Instruction: What is GV.RR-04?

Output: Cybersecurity is included in human resources practices


Instruction: Explain the requirement of GV.RR-04.

Output: Cybersecurity is included in human resources practices


Instruction: What outcome is expected by GV.RR-04?

Output: Cybersecurity is included in human resources practices


Instruction: What is GV.PO-01?

Output: Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced


Instruction: Explain the requirement of GV.PO-01.

Output: Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced


Instruction: What outcome is expected by GV.PO-01?

Output: Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced


Instruction: What is GV.PO-02?

Output: Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission


Instruction: Explain the requirement of GV.PO-02.

Output: Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission


Instruction: What outcome is expected by GV.PO-02?

Output: Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission


Instruction: What is GV.OV-01?

Output: Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction


Instruction: Explain the requirement of GV.OV-01.

Output: Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction


Instruction: What outcome is expected by GV.OV-01?

Output: Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction


Instruction: What is GV.OV-02?

Output: The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks


Instruction: Explain the requirement of GV.OV-02.

Output: The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks


Instruction: What outcome is expected by GV.OV-02?

Output: The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks


Instruction: What is GV.OV-03?

Output: Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed


Instruction: Explain the requirement of GV.OV-03.

Output: Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed


Instruction: What outcome is expected by GV.OV-03?

Output: Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed


Instruction: What is GV.SC-01?

Output: A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders


Instruction: Explain the requirement of GV.SC-01.

Output: A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders


Instruction: What outcome is expected by GV.SC-01?

Output: A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders


Instruction: What is GV.SC-02?

Output: Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally


Instruction: Explain the requirement of GV.SC-02.

Output: Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally


Instruction: What outcome is expected by GV.SC-02?

Output: Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally


Instruction: What is GV.SC-03?

Output: Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes


Instruction: Explain the requirement of GV.SC-03.

Output: Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes


Instruction: What outcome is expected by GV.SC-03?

Output: Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes


Instruction: What is GV.SC-04?

Output: Suppliers are known and prioritized by criticality


Instruction: Explain the requirement of GV.SC-04.

Output: Suppliers are known and prioritized by criticality


Instruction: What outcome is expected by GV.SC-04?

Output: Suppliers are known and prioritized by criticality


Instruction: What is GV.SC-05?

Output: Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties


Instruction: Explain the requirement of GV.SC-05.

Output: Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties


Instruction: What outcome is expected by GV.SC-05?

Output: Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties


Instruction: What is GV.SC-06?

Output: Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships


Instruction: Explain the requirement of GV.SC-06.

Output: Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships


Instruction: What outcome is expected by GV.SC-06?

Output: Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships


Instruction: What is GV.SC-07?

Output: The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship


Instruction: Explain the requirement of GV.SC-07.

Output: The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship


Instruction: What outcome is expected by GV.SC-07?

Output: The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship


Instruction: What is GV.SC-08?

Output: Relevant suppliers and other third parties are included in incident planning, response, and recovery activities


Instruction: Explain the requirement of GV.SC-08.

Output: Relevant suppliers and other third parties are included in incident planning, response, and recovery activities


Instruction: What outcome is expected by GV.SC-08?

Output: Relevant suppliers and other third parties are included in incident planning, response, and recovery activities


Instruction: What is GV.SC-09?

Output: Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle


Instruction: Explain the requirement of GV.SC-09.

Output: Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle


Instruction: What outcome is expected by GV.SC-09?

Output: Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle


Instruction: What is GV.SC-10?

Output: Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement


Instruction: Explain the requirement of GV.SC-10.

Output: Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement


Instruction: What outcome is expected by GV.SC-10?

Output: Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement


Instruction: What is ID.AM-01?

Output: Inventories of hardware managed by the organization are maintained


Instruction: Explain the requirement of ID.AM-01.

Output: Inventories of hardware managed by the organization are maintained


Instruction: What outcome is expected by ID.AM-01?

Output: Inventories of hardware managed by the organization are maintained


Instruction: What is ID.AM-02?

Output: Inventories of software, services, and systems managed by the organization are maintained


Instruction: Explain the requirement of ID.AM-02.

Output: Inventories of software, services, and systems managed by the organization are maintained


Instruction: What outcome is expected by ID.AM-02?

Output: Inventories of software, services, and systems managed by the organization are maintained


Instruction: What is ID.AM-03?

Output: Representations of the organization's authorized network communication and internal and external network data flows are maintained


Instruction: Explain the requirement of ID.AM-03.

Output: Representations of the organization's authorized network communication and internal and external network data flows are maintained


Instruction: What outcome is expected by ID.AM-03?

Output: Representations of the organization's authorized network communication and internal and external network data flows are maintained


Instruction: What is ID.AM-04?

Output: Inventories of services provided by suppliers are maintained


Instruction: Explain the requirement of ID.AM-04.

Output: Inventories of services provided by suppliers are maintained


Instruction: What outcome is expected by ID.AM-04?

Output: Inventories of services provided by suppliers are maintained


Instruction: What is ID.AM-05?

Output: Assets are prioritized based on classification, criticality, resources, and impact on the mission


Instruction: Explain the requirement of ID.AM-05.

Output: Assets are prioritized based on classification, criticality, resources, and impact on the mission


Instruction: What outcome is expected by ID.AM-05?

Output: Assets are prioritized based on classification, criticality, resources, and impact on the mission


Instruction: What is ID.AM-07?

Output: Inventories of data and corresponding metadata for designated data types are maintained


Instruction: Explain the requirement of ID.AM-07.

Output: Inventories of data and corresponding metadata for designated data types are maintained


Instruction: What outcome is expected by ID.AM-07?

Output: Inventories of data and corresponding metadata for designated data types are maintained


Instruction: What is ID.AM-08?

Output: Systems, hardware, software, services, and data are managed throughout their life cycles


Instruction: Explain the requirement of ID.AM-08.

Output: Systems, hardware, software, services, and data are managed throughout their life cycles


Instruction: What outcome is expected by ID.AM-08?

Output: Systems, hardware, software, services, and data are managed throughout their life cycles


Instruction: What is ID.RA-01?

Output: Vulnerabilities in assets are identified, validated, and recorded


Instruction: Explain the requirement of ID.RA-01.

Output: Vulnerabilities in assets are identified, validated, and recorded


Instruction: What outcome is expected by ID.RA-01?

Output: Vulnerabilities in assets are identified, validated, and recorded


Instruction: What is ID.RA-02?

Output: Cyber threat intelligence is received from information sharing forums and sources


Instruction: Explain the requirement of ID.RA-02.

Output: Cyber threat intelligence is received from information sharing forums and sources


Instruction: What outcome is expected by ID.RA-02?

Output: Cyber threat intelligence is received from information sharing forums and sources


Instruction: What is ID.RA-03?

Output: Internal and external threats to the organization are identified and recorded


Instruction: Explain the requirement of ID.RA-03.

Output: Internal and external threats to the organization are identified and recorded


Instruction: What outcome is expected by ID.RA-03?

Output: Internal and external threats to the organization are identified and recorded


Instruction: What is ID.RA-04?

Output: Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded


Instruction: Explain the requirement of ID.RA-04.

Output: Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded


Instruction: What outcome is expected by ID.RA-04?

Output: Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded


Instruction: What is ID.RA-05?

Output: Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization


Instruction: Explain the requirement of ID.RA-05.

Output: Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization


Instruction: What outcome is expected by ID.RA-05?

Output: Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization


Instruction: What is ID.RA-06?

Output: Risk responses are chosen, prioritized, planned, tracked, and communicated


Instruction: Explain the requirement of ID.RA-06.

Output: Risk responses are chosen, prioritized, planned, tracked, and communicated


Instruction: What outcome is expected by ID.RA-06?

Output: Risk responses are chosen, prioritized, planned, tracked, and communicated


Instruction: What is ID.RA-07?

Output: Changes and exceptions are managed, assessed for risk impact, recorded, and tracked


Instruction: Explain the requirement of ID.RA-07.

Output: Changes and exceptions are managed, assessed for risk impact, recorded, and tracked


Instruction: What outcome is expected by ID.RA-07?

Output: Changes and exceptions are managed, assessed for risk impact, recorded, and tracked


Instruction: What is ID.RA-08?

Output: Processes for receiving, analyzing, and responding to vulnerability disclosures are established


Instruction: Explain the requirement of ID.RA-08.

Output: Processes for receiving, analyzing, and responding to vulnerability disclosures are established


Instruction: What outcome is expected by ID.RA-08?

Output: Processes for receiving, analyzing, and responding to vulnerability disclosures are established


Instruction: What is ID.RA-09?

Output: The authenticity and integrity of hardware and software are assessed prior to acquisition and use


Instruction: Explain the requirement of ID.RA-09.

Output: The authenticity and integrity of hardware and software are assessed prior to acquisition and use


Instruction: What outcome is expected by ID.RA-09?

Output: The authenticity and integrity of hardware and software are assessed prior to acquisition and use


Instruction: What is ID.RA-10?

Output: Critical suppliers are assessed prior to acquisition


Instruction: Explain the requirement of ID.RA-10.

Output: Critical suppliers are assessed prior to acquisition


Instruction: What outcome is expected by ID.RA-10?

Output: Critical suppliers are assessed prior to acquisition


Instruction: What is ID.IM-01?

Output: Improvements are identified from evaluations


Instruction: Explain the requirement of ID.IM-01.

Output: Improvements are identified from evaluations


Instruction: What outcome is expected by ID.IM-01?

Output: Improvements are identified from evaluations


Instruction: What is ID.IM-02?

Output: Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties


Instruction: Explain the requirement of ID.IM-02.

Output: Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties


Instruction: What outcome is expected by ID.IM-02?

Output: Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties


Instruction: What is ID.IM-03?

Output: Improvements are identified from execution of operational processes, procedures, and activities


Instruction: Explain the requirement of ID.IM-03.

Output: Improvements are identified from execution of operational processes, procedures, and activities


Instruction: What outcome is expected by ID.IM-03?

Output: Improvements are identified from execution of operational processes, procedures, and activities


Instruction: What is ID.IM-04?

Output: Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved


Instruction: Explain the requirement of ID.IM-04.

Output: Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved


Instruction: What outcome is expected by ID.IM-04?

Output: Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved


Instruction: What is PR.AA-01?

Output: Identities and credentials for authorized users, services, and hardware are managed by the organization


Instruction: Explain the requirement of PR.AA-01.

Output: Identities and credentials for authorized users, services, and hardware are managed by the organization


Instruction: What outcome is expected by PR.AA-01?

Output: Identities and credentials for authorized users, services, and hardware are managed by the organization


Instruction: What is PR.AA-02?

Output: Identities are proofed and bound to credentials based on the context of interactions


Instruction: Explain the requirement of PR.AA-02.

Output: Identities are proofed and bound to credentials based on the context of interactions


Instruction: What outcome is expected by PR.AA-02?

Output: Identities are proofed and bound to credentials based on the context of interactions


Instruction: What is PR.AA-03?

Output: Users, services, and hardware are authenticated


Instruction: Explain the requirement of PR.AA-03.

Output: Users, services, and hardware are authenticated


Instruction: What outcome is expected by PR.AA-03?

Output: Users, services, and hardware are authenticated


Instruction: What is PR.AA-04?

Output: Identity assertions are protected, conveyed, and verified


Instruction: Explain the requirement of PR.AA-04.

Output: Identity assertions are protected, conveyed, and verified


Instruction: What outcome is expected by PR.AA-04?

Output: Identity assertions are protected, conveyed, and verified


Instruction: What is PR.AA-05?

Output: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties


Instruction: Explain the requirement of PR.AA-05.

Output: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties


Instruction: What outcome is expected by PR.AA-05?

Output: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties


Instruction: What is PR.AA-06?

Output: Physical access to assets is managed, monitored, and enforced commensurate with risk


Instruction: Explain the requirement of PR.AA-06.

Output: Physical access to assets is managed, monitored, and enforced commensurate with risk


Instruction: What outcome is expected by PR.AA-06?

Output: Physical access to assets is managed, monitored, and enforced commensurate with risk


Instruction: What is PR.AT-01?

Output: Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind


Instruction: Explain the requirement of PR.AT-01.

Output: Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind


Instruction: What outcome is expected by PR.AT-01?

Output: Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind


Instruction: What is PR.AT-02?

Output: Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind


Instruction: Explain the requirement of PR.AT-02.

Output: Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind


Instruction: What outcome is expected by PR.AT-02?

Output: Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind


Instruction: What is PR.DS-01?

Output: The confidentiality, integrity, and availability of data-at-rest are protected


Instruction: Explain the requirement of PR.DS-01.

Output: The confidentiality, integrity, and availability of data-at-rest are protected


Instruction: What outcome is expected by PR.DS-01?

Output: The confidentiality, integrity, and availability of data-at-rest are protected


Instruction: What is PR.DS-02?

Output: The confidentiality, integrity, and availability of data-in-transit are protected


Instruction: Explain the requirement of PR.DS-02.

Output: The confidentiality, integrity, and availability of data-in-transit are protected


Instruction: What outcome is expected by PR.DS-02?

Output: The confidentiality, integrity, and availability of data-in-transit are protected


Instruction: What is PR.DS-10?

Output: The confidentiality, integrity, and availability of data-in-use are protected


Instruction: Explain the requirement of PR.DS-10.

Output: The confidentiality, integrity, and availability of data-in-use are protected


Instruction: What outcome is expected by PR.DS-10?

Output: The confidentiality, integrity, and availability of data-in-use are protected


Instruction: What is PR.DS-11?

Output: Backups of data are created, protected, maintained, and tested


Instruction: Explain the requirement of PR.DS-11.

Output: Backups of data are created, protected, maintained, and tested


Instruction: What outcome is expected by PR.DS-11?

Output: Backups of data are created, protected, maintained, and tested


Instruction: What is PR.PS-01?

Output: Configuration management practices are established and applied


Instruction: Explain the requirement of PR.PS-01.

Output: Configuration management practices are established and applied


Instruction: What outcome is expected by PR.PS-01?

Output: Configuration management practices are established and applied


Instruction: What is PR.PS-02?

Output: Software is maintained, replaced, and removed commensurate with risk


Instruction: Explain the requirement of PR.PS-02.

Output: Software is maintained, replaced, and removed commensurate with risk


Instruction: What outcome is expected by PR.PS-02?

Output: Software is maintained, replaced, and removed commensurate with risk


Instruction: What is PR.PS-03?

Output: Hardware is maintained, replaced, and removed commensurate with risk


Instruction: Explain the requirement of PR.PS-03.

Output: Hardware is maintained, replaced, and removed commensurate with risk


Instruction: What outcome is expected by PR.PS-03?

Output: Hardware is maintained, replaced, and removed commensurate with risk


Instruction: What is PR.PS-04?

Output: Log records are generated and made available for continuous monitoring


Instruction: Explain the requirement of PR.PS-04.

Output: Log records are generated and made available for continuous monitoring


Instruction: What outcome is expected by PR.PS-04?

Output: Log records are generated and made available for continuous monitoring


Instruction: What is PR.PS-05?

Output: Installation and execution of unauthorized software are prevented


Instruction: Explain the requirement of PR.PS-05.

Output: Installation and execution of unauthorized software are prevented


Instruction: What outcome is expected by PR.PS-05?

Output: Installation and execution of unauthorized software are prevented


Instruction: What is PR.PS-06?

Output: Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle


Instruction: Explain the requirement of PR.PS-06.

Output: Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle


Instruction: What outcome is expected by PR.PS-06?

Output: Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle


Instruction: What is PR.IR-01?

Output: Networks and environments are protected from unauthorized logical access and usage


Instruction: Explain the requirement of PR.IR-01.

Output: Networks and environments are protected from unauthorized logical access and usage


Instruction: What outcome is expected by PR.IR-01?

Output: Networks and environments are protected from unauthorized logical access and usage


Instruction: What is PR.IR-02?

Output: The organization's technology assets are protected from environmental threats


Instruction: Explain the requirement of PR.IR-02.

Output: The organization's technology assets are protected from environmental threats


Instruction: What outcome is expected by PR.IR-02?

Output: The organization's technology assets are protected from environmental threats


Instruction: What is PR.IR-03?

Output: Mechanisms are implemented to achieve resilience requirements in normal and adverse situations


Instruction: Explain the requirement of PR.IR-03.

Output: Mechanisms are implemented to achieve resilience requirements in normal and adverse situations


Instruction: What outcome is expected by PR.IR-03?

Output: Mechanisms are implemented to achieve resilience requirements in normal and adverse situations


Instruction: What is PR.IR-04?

Output: Adequate resource capacity to ensure availability is maintained


Instruction: Explain the requirement of PR.IR-04.

Output: Adequate resource capacity to ensure availability is maintained


Instruction: What outcome is expected by PR.IR-04?

Output: Adequate resource capacity to ensure availability is maintained


Instruction: What is DE.CM-01?

Output: Networks and network services are monitored to find potentially adverse events


Instruction: Explain the requirement of DE.CM-01.

Output: Networks and network services are monitored to find potentially adverse events


Instruction: What outcome is expected by DE.CM-01?

Output: Networks and network services are monitored to find potentially adverse events


Instruction: What is DE.CM-02?

Output: The physical environment is monitored to find potentially adverse events


Instruction: Explain the requirement of DE.CM-02.

Output: The physical environment is monitored to find potentially adverse events


Instruction: What outcome is expected by DE.CM-02?

Output: The physical environment is monitored to find potentially adverse events


Instruction: What is DE.CM-03?

Output: Personnel activity and technology usage are monitored to find potentially adverse events


Instruction: Explain the requirement of DE.CM-03.

Output: Personnel activity and technology usage are monitored to find potentially adverse events


Instruction: What outcome is expected by DE.CM-03?

Output: Personnel activity and technology usage are monitored to find potentially adverse events


Instruction: What is DE.CM-06?

Output: External service provider activities and services are monitored to find potentially adverse events


Instruction: Explain the requirement of DE.CM-06.

Output: External service provider activities and services are monitored to find potentially adverse events


Instruction: What outcome is expected by DE.CM-06?

Output: External service provider activities and services are monitored to find potentially adverse events


Instruction: What is DE.CM-09?

Output: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events


Instruction: Explain the requirement of DE.CM-09.

Output: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events


Instruction: What outcome is expected by DE.CM-09?

Output: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events


Instruction: What is DE.AE-02?

Output: Potentially adverse events are analyzed to better understand associated activities


Instruction: Explain the requirement of DE.AE-02.

Output: Potentially adverse events are analyzed to better understand associated activities


Instruction: What outcome is expected by DE.AE-02?

Output: Potentially adverse events are analyzed to better understand associated activities


Instruction: What is DE.AE-03?

Output: Information is correlated from multiple sources


Instruction: Explain the requirement of DE.AE-03.

Output: Information is correlated from multiple sources


Instruction: What outcome is expected by DE.AE-03?

Output: Information is correlated from multiple sources


Instruction: What is DE.AE-04?

Output: The estimated impact and scope of adverse events are understood


Instruction: Explain the requirement of DE.AE-04.

Output: The estimated impact and scope of adverse events are understood


Instruction: What outcome is expected by DE.AE-04?

Output: The estimated impact and scope of adverse events are understood


Instruction: What is DE.AE-06?

Output: Information on adverse events is provided to authorized staff and tools


Instruction: Explain the requirement of DE.AE-06.

Output: Information on adverse events is provided to authorized staff and tools


Instruction: What outcome is expected by DE.AE-06?

Output: Information on adverse events is provided to authorized staff and tools


Instruction: What is DE.AE-07?

Output: Cyber threat intelligence and other contextual information are integrated into the analysis


Instruction: Explain the requirement of DE.AE-07.

Output: Cyber threat intelligence and other contextual information are integrated into the analysis


Instruction: What outcome is expected by DE.AE-07?

Output: Cyber threat intelligence and other contextual information are integrated into the analysis


Instruction: What is DE.AE-08?

Output: Incidents are declared when adverse events meet the defined incident criteria


Instruction: Explain the requirement of DE.AE-08.

Output: Incidents are declared when adverse events meet the defined incident criteria


Instruction: What outcome is expected by DE.AE-08?

Output: Incidents are declared when adverse events meet the defined incident criteria


Instruction: What is RS.MA-01?

Output: The incident response plan is executed in coordination with relevant third parties once an incident is declared


Instruction: Explain the requirement of RS.MA-01.

Output: The incident response plan is executed in coordination with relevant third parties once an incident is declared


Instruction: What outcome is expected by RS.MA-01?

Output: The incident response plan is executed in coordination with relevant third parties once an incident is declared


Instruction: What is RS.MA-02?

Output: Incident reports are triaged and validated


Instruction: Explain the requirement of RS.MA-02.

Output: Incident reports are triaged and validated


Instruction: What outcome is expected by RS.MA-02?

Output: Incident reports are triaged and validated


Instruction: What is RS.MA-03?

Output: Incidents are categorized and prioritized


Instruction: Explain the requirement of RS.MA-03.

Output: Incidents are categorized and prioritized


Instruction: What outcome is expected by RS.MA-03?

Output: Incidents are categorized and prioritized


Instruction: What is RS.MA-04?

Output: Incidents are escalated or elevated as needed


Instruction: Explain the requirement of RS.MA-04.

Output: Incidents are escalated or elevated as needed


Instruction: What outcome is expected by RS.MA-04?

Output: Incidents are escalated or elevated as needed


Instruction: What is RS.MA-05?

Output: The criteria for initiating incident recovery are applied


Instruction: Explain the requirement of RS.MA-05.

Output: The criteria for initiating incident recovery are applied


Instruction: What outcome is expected by RS.MA-05?

Output: The criteria for initiating incident recovery are applied


Instruction: What is RS.AN-03?

Output: Analysis is performed to establish what has taken place during an incident and the root cause of the incident


Instruction: Explain the requirement of RS.AN-03.

Output: Analysis is performed to establish what has taken place during an incident and the root cause of the incident


Instruction: What outcome is expected by RS.AN-03?

Output: Analysis is performed to establish what has taken place during an incident and the root cause of the incident


Instruction: What is RS.AN-06?

Output: Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved


Instruction: Explain the requirement of RS.AN-06.

Output: Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved


Instruction: What outcome is expected by RS.AN-06?

Output: Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved


Instruction: What is RS.AN-07?

Output: Incident data and metadata are collected, and their integrity and provenance are preserved


Instruction: Explain the requirement of RS.AN-07.

Output: Incident data and metadata are collected, and their integrity and provenance are preserved


Instruction: What outcome is expected by RS.AN-07?

Output: Incident data and metadata are collected, and their integrity and provenance are preserved


Instruction: What is RS.AN-08?

Output: An incident's magnitude is estimated and validated


Instruction: Explain the requirement of RS.AN-08.

Output: An incident's magnitude is estimated and validated


Instruction: What outcome is expected by RS.AN-08?

Output: An incident's magnitude is estimated and validated


Instruction: What is RS.CO-02?

Output: Internal and external stakeholders are notified of incidents


Instruction: Explain the requirement of RS.CO-02.

Output: Internal and external stakeholders are notified of incidents


Instruction: What outcome is expected by RS.CO-02?

Output: Internal and external stakeholders are notified of incidents


Instruction: What is RS.CO-03?

Output: Information is shared with designated internal and external stakeholders


Instruction: Explain the requirement of RS.CO-03.

Output: Information is shared with designated internal and external stakeholders


Instruction: What outcome is expected by RS.CO-03?

Output: Information is shared with designated internal and external stakeholders


Instruction: What is RS.MI-01?

Output: Incidents are contained


Instruction: Explain the requirement of RS.MI-01.

Output: Incidents are contained


Instruction: What outcome is expected by RS.MI-01?

Output: Incidents are contained


Instruction: What is RS.MI-02?

Output: Incidents are eradicated


Instruction: Explain the requirement of RS.MI-02.

Output: Incidents are eradicated


Instruction: What outcome is expected by RS.MI-02?

Output: Incidents are eradicated


Instruction: What is RC.RP-01?

Output: The recovery portion of the incident response plan is executed once initiated from the incident response process


Instruction: Explain the requirement of RC.RP-01.

Output: The recovery portion of the incident response plan is executed once initiated from the incident response process


Instruction: What outcome is expected by RC.RP-01?

Output: The recovery portion of the incident response plan is executed once initiated from the incident response process


Instruction: What is RC.RP-02?

Output: Recovery actions are selected, scoped, prioritized, and performed


Instruction: Explain the requirement of RC.RP-02.

Output: Recovery actions are selected, scoped, prioritized, and performed


Instruction: What outcome is expected by RC.RP-02?

Output: Recovery actions are selected, scoped, prioritized, and performed


Instruction: What is RC.RP-03?

Output: The integrity of backups and other restoration assets is verified before using them for restoration


Instruction: Explain the requirement of RC.RP-03.

Output: The integrity of backups and other restoration assets is verified before using them for restoration


Instruction: What outcome is expected by RC.RP-03?

Output: The integrity of backups and other restoration assets is verified before using them for restoration


Instruction: What is RC.RP-04?

Output: Critical mission functions and cybersecurity risk management are considered to establish post-incident operational norms


Instruction: Explain the requirement of RC.RP-04.

Output: Critical mission functions and cybersecurity risk management are considered to establish post-incident operational norms


Instruction: What outcome is expected by RC.RP-04?

Output: Critical mission functions and cybersecurity risk management are considered to establish post-incident operational norms


Instruction: What is RC.RP-05?

Output: The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed


Instruction: Explain the requirement of RC.RP-05.

Output: The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed


Instruction: What outcome is expected by RC.RP-05?

Output: The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed


Instruction: What is RC.RP-06?

Output: The end of incident recovery is declared based on criteria, and incident-related documentation is completed


Instruction: Explain the requirement of RC.RP-06.

Output: The end of incident recovery is declared based on criteria, and incident-related documentation is completed


Instruction: What outcome is expected by RC.RP-06?

Output: The end of incident recovery is declared based on criteria, and incident-related documentation is completed


Instruction: What is RC.CO-03?

Output: Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders


Instruction: Explain the requirement of RC.CO-03.

Output: Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders


Instruction: What outcome is expected by RC.CO-03?

Output: Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders


Instruction: What is RC.CO-04?

Output: Public updates on incident recovery are shared using approved methods and messaging


Instruction: Explain the requirement of RC.CO-04.

Output: Public updates on incident recovery are shared using approved methods and messaging


Instruction: What outcome is expected by RC.CO-04?

Output: Public updates on incident recovery are shared using approved methods and messaging


Instruction: What is third? (3rd)

Output: 3rd Party Risk


Instruction: Explain third.

Output: 3rd Party Risk


Instruction: What is first? (1st)

Output: 1st Party Risk


Instruction: Explain first.

Output: 1st Party Risk


Instruction: What is ID.AM-06?

Output: Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established


Instruction: Explain the requirement of ID.AM-06.

Output: Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established


Instruction: What outcome is expected by ID.AM-06?

Output: Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established


Instruction: What is WR-ID.AM-06?

Output: Incorporated into GV.RR-02, GV.SC-02


Instruction: Explain WR-ID.AM-06.

Output: Incorporated into GV.RR-02, GV.SC-02


Instruction: What is WR-ID.BE?

Output: Incorporated into GV.OC


Instruction: Explain WR-ID.BE.

Output: Incorporated into GV.OC


Instruction: What is ID.BE-01?

Output: The organization’s role in the supply chain is identified and communicated


Instruction: Explain the requirement of ID.BE-01.

Output: The organization’s role in the supply chain is identified and communicated


Instruction: What outcome is expected by ID.BE-01?

Output: The organization’s role in the supply chain is identified and communicated


Instruction: What is WR-ID.BE-01?

Output: Incorporated into GV.OC-05


Instruction: Explain WR-ID.BE-01.

Output: Incorporated into GV.OC-05


Instruction: What is ID.BE-02?

Output: The organization’s place in critical infrastructure and its industry sector is identified and communicated


Instruction: Explain the requirement of ID.BE-02.

Output: The organization’s place in critical infrastructure and its industry sector is identified and communicated


Instruction: What outcome is expected by ID.BE-02?

Output: The organization’s place in critical infrastructure and its industry sector is identified and communicated


Instruction: What is WR-ID.BE-02?

Output: Incorporated into GV.OC-01


Instruction: Explain WR-ID.BE-02.

Output: Incorporated into GV.OC-01


Instruction: What is ID.BE-03?

Output: Priorities for organizational mission, objectives, and activities are established and communicated


Instruction: Explain the requirement of ID.BE-03.

Output: Priorities for organizational mission, objectives, and activities are established and communicated


Instruction: What outcome is expected by ID.BE-03?

Output: Priorities for organizational mission, objectives, and activities are established and communicated


Instruction: What is WR-ID.BE-03?

Output: Incorporated into GV.OC-01


Instruction: Explain WR-ID.BE-03.

Output: Incorporated into GV.OC-01


Instruction: What is ID.BE-04?

Output: Dependencies and critical functions for delivery of critical services are established


Instruction: Explain the requirement of ID.BE-04.

Output: Dependencies and critical functions for delivery of critical services are established


Instruction: What outcome is expected by ID.BE-04?

Output: Dependencies and critical functions for delivery of critical services are established


Instruction: What is WR-ID.BE-04?

Output: Incorporated into GV.OC-04, GV.OC-05


Instruction: Explain WR-ID.BE-04.

Output: Incorporated into GV.OC-04, GV.OC-05


Instruction: What is ID.BE-05?

Output: Resilience requirements to support delivery of critical services are established for all operating states (e.g. under duress/attack, during recovery, normal operations)


Instruction: Explain the requirement of ID.BE-05.

Output: Resilience requirements to support delivery of critical services are established for all operating states (e.g. under duress/attack, during recovery, normal operations)


Instruction: What outcome is expected by ID.BE-05?

Output: Resilience requirements to support delivery of critical services are established for all operating states (e.g. under duress/attack, during recovery, normal operations)


Instruction: What is WR-ID.BE-05?

Output: Incorporated into GV.OC-04


Instruction: Explain WR-ID.BE-05.

Output: Incorporated into GV.OC-04


Instruction: What is WR-ID.GV?

Output: Incorporated into GV


Instruction: Explain WR-ID.GV.

Output: Incorporated into GV


Instruction: What is ID.GV-01?

Output: Organizational cybersecurity policy is established and communicated


Instruction: Explain the requirement of ID.GV-01.

Output: Organizational cybersecurity policy is established and communicated


Instruction: What outcome is expected by ID.GV-01?

Output: Organizational cybersecurity policy is established and communicated


Instruction: What is WR-ID.GV-01?

Output: Incorporated into GV.PO, GV.PO-01, GV.PO-02


Instruction: Explain WR-ID.GV-01.

Output: Incorporated into GV.PO, GV.PO-01, GV.PO-02


Instruction: What is ID.GV-02?

Output: Cybersecurity roles and responsibilities are coordinated and aligned with internal roles and external partners


Instruction: Explain the requirement of ID.GV-02.

Output: Cybersecurity roles and responsibilities are coordinated and aligned with internal roles and external partners


Instruction: What outcome is expected by ID.GV-02?

Output: Cybersecurity roles and responsibilities are coordinated and aligned with internal roles and external partners


Instruction: What is WR-ID.GV-02?

Output: Incorporated into GV.OC-02, GV.RR, GV.RR-02


Instruction: Explain WR-ID.GV-02.

Output: Incorporated into GV.OC-02, GV.RR, GV.RR-02


Instruction: What is ID.GV-03?

Output: Legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations, are understood and managed


Instruction: Explain the requirement of ID.GV-03.

Output: Legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations, are understood and managed


Instruction: What outcome is expected by ID.GV-03?

Output: Legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations, are understood and managed


Instruction: What is WR-ID.GV-03?

Output: Moved to GV.OC-03


Instruction: Explain WR-ID.GV-03.

Output: Moved to GV.OC-03


Instruction: What is ID.GV-04?

Output: Governance and risk management processes address cybersecurity risks


Instruction: Explain the requirement of ID.GV-04.

Output: Governance and risk management processes address cybersecurity risks


Instruction: What outcome is expected by ID.GV-04?

Output: Governance and risk management processes address cybersecurity risks


Instruction: What is WR-ID.GV-04?

Output: Moved to GV.RM-04


Instruction: Explain WR-ID.GV-04.

Output: Moved to GV.RM-04


Instruction: What is WR-ID.RM?

Output: Incorporated into GV.RM


Instruction: Explain WR-ID.RM.

Output: Incorporated into GV.RM


Instruction: What is ID.RM-01?

Output: Risk management processes are established, managed, and agreed to by organizational stakeholders


Instruction: Explain the requirement of ID.RM-01.

Output: Risk management processes are established, managed, and agreed to by organizational stakeholders


Instruction: What outcome is expected by ID.RM-01?

Output: Risk management processes are established, managed, and agreed to by organizational stakeholders


Instruction: What is WR-ID.RM-01?

Output: Incorporated into GV.RM-01, GV.RM-06, GV.RR-03


Instruction: Explain WR-ID.RM-01.

Output: Incorporated into GV.RM-01, GV.RM-06, GV.RR-03


Instruction: What is ID.RM-02?

Output: Organizational risk tolerance is determined and clearly expressed


Instruction: Explain the requirement of ID.RM-02.

Output: Organizational risk tolerance is determined and clearly expressed


Instruction: What outcome is expected by ID.RM-02?

Output: Organizational risk tolerance is determined and clearly expressed


Instruction: What is WR-ID.RM-02?

Output: Incorporated into GV.RM-02, GV.RM-04


Instruction: Explain WR-ID.RM-02.

Output: Incorporated into GV.RM-02, GV.RM-04


Instruction: What is ID.RM-03?

Output: The organization’s determination of risk tolerance is informed by its role in critical infrastructure and sector specific risk analysis


Instruction: Explain the requirement of ID.RM-03.

Output: The organization’s determination of risk tolerance is informed by its role in critical infrastructure and sector specific risk analysis


Instruction: What outcome is expected by ID.RM-03?

Output: The organization’s determination of risk tolerance is informed by its role in critical infrastructure and sector specific risk analysis


Instruction: What is WR-ID.RM-03?

Output: Moved into GV.RM-02


Instruction: Explain WR-ID.RM-03.

Output: Moved into GV.RM-02


Instruction: What is WR-ID.SC?

Output: Incorporated into GV.SC


Instruction: Explain WR-ID.SC.

Output: Incorporated into GV.SC


Instruction: What is ID.SC-01?

Output: Cyber supply chain risk management processes are identified, established, assessed, managed, and agreed to by organizational stakeholders


Instruction: Explain the requirement of ID.SC-01.

Output: Cyber supply chain risk management processes are identified, established, assessed, managed, and agreed to by organizational stakeholders


Instruction: What outcome is expected by ID.SC-01?

Output: Cyber supply chain risk management processes are identified, established, assessed, managed, and agreed to by organizational stakeholders


Instruction: What is WR-ID.SC-01?

Output: Incorporated into GV.RM-05, GV.SC-01, GV.SC-06, GV.SC-09, GV.SC-10


Instruction: Explain WR-ID.SC-01.

Output: Incorporated into GV.RM-05, GV.SC-01, GV.SC-06, GV.SC-09, GV.SC-10


Instruction: What is ID.SC-02?

Output: Suppliers and third party partners of information systems, components, and services are identified, prioritized, and assessed using a cyber supply chain risk assessment process


Instruction: Explain the requirement of ID.SC-02.

Output: Suppliers and third party partners of information systems, components, and services are identified, prioritized, and assessed using a cyber supply chain risk assessment process


Instruction: What outcome is expected by ID.SC-02?

Output: Suppliers and third party partners of information systems, components, and services are identified, prioritized, and assessed using a cyber supply chain risk assessment process


Instruction: What is WR-ID.SC-02?

Output: Incorporated into GV.OC-02, GV.SC-03, GV.SC-04, GV.SC-07, ID.RA-10


Instruction: Explain WR-ID.SC-02.

Output: Incorporated into GV.OC-02, GV.SC-03, GV.SC-04, GV.SC-07, ID.RA-10


Instruction: What is ID.SC-03?

Output: Contracts with suppliers and third-party partners are used to implement appropriate measures designed to meet the objectives of an organization’s cybersecurity program and Cyber Supply Chain Risk Management Plan.


Instruction: Explain the requirement of ID.SC-03.

Output: Contracts with suppliers and third-party partners are used to implement appropriate measures designed to meet the objectives of an organization’s cybersecurity program and Cyber Supply Chain Risk Management Plan.


Instruction: What outcome is expected by ID.SC-03?

Output: Contracts with suppliers and third-party partners are used to implement appropriate measures designed to meet the objectives of an organization’s cybersecurity program and Cyber Supply Chain Risk Management Plan.


Instruction: What is WR-ID.SC-03?

Output: Moved to GV.SC-05


Instruction: Explain WR-ID.SC-03.

Output: Moved to GV.SC-05


Instruction: What is ID.SC-04?

Output: Suppliers and third-party partners are routinely assessed using audits, test results, or other forms of evaluations to confirm they are meeting their contractual obligations.


Instruction: Explain the requirement of ID.SC-04.

Output: Suppliers and third-party partners are routinely assessed using audits, test results, or other forms of evaluations to confirm they are meeting their contractual obligations.


Instruction: What outcome is expected by ID.SC-04?

Output: Suppliers and third-party partners are routinely assessed using audits, test results, or other forms of evaluations to confirm they are meeting their contractual obligations.


Instruction: What is WR-ID.SC-04?

Output: Incorporated into GV.SC-07, ID.RA-10


Instruction: Explain WR-ID.SC-04.

Output: Incorporated into GV.SC-07, ID.RA-10


Instruction: What is ID.SC-05?

Output: Response and recovery planning and testing are conducted with suppliers and third-party providers


Instruction: Explain the requirement of ID.SC-05.

Output: Response and recovery planning and testing are conducted with suppliers and third-party providers


Instruction: What outcome is expected by ID.SC-05?

Output: Response and recovery planning and testing are conducted with suppliers and third-party providers


Instruction: What is WR-ID.SC-05?

Output: Incorporated into GV.SC-08, ID.IM-02


Instruction: Explain WR-ID.SC-05.

Output: Incorporated into GV.SC-08, ID.IM-02


Instruction: What is WR-PR.AC?

Output: Moved to PR.AA


Instruction: Explain WR-PR.AC.

Output: Moved to PR.AA


Instruction: What is PR.AC-01?

Output: Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users and processes


Instruction: Explain the requirement of PR.AC-01.

Output: Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users and processes


Instruction: What outcome is expected by PR.AC-01?

Output: Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users and processes


Instruction: What is WR-PR.AC-01?

Output: Incorporated into PR.AA-01, PR.AA-05


Instruction: Explain WR-PR.AC-01.

Output: Incorporated into PR.AA-01, PR.AA-05


Instruction: What is PR.AC-02?

Output: Physical access to assets is managed and protected


Instruction: Explain the requirement of PR.AC-02.

Output: Physical access to assets is managed and protected


Instruction: What outcome is expected by PR.AC-02?

Output: Physical access to assets is managed and protected


Instruction: What is WR-PR.AC-02?

Output: Moved to PR.AA-06


Instruction: Explain WR-PR.AC-02.

Output: Moved to PR.AA-06


Instruction: What is PR.AC-03?

Output: Remote access is managed


Instruction: Explain the requirement of PR.AC-03.

Output: Remote access is managed


Instruction: What outcome is expected by PR.AC-03?

Output: Remote access is managed


Instruction: What is WR-PR.AC-03?

Output: Incorporated into PR.AA-03, PR.AA-05, PR.IR-01


Instruction: Explain WR-PR.AC-03.

Output: Incorporated into PR.AA-03, PR.AA-05, PR.IR-01


Instruction: What is PR.AC-04?

Output: Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties


Instruction: Explain the requirement of PR.AC-04.

Output: Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties


Instruction: What outcome is expected by PR.AC-04?

Output: Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties


Instruction: What is WR-PR.AC-04?

Output: Moved to PR.AA-05


Instruction: Explain WR-PR.AC-04.

Output: Moved to PR.AA-05


Instruction: What is PR.AC-05?

Output: Network integrity is protected (e.g., network segregation, network segmentation)


Instruction: Explain the requirement of PR.AC-05.

Output: Network integrity is protected (e.g., network segregation, network segmentation)


Instruction: What outcome is expected by PR.AC-05?

Output: Network integrity is protected (e.g., network segregation, network segmentation)


Instruction: What is WR-PR.AC-05?

Output: Incorporated into PR.IR-01


Instruction: Explain WR-PR.AC-05.

Output: Incorporated into PR.IR-01


Instruction: What is PR.AC-06?

Output: Identities are proofed and bound to credentials and asserted in interactions


Instruction: Explain the requirement of PR.AC-06.

Output: Identities are proofed and bound to credentials and asserted in interactions


Instruction: What outcome is expected by PR.AC-06?

Output: Identities are proofed and bound to credentials and asserted in interactions


Instruction: What is WR-PR.AC-06?

Output: Moved to PR.AA-02


Instruction: Explain WR-PR.AC-06.

Output: Moved to PR.AA-02


Instruction: What is PR.AC-07?

Output: Users, devices, and other assets are authenticated (e.g., single-factor, multi-factor) commensurate with the risk of the transaction (e.g., individuals’ security and privacy risks and other organizational risks)


Instruction: Explain the requirement of PR.AC-07.

Output: Users, devices, and other assets are authenticated (e.g., single-factor, multi-factor) commensurate with the risk of the transaction (e.g., individuals’ security and privacy risks and other organizational risks)


Instruction: What outcome is expected by PR.AC-07?

Output: Users, devices, and other assets are authenticated (e.g., single-factor, multi-factor) commensurate with the risk of the transaction (e.g., individuals’ security and privacy risks and other organizational risks)


Instruction: What is WR-PR.AC-07?

Output: Moved to PR.AA-03


Instruction: Explain WR-PR.AC-07.

Output: Moved to PR.AA-03


Instruction: What is PR.AT-03?

Output: Third-party stakeholders (e.g., suppliers, customers, partners) understand their roles and responsibilities


Instruction: Explain the requirement of PR.AT-03.

Output: Third-party stakeholders (e.g., suppliers, customers, partners) understand their roles and responsibilities


Instruction: What outcome is expected by PR.AT-03?

Output: Third-party stakeholders (e.g., suppliers, customers, partners) understand their roles and responsibilities


Instruction: What is WR-PR.AT-03?

Output: Incorporated into PR.AT-01, PR.AT-02


Instruction: Explain WR-PR.AT-03.

Output: Incorporated into PR.AT-01, PR.AT-02


Instruction: What is PR.AT-04?

Output: Senior executives understand their roles and responsibilities


Instruction: Explain the requirement of PR.AT-04.

Output: Senior executives understand their roles and responsibilities


Instruction: What outcome is expected by PR.AT-04?

Output: Senior executives understand their roles and responsibilities


Instruction: What is WR-PR.AT-04?

Output: Incorporated into PR.AT-02


Instruction: Explain WR-PR.AT-04.

Output: Incorporated into PR.AT-02


Instruction: What is PR.AT-05?

Output: Physical and cybersecurity personnel understand their roles and responsibilities


Instruction: Explain the requirement of PR.AT-05.

Output: Physical and cybersecurity personnel understand their roles and responsibilities


Instruction: What outcome is expected by PR.AT-05?

Output: Physical and cybersecurity personnel understand their roles and responsibilities


Instruction: What is WR-PR.AT-05?

Output: Incorporated into PR.AT-02


Instruction: Explain WR-PR.AT-05.

Output: Incorporated into PR.AT-02


Instruction: What is PR.DS-03?

Output: Assets are formally managed throughout removal, transfers, and disposition


Instruction: Explain the requirement of PR.DS-03.

Output: Assets are formally managed throughout removal, transfers, and disposition


Instruction: What outcome is expected by PR.DS-03?

Output: Assets are formally managed throughout removal, transfers, and disposition


Instruction: What is WR-PR.DS-03?

Output: Incorporated into ID.AM-08, PR.PS-03


Instruction: Explain WR-PR.DS-03.

Output: Incorporated into ID.AM-08, PR.PS-03


Instruction: What is PR.DS-04?

Output: Adequate capacity to ensure availability is maintained


Instruction: Explain the requirement of PR.DS-04.

Output: Adequate capacity to ensure availability is maintained


Instruction: What outcome is expected by PR.DS-04?

Output: Adequate capacity to ensure availability is maintained


Instruction: What is WR-PR.DS-04?

Output: Moved to PR.IR-04


Instruction: Explain WR-PR.DS-04.

Output: Moved to PR.IR-04


Instruction: What is PR.DS-05?

Output: Protections against data leaks are implemented


Instruction: Explain the requirement of PR.DS-05.

Output: Protections against data leaks are implemented


Instruction: What outcome is expected by PR.DS-05?

Output: Protections against data leaks are implemented


Instruction: What is WR-PR.DS-05?

Output: Incorporated into PR.DS-01, PR.DS-02, PR.DS-10


Instruction: Explain WR-PR.DS-05.

Output: Incorporated into PR.DS-01, PR.DS-02, PR.DS-10


Instruction: What is PR.DS-06?

Output: Integrity checking mechanisms are used to verify software, firmware, and information integrity


Instruction: Explain the requirement of PR.DS-06.

Output: Integrity checking mechanisms are used to verify software, firmware, and information integrity


Instruction: What outcome is expected by PR.DS-06?

Output: Integrity checking mechanisms are used to verify software, firmware, and information integrity


Instruction: What is WR-PR.DS-06?

Output: Incorporated into PR.DS-01, DE.CM-09


Instruction: Explain WR-PR.DS-06.

Output: Incorporated into PR.DS-01, DE.CM-09


Instruction: What is PR.DS-07?

Output: The development and testing environment(s) are separate from the production environment


Instruction: Explain the requirement of PR.DS-07.

Output: The development and testing environment(s) are separate from the production environment


Instruction: What outcome is expected by PR.DS-07?

Output: The development and testing environment(s) are separate from the production environment


Instruction: What is WR-PR.DS-07?

Output: Incorporated into PR.IR-01


Instruction: Explain WR-PR.DS-07.

Output: Incorporated into PR.IR-01


Instruction: What is PR.DS-08?

Output: Integrity checking mechanisms are used to verify hardware integrity


Instruction: Explain the requirement of PR.DS-08.

Output: Integrity checking mechanisms are used to verify hardware integrity


Instruction: What outcome is expected by PR.DS-08?

Output: Integrity checking mechanisms are used to verify hardware integrity


Instruction: What is WR-PR.DS-08?

Output: Incorporated into ID.RA-09, DE.CM-09


Instruction: Explain WR-PR.DS-08.

Output: Incorporated into ID.RA-09, DE.CM-09


Instruction: What is WR-PR.IP?

Output: Incorporated into other Categories and Functions


Instruction: Explain WR-PR.IP.

Output: Incorporated into other Categories and Functions


Instruction: What is PR.IP-01?

Output: A baseline configuration of information technology/industrial control systems is created and maintained incorporating security principles (e.g. concept of least functionality)


Instruction: Explain the requirement of PR.IP-01.

Output: A baseline configuration of information technology/industrial control systems is created and maintained incorporating security principles (e.g. concept of least functionality)


Instruction: What outcome is expected by PR.IP-01?

Output: A baseline configuration of information technology/industrial control systems is created and maintained incorporating security principles (e.g. concept of least functionality)


Instruction: What is WR-PR.IP-01?

Output: Incorporated into PR.PS-01


Instruction: Explain WR-PR.IP-01.

Output: Incorporated into PR.PS-01


Instruction: What is PR.IP-02?

Output: A System Development Life Cycle to manage systems is implemented


Instruction: Explain the requirement of PR.IP-02.

Output: A System Development Life Cycle to manage systems is implemented


Instruction: What outcome is expected by PR.IP-02?

Output: A System Development Life Cycle to manage systems is implemented


Instruction: What is WR-PR.IP-02?

Output: Incorporated into ID.AM-08, PR.PS-06


Instruction: Explain WR-PR.IP-02.

Output: Incorporated into ID.AM-08, PR.PS-06


Instruction: What is PR.IP-03?

Output: Configuration change control processes are in place


Instruction: Explain the requirement of PR.IP-03.

Output: Configuration change control processes are in place


Instruction: What outcome is expected by PR.IP-03?

Output: Configuration change control processes are in place


Instruction: What is WR-PR.IP-03?

Output: Incorporated into PR.PS-01, ID.RA-07


Instruction: Explain WR-PR.IP-03.

Output: Incorporated into PR.PS-01, ID.RA-07


Instruction: What is PR.IP-04?

Output: Backups of information are conducted, maintained, and tested


Instruction: Explain the requirement of PR.IP-04.

Output: Backups of information are conducted, maintained, and tested


Instruction: What outcome is expected by PR.IP-04?

Output: Backups of information are conducted, maintained, and tested


Instruction: What is WR-PR.IP-04?

Output: Moved to PR.DS-11


Instruction: Explain WR-PR.IP-04.

Output: Moved to PR.DS-11


Instruction: What is PR.IP-05?

Output: Policy and regulations regarding the physical operating environment for organizational assets are met


Instruction: Explain the requirement of PR.IP-05.

Output: Policy and regulations regarding the physical operating environment for organizational assets are met


Instruction: What outcome is expected by PR.IP-05?

Output: Policy and regulations regarding the physical operating environment for organizational assets are met


Instruction: What is WR-PR.IP-05?

Output: Moved to PR.IR-02


Instruction: Explain WR-PR.IP-05.

Output: Moved to PR.IR-02


Instruction: What is PR.IP-06?

Output: Data is destroyed according to policy


Instruction: Explain the requirement of PR.IP-06.

Output: Data is destroyed according to policy


Instruction: What outcome is expected by PR.IP-06?

Output: Data is destroyed according to policy


Instruction: What is WR-PR.IP-06?

Output: Incorporated into ID.AM-08


Instruction: Explain WR-PR.IP-06.

Output: Incorporated into ID.AM-08


Instruction: What is PR.IP-07?

Output: Protection processes are improved


Instruction: Explain the requirement of PR.IP-07.

Output: Protection processes are improved


Instruction: What outcome is expected by PR.IP-07?

Output: Protection processes are improved


Instruction: What is WR-PR.IP-07?

Output: Incorporated into ID.IM, ID.IM-03


Instruction: Explain WR-PR.IP-07.

Output: Incorporated into ID.IM, ID.IM-03


Instruction: What is PR.IP-08?

Output: Effectiveness of protection technologies is shared


Instruction: Explain the requirement of PR.IP-08.

Output: Effectiveness of protection technologies is shared


Instruction: What outcome is expected by PR.IP-08?

Output: Effectiveness of protection technologies is shared


Instruction: What is WR-PR.IP-08?

Output: Moved to ID.IM-03


Instruction: Explain WR-PR.IP-08.

Output: Moved to ID.IM-03


Instruction: What is PR.IP-09?

Output: Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed


Instruction: Explain the requirement of PR.IP-09.

Output: Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed


Instruction: What outcome is expected by PR.IP-09?

Output: Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed


Instruction: What is WR-PR.IP-09?

Output: Moved to ID.IM-04


Instruction: Explain WR-PR.IP-09.

Output: Moved to ID.IM-04


Instruction: What is PR.IP-10?

Output: Response and recovery plans are tested


Instruction: Explain the requirement of PR.IP-10.

Output: Response and recovery plans are tested


Instruction: What outcome is expected by PR.IP-10?

Output: Response and recovery plans are tested


Instruction: What is WR-PR.IP-10?

Output: Incorporated into ID.IM-02, ID.IM-04


Instruction: Explain WR-PR.IP-10.

Output: Incorporated into ID.IM-02, ID.IM-04


Instruction: What is PR.IP-11?

Output: Cybersecurity is included in human resources practices (e.g., deprovisioning, personnel screening)


Instruction: Explain the requirement of PR.IP-11.

Output: Cybersecurity is included in human resources practices (e.g., deprovisioning, personnel screening)


Instruction: What outcome is expected by PR.IP-11?

Output: Cybersecurity is included in human resources practices (e.g., deprovisioning, personnel screening)


Instruction: What is WR-PR.IP-11?

Output: Moved to GV.RR-04


Instruction: Explain WR-PR.IP-11.

Output: Moved to GV.RR-04


Instruction: What is PR.IP-12?

Output: A vulnerability management plan is developed and implemented


Instruction: Explain the requirement of PR.IP-12.

Output: A vulnerability management plan is developed and implemented


Instruction: What outcome is expected by PR.IP-12?

Output: A vulnerability management plan is developed and implemented


Instruction: What is WR-PR.IP-12?

Output: Incorporated into ID.RA-01, PR.PS-02


Instruction: Explain WR-PR.IP-12.

Output: Incorporated into ID.RA-01, PR.PS-02


Instruction: What is WR-PR.MA?

Output: Incorporated into ID.AM-08


Instruction: Explain WR-PR.MA.

Output: Incorporated into ID.AM-08


Instruction: What is PR.MA-01?

Output: Maintenance and repair of organizational assets are performed and logged, with approved and controlled tools


Instruction: Explain the requirement of PR.MA-01.

Output: Maintenance and repair of organizational assets are performed and logged, with approved and controlled tools


Instruction: What outcome is expected by PR.MA-01?

Output: Maintenance and repair of organizational assets are performed and logged, with approved and controlled tools


Instruction: What is WR-PR.MA-01?

Output: Incorporated into ID.AM-08, PR.PS-03


Instruction: Explain WR-PR.MA-01.

Output: Incorporated into ID.AM-08, PR.PS-03


Instruction: What is PR.MA-02?

Output: Remote maintenance of organizational assets is approved, logged, and performed in a manner that prevents unauthorized access


Instruction: Explain the requirement of PR.MA-02.

Output: Remote maintenance of organizational assets is approved, logged, and performed in a manner that prevents unauthorized access


Instruction: What outcome is expected by PR.MA-02?

Output: Remote maintenance of organizational assets is approved, logged, and performed in a manner that prevents unauthorized access


Instruction: What is WR-PR.MA-02?

Output: Incorporated into ID.AM-08, PR.PS-02


Instruction: Explain WR-PR.MA-02.

Output: Incorporated into ID.AM-08, PR.PS-02


Instruction: What is WR-PR.PT?

Output: Incorporated into other Protect Categories


Instruction: Explain WR-PR.PT.

Output: Incorporated into other Protect Categories


Instruction: What is PR.PT-01?

Output: Audit/log records are determined, documented, implemented, and reviewed in accordance with policy


Instruction: Explain the requirement of PR.PT-01.

Output: Audit/log records are determined, documented, implemented, and reviewed in accordance with policy


Instruction: What outcome is expected by PR.PT-01?

Output: Audit/log records are determined, documented, implemented, and reviewed in accordance with policy


Instruction: What is WR-PR.PT-01?

Output: Incorporated into PR.PS-04


Instruction: Explain WR-PR.PT-01.

Output: Incorporated into PR.PS-04


Instruction: What is PR.PT-02?

Output: Removable media is protected and its use restricted according to policy


Instruction: Explain the requirement of PR.PT-02.

Output: Removable media is protected and its use restricted according to policy


Instruction: What outcome is expected by PR.PT-02?

Output: Removable media is protected and its use restricted according to policy


Instruction: What is WR-PR.PT-02?

Output: Incorporated into PR.DS-01, PR.PS-01


Instruction: Explain WR-PR.PT-02.

Output: Incorporated into PR.DS-01, PR.PS-01


Instruction: What is PR.PT-03?

Output: The principle of least functionality is incorporated by configuring systems to provide only essential capabilities


Instruction: Explain the requirement of PR.PT-03.

Output: The principle of least functionality is incorporated by configuring systems to provide only essential capabilities


Instruction: What outcome is expected by PR.PT-03?

Output: The principle of least functionality is incorporated by configuring systems to provide only essential capabilities


Instruction: What is WR-PR.PT-03?

Output: Incorporated into PR.PS-01


Instruction: Explain WR-PR.PT-03.

Output: Incorporated into PR.PS-01


Instruction: What is PR.PT-04?

Output: Communications and control networks are protected


Instruction: Explain the requirement of PR.PT-04.

Output: Communications and control networks are protected


Instruction: What outcome is expected by PR.PT-04?

Output: Communications and control networks are protected


Instruction: What is WR-PR.PT-04?

Output: Incorporated into PR.AA-06, PR.IR-01


Instruction: Explain WR-PR.PT-04.

Output: Incorporated into PR.AA-06, PR.IR-01


Instruction: What is PR.PT-05?

Output: Mechanisms (e.g., failsafe, load balancing, hot swap) are implemented to achieve resilience requirements in normal and adverse situations


Instruction: Explain the requirement of PR.PT-05.

Output: Mechanisms (e.g., failsafe, load balancing, hot swap) are implemented to achieve resilience requirements in normal and adverse situations


Instruction: What outcome is expected by PR.PT-05?

Output: Mechanisms (e.g., failsafe, load balancing, hot swap) are implemented to achieve resilience requirements in normal and adverse situations


Instruction: What is WR-PR.PT-05?

Output: Moved to PR.IR-03


Instruction: Explain WR-PR.PT-05.

Output: Moved to PR.IR-03


Instruction: What is DE.CM-04?

Output: Malicious code is detected


Instruction: Explain the requirement of DE.CM-04.

Output: Malicious code is detected


Instruction: What outcome is expected by DE.CM-04?

Output: Malicious code is detected


Instruction: What is WR-DE.CM-04?

Output: Incorporated into DE.CM-01, DE.CM-09


Instruction: Explain WR-DE.CM-04.

Output: Incorporated into DE.CM-01, DE.CM-09


Instruction: What is DE.CM-05?

Output: Unauthorized mobile code is detected


Instruction: Explain the requirement of DE.CM-05.

Output: Unauthorized mobile code is detected


Instruction: What outcome is expected by DE.CM-05?

Output: Unauthorized mobile code is detected


Instruction: What is WR-DE.CM-05?

Output: Incorporated into DE.CM-01, DE.CM-09


Instruction: Explain WR-DE.CM-05.

Output: Incorporated into DE.CM-01, DE.CM-09


Instruction: What is DE.CM-07?

Output: Monitoring for unauthorized personnel, connections, devices, and software is performed


Instruction: Explain the requirement of DE.CM-07.

Output: Monitoring for unauthorized personnel, connections, devices, and software is performed


Instruction: What outcome is expected by DE.CM-07?

Output: Monitoring for unauthorized personnel, connections, devices, and software is performed


Instruction: What is WR-DE.CM-07?

Output: Incorporated into DE.CM-01, DE.CM-03, DE.CM-06, DE.CM-09


Instruction: Explain WR-DE.CM-07.

Output: Incorporated into DE.CM-01, DE.CM-03, DE.CM-06, DE.CM-09


Instruction: What is DE.CM-08?

Output: Vulnerability scans are performed


Instruction: Explain the requirement of DE.CM-08.

Output: Vulnerability scans are performed


Instruction: What outcome is expected by DE.CM-08?

Output: Vulnerability scans are performed


Instruction: What is WR-DE.CM-08?

Output: Incorporated into ID.RA-01


Instruction: Explain WR-DE.CM-08.

Output: Incorporated into ID.RA-01


Instruction: What is DE.AE-01?

Output: A baseline of network operations and expected data flows for users and systems is established and managed


Instruction: Explain the requirement of DE.AE-01.

Output: A baseline of network operations and expected data flows for users and systems is established and managed


Instruction: What outcome is expected by DE.AE-01?

Output: A baseline of network operations and expected data flows for users and systems is established and managed


Instruction: What is WR-DE.AE-01?

Output: Incorporated into ID.AM-03


Instruction: Explain WR-DE.AE-01.

Output: Incorporated into ID.AM-03


Instruction: What is DE.AE-05?

Output: Incident alert thresholds are established


Instruction: Explain the requirement of DE.AE-05.

Output: Incident alert thresholds are established


Instruction: What outcome is expected by DE.AE-05?

Output: Incident alert thresholds are established


Instruction: What is WR-DE.AE-05?

Output: Moved to DE.AE-08


Instruction: Explain WR-DE.AE-05.

Output: Moved to DE.AE-08


Instruction: What is WR-DE.DP?

Output: Incorporated into other Categories and Functions


Instruction: Explain WR-DE.DP.

Output: Incorporated into other Categories and Functions


Instruction: What is DE.DP-01?

Output: Roles and responsibilities for detection are well defined to ensure accountability


Instruction: Explain the requirement of DE.DP-01.

Output: Roles and responsibilities for detection are well defined to ensure accountability


Instruction: What outcome is expected by DE.DP-01?

Output: Roles and responsibilities for detection are well defined to ensure accountability


Instruction: What is WR-DE.DP-01?

Output: Incorporated into GV.RR-02


Instruction: Explain WR-DE.DP-01.

Output: Incorporated into GV.RR-02


Instruction: What is DE.DP-02?

Output: Detection activities comply with all applicable requirements


Instruction: Explain the requirement of DE.DP-02.

Output: Detection activities comply with all applicable requirements


Instruction: What outcome is expected by DE.DP-02?

Output: Detection activities comply with all applicable requirements


Instruction: What is WR-DE.DP-02?

Output: Incorporated into DE.AE


Instruction: Explain WR-DE.DP-02.

Output: Incorporated into DE.AE


Instruction: What is DE.DP-03?

Output: Detection processes are tested


Instruction: Explain the requirement of DE.DP-03.

Output: Detection processes are tested


Instruction: What outcome is expected by DE.DP-03?

Output: Detection processes are tested


Instruction: What is WR-DE.DP-03?

Output: Incorporated into ID.IM-02


Instruction: Explain WR-DE.DP-03.

Output: Incorporated into ID.IM-02


Instruction: What is DE.DP-04?

Output: Event detection information is communicated


Instruction: Explain the requirement of DE.DP-04.

Output: Event detection information is communicated


Instruction: What outcome is expected by DE.DP-04?

Output: Event detection information is communicated


Instruction: What is WR-DE.DP-04?

Output: Incorporated into DE.AE-06


Instruction: Explain WR-DE.DP-04.

Output: Incorporated into DE.AE-06


Instruction: What is DE.DP-05?

Output: Detection processes are continuously improved


Instruction: Explain the requirement of DE.DP-05.

Output: Detection processes are continuously improved


Instruction: What outcome is expected by DE.DP-05?

Output: Detection processes are continuously improved


Instruction: What is WR-DE.DP-05?

Output: Incorporated into ID.IM, ID.IM-03


Instruction: Explain WR-DE.DP-05.

Output: Incorporated into ID.IM, ID.IM-03


Instruction: What is WR-RS.RP?

Output: Incorporated into RS.MA


Instruction: Explain WR-RS.RP.

Output: Incorporated into RS.MA


Instruction: What is RS.RP-01?

Output: Response plan is executed during or after an incident


Instruction: Explain the requirement of RS.RP-01.

Output: Response plan is executed during or after an incident


Instruction: What outcome is expected by RS.RP-01?

Output: Response plan is executed during or after an incident


Instruction: What is WR-RS.RP-01?

Output: Incorporated into RS.MA-01


Instruction: Explain WR-RS.RP-01.

Output: Incorporated into RS.MA-01


Instruction: What is RS.AN-01?

Output: Notifications from detection systems are investigated


Instruction: Explain the requirement of RS.AN-01.

Output: Notifications from detection systems are investigated


Instruction: What outcome is expected by RS.AN-01?

Output: Notifications from detection systems are investigated


Instruction: What is WR-RS.AN-01?

Output: Incorporated into RS.MA-02


Instruction: Explain WR-RS.AN-01.

Output: Incorporated into RS.MA-02


Instruction: What is RS.AN-02?

Output: The impact of the incident is understood


Instruction: Explain the requirement of RS.AN-02.

Output: The impact of the incident is understood


Instruction: What outcome is expected by RS.AN-02?

Output: The impact of the incident is understood


Instruction: What is WR-RS.AN-02?

Output: Incorporated into RS.MA-02, RS.MA-03, RS.MA-04


Instruction: Explain WR-RS.AN-02.

Output: Incorporated into RS.MA-02, RS.MA-03, RS.MA-04


Instruction: What is RS.AN-04?

Output: Incidents are categorized consistent with response plans


Instruction: Explain the requirement of RS.AN-04.

Output: Incidents are categorized consistent with response plans


Instruction: What outcome is expected by RS.AN-04?

Output: Incidents are categorized consistent with response plans


Instruction: What is WR-RS.AN-04?

Output: Moved to RS.MA-03


Instruction: Explain WR-RS.AN-04.

Output: Moved to RS.MA-03


Instruction: What is RS.AN-05?

Output: Processes are established to receive, analyze and respond to vulnerabilities disclosed to the organization from internal and external sources (e.g. internal testing, security bulletins, or security researchers)


Instruction: Explain the requirement of RS.AN-05.

Output: Processes are established to receive, analyze and respond to vulnerabilities disclosed to the organization from internal and external sources (e.g. internal testing, security bulletins, or security researchers)


Instruction: What outcome is expected by RS.AN-05?

Output: Processes are established to receive, analyze and respond to vulnerabilities disclosed to the organization from internal and external sources (e.g. internal testing, security bulletins, or security researchers)


Instruction: What is WR-RS.AN-05?

Output: Moved to ID.RA-08


Instruction: Explain WR-RS.AN-05.

Output: Moved to ID.RA-08


Instruction: What is RS.CO-01?

Output: Personnel know their roles and order of operations when a response is needed


Instruction: Explain the requirement of RS.CO-01.

Output: Personnel know their roles and order of operations when a response is needed


Instruction: What outcome is expected by RS.CO-01?

Output: Personnel know their roles and order of operations when a response is needed


Instruction: What is WR-RS.CO-01?

Output: Incorporated into PR.AT-01


Instruction: Explain WR-RS.CO-01.

Output: Incorporated into PR.AT-01


Instruction: What is RS.CO-04?

Output: Coordination with stakeholders occurs consistent with response plans


Instruction: Explain the requirement of RS.CO-04.

Output: Coordination with stakeholders occurs consistent with response plans


Instruction: What outcome is expected by RS.CO-04?

Output: Coordination with stakeholders occurs consistent with response plans


Instruction: What is WR-RS.CO-04?

Output: Incorporated into RS.MA-01, RS.MA-04


Instruction: Explain WR-RS.CO-04.

Output: Incorporated into RS.MA-01, RS.MA-04


Instruction: What is RS.CO-05?

Output: Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness


Instruction: Explain the requirement of RS.CO-05.

Output: Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness


Instruction: What outcome is expected by RS.CO-05?

Output: Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness


Instruction: What is WR-RS.CO-05?

Output: Incorporated into RS.CO-03


Instruction: Explain WR-RS.CO-05.

Output: Incorporated into RS.CO-03


Instruction: What is RS.MI-03?

Output: Newly identified vulnerabilities are mitigated or documented as accepted risks


Instruction: Explain the requirement of RS.MI-03.

Output: Newly identified vulnerabilities are mitigated or documented as accepted risks


Instruction: What outcome is expected by RS.MI-03?

Output: Newly identified vulnerabilities are mitigated or documented as accepted risks


Instruction: What is WR-RS.MI-03?

Output: Incorporated into ID.RA-06


Instruction: Explain WR-RS.MI-03.

Output: Incorporated into ID.RA-06


Instruction: What is WR-RS.IM?

Output: Incorporated into ID.IM


Instruction: Explain WR-RS.IM.

Output: Incorporated into ID.IM


Instruction: What is RS.IM-01?

Output: Response plans incorporate lessons learned


Instruction: Explain the requirement of RS.IM-01.

Output: Response plans incorporate lessons learned


Instruction: What outcome is expected by RS.IM-01?

Output: Response plans incorporate lessons learned


Instruction: What is WR-RS.IM-01?

Output: Incorporated into ID.IM-03, ID.IM-04


Instruction: Explain WR-RS.IM-01.

Output: Incorporated into ID.IM-03, ID.IM-04


Instruction: What is RS.IM-02?

Output: Response strategies are updated


Instruction: Explain the requirement of RS.IM-02.

Output: Response strategies are updated


Instruction: What outcome is expected by RS.IM-02?

Output: Response strategies are updated


Instruction: What is WR-RS.IM-02?

Output: Incorporated into ID.IM-03


Instruction: Explain WR-RS.IM-02.

Output: Incorporated into ID.IM-03


Instruction: What is RC.CO-01?

Output: Public relations are managed


Instruction: Explain the requirement of RC.CO-01.

Output: Public relations are managed


Instruction: What outcome is expected by RC.CO-01?

Output: Public relations are managed


Instruction: What is WR-RC.CO-01?

Output: Incorporated into RC.CO-04


Instruction: Explain WR-RC.CO-01.

Output: Incorporated into RC.CO-04


Instruction: What is RC.CO-02?

Output: Reputation is repaired after an incident


Instruction: Explain the requirement of RC.CO-02.

Output: Reputation is repaired after an incident


Instruction: What outcome is expected by RC.CO-02?

Output: Reputation is repaired after an incident


Instruction: What is WR-RC.CO-02?

Output: Incorporated into RC.CO-04


Instruction: Explain WR-RC.CO-02.

Output: Incorporated into RC.CO-04


Instruction: What is WR-RC.IM?

Output: Incorporated into ID.IM


Instruction: Explain WR-RC.IM.

Output: Incorporated into ID.IM


Instruction: What is RC.IM-01?

Output: Recovery plans incorporate lessons learned


Instruction: Explain the requirement of RC.IM-01.

Output: Recovery plans incorporate lessons learned


Instruction: What outcome is expected by RC.IM-01?

Output: Recovery plans incorporate lessons learned


Instruction: What is WR-RC.IM-01?

Output: Incorporated into ID.IM-03, ID.IM-04


Instruction: Explain WR-RC.IM-01.

Output: Incorporated into ID.IM-03, ID.IM-04


Instruction: What is RC.IM-02?

Output: Recovery strategies are updated


Instruction: Explain the requirement of RC.IM-02.

Output: Recovery strategies are updated


Instruction: What outcome is expected by RC.IM-02?

Output: Recovery strategies are updated


Instruction: What is WR-RC.IM-02?

Output: Incorporated into ID.IM-03


Instruction: Explain WR-RC.IM-02.

Output: Incorporated into ID.IM-03