

Output: Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced


Instruction: What outcome is expected by GV.RR-02?

Output: Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced


Instruction: What is GV.RR-03?

Output: Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies


Instruction: Explain the requirement of GV.RR-03.

Output: Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies


Instruction: What outcome is expected by GV.RR-03?

Output: Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies