[User] Explain ID.RA-10.176.

[Assistant] Conduct supplier risk assessments against business and applicable cybersecurity requirements, including the supply chain


[User] What is ID.IM? (Improvement)

[Assistant] Improvements to organizational cybersecurity risk management processes, procedures and activities are identified across all CSF Functions


[User] Summarize the scope of ID.IM.

[Assistant] Improvements to organizational cybersecurity risk management processes, procedures and activities are identified across all CSF Functions


[User] What does ID.IM cover?

[Assistant] Improvements to organizational cybersecurity risk management processes, procedures and activities are identified across all CSF Functions


[User] What is ID.IM-01?

[Assistant] Improvements are identified from evaluations


[User] Explain the requirement of ID.IM-01.

[Assistant] Improvements are identified from evaluations


[User] What outcome is expected by ID.IM-01?

[Assistant] Improvements are identified from evaluations


[User] What is first? (1st)

[Assistant] 1st Party Risk


[User] Explain first.

[Assistant] 1st Party Risk


[User] What is ID.IM-01.177? (Ex1)

[Assistant] Perform self-assessments of critical services that take current threats and TTPs into consideration


[User] Explain ID.IM-01.177.

[Assistant] Perform self-assessments of critical services that take current threats and TTPs into consideration


[User] What is ID.IM-01.178? (Ex2)

[Assistant] Invest in third-party assessments or independent audits of the effectiveness of the organization's cybersecurity program to identify areas that need improvement


[User] Explain ID.IM-01.178.

[Assistant] Invest in third-party assessments or independent audits of the effectiveness of the organization's cybersecurity program to identify areas that need improvement


[User] What is ID.IM-01.179? (Ex3)

[Assistant] Constantly evaluate compliance with selected cybersecurity requirements through automated means


[User] Explain ID.IM-01.179.

[Assistant] Constantly evaluate compliance with selected cybersecurity requirements through automated means


[User] What is ID.IM-02?

[Assistant] Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties


[User] Explain the requirement of ID.IM-02.

[Assistant] Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties


[User] What outcome is expected by ID.IM-02?

[Assistant] Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties


[User] What is first? (1st)

[Assistant] 1st Party Risk


[User] Explain first.

[Assistant] 1st Party Risk


[User] What is third? (3rd)

[Assistant] 3rd Party Risk


[User] Explain third.

[Assistant] 3rd Party Risk


[User] What is ID.IM-02.180? (Ex1)

[Assistant] Identify improvements for future incident response activities based on findings from incident response assessments (e.g., tabletop exercises and simulations, tests, internal reviews, independent audits)


[User] Explain ID.IM-02.180.

[Assistant] Identify improvements for future incident response activities based on findings from incident response assessments (e.g., tabletop exercises and simulations, tests, internal reviews, independent audits)


[User] What is ID.IM-02.181? (Ex2)

[Assistant] Identify improvements for future business continuity, disaster recovery, and incident response activities based on exercises performed in coordination with critical service providers and product suppliers


[User] Explain ID.IM-02.181.

[Assistant] Identify improvements for future business continuity, disaster recovery, and incident response activities based on exercises performed in coordination with critical service providers and product suppliers


[User] What is ID.IM-02.182? (Ex3)

[Assistant] Involve internal stakeholders (e.g., senior executives, legal department, HR) in security tests and exercises as appropriate


[User] Explain ID.IM-02.182.

[Assistant] Involve internal stakeholders (e.g., senior executives, legal department, HR) in security tests and exercises as appropriate


[User] What is ID.IM-02.183? (Ex4)

[Assistant] Perform penetration testing to identify opportunities to improve the security posture of selected high-risk systems as approved by leadership


[User] Explain ID.IM-02.183.

[Assistant] Perform penetration testing to identify opportunities to improve the security posture of selected high-risk systems as approved by leadership


[User] What is ID.IM-02.184? (Ex5)

[Assistant] Exercise contingency plans for responding to and recovering from the discovery that products or services did not originate with the contracted supplier or partner or were altered before receipt


[User] Explain ID.IM-02.184.

[Assistant] Exercise contingency plans for responding to and recovering from the discovery that products or services did not originate with the contracted supplier or partner or were altered before receipt


[User] What is ID.IM-02.185? (Ex6)

[Assistant] Collect and analyze performance metrics using security tools and services to inform improvements to the cybersecurity program


[User] Explain ID.IM-02.185.

[Assistant] Collect and analyze performance metrics using security tools and services to inform improvements to the cybersecurity program


[User] What is ID.IM-03?

[Assistant] Improvements are identified from execution of operational processes, procedures, and activities


[User] Explain the requirement of ID.IM-03.

[Assistant] Improvements are identified from execution of operational processes, procedures, and activities


[User] What outcome is expected by ID.IM-03?

[Assistant] Improvements are identified from execution of operational processes, procedures, and activities


[User] What is first? (1st)

[Assistant] 1st Party Risk


[User] Explain first.

[Assistant] 1st Party Risk


[User] What is ID.IM-03.186? (Ex1)

[Assistant] Conduct collaborative lessons learned sessions with suppliers


[User] Explain ID.IM-03.186.

[Assistant] Conduct collaborative lessons learned sessions with suppliers


[User] What is ID.IM-03.187? (Ex2)

[Assistant] Annually review cybersecurity policies, processes, and procedures to take lessons learned into account


[User] Explain ID.IM-03.187.

[Assistant] Annually review cybersecurity policies, processes, and procedures to take lessons learned into account


[User] What is ID.IM-03.188? (Ex3)

[Assistant] Use metrics to assess operational cybersecurity performance over time


[User] Explain ID.IM-03.188.

[Assistant] Use metrics to assess operational cybersecurity performance over time


[User] What is ID.IM-04?

[Assistant] Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved


[User] Explain the requirement of ID.IM-04.

[Assistant] Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved


[User] What outcome is expected by ID.IM-04?

[Assistant] Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved


[User] What is first? (1st)

[Assistant] 1st Party Risk


[User] Explain first.

[Assistant] 1st Party Risk


[User] What is ID.IM-04.189? (Ex1)

[Assistant] Establish contingency plans (e.g., incident response, business continuity, disaster recovery) for responding to and recovering from adverse events that can interfere with operations, expose confidential information, or otherwise endanger the organization's mission and viability


[User] Explain ID.IM-04.189.

[Assistant] Establish contingency plans (e.g., incident response, business continuity, disaster recovery) for responding to and recovering from adverse events that can interfere with operations, expose confidential information, or otherwise endanger the organization's mission and viability


[User] What is ID.IM-04.190? (Ex2)

[Assistant] Include contact and communication information, processes for handling common scenarios, and criteria for prioritization, escalation, and elevation in all contingency plans


[User] Explain ID.IM-04.190.

[Assistant] Include contact and communication information, processes for handling common scenarios, and criteria for prioritization, escalation, and elevation in all contingency plans


[User] What is ID.IM-04.191? (Ex3)

[Assistant] Create a vulnerability management plan to identify and assess all types of vulnerabilities and to prioritize, test, and implement risk responses


[User] Explain ID.IM-04.191.

[Assistant] Create a vulnerability management plan to identify and assess all types of vulnerabilities and to prioritize, test, and implement risk responses


[User] What is ID.IM-04.192? (Ex4)

[Assistant] Communicate cybersecurity plans (including updates) to those responsible for carrying them out and to affected parties


[User] Explain ID.IM-04.192.

[Assistant] Communicate cybersecurity plans (including updates) to those responsible for carrying them out and to affected parties


[User] What is ID.IM-04.193? (Ex5)

[Assistant] Review and update all cybersecurity plans annually or when a need for significant improvements is identified


[User] Explain ID.IM-04.193.

[Assistant] Review and update all cybersecurity plans annually or when a need for significant improvements is identified


[User] What is ID.BE-01?

[Assistant] The organization’s role in the supply chain is identified and communicated


[User] Explain the requirement of ID.BE-01.

[Assistant] The organization’s role in the supply chain is identified and communicated


[User] What outcome is expected by ID.BE-01?

[Assistant] The organization’s role in the supply chain is identified and communicated


[User] What is WR-ID.BE-01?

[Assistant] Incorporated into GV.OC-05


[User] Explain WR-ID.BE-01.

[Assistant] Incorporated into GV.OC-05


[User] What is ID.BE-02?

[Assistant] The organization’s place in critical infrastructure and its industry sector is identified and communicated


[User] Explain the requirement of ID.BE-02.

[Assistant] The organization’s place in critical infrastructure and its industry sector is identified and communicated


[User] What outcome is expected by ID.BE-02?

[Assistant] The organization’s place in critical infrastructure and its industry sector is identified and communicated


[User] What is WR-ID.BE-02?

[Assistant] Incorporated into GV.OC-01


[User] Explain WR-ID.BE-02.

[Assistant] Incorporated into GV.OC-01


[User] What is ID.BE-03?

[Assistant] Priorities for organizational mission, objectives, and activities are established and communicated


[User] Explain the requirement of ID.BE-03.

[Assistant] Priorities for organizational mission, objectives, and activities are established and communicated


[User] What outcome is expected by ID.BE-03?

[Assistant] Priorities for organizational mission, objectives, and activities are established and communicated


[User] What is WR-ID.BE-03?

[Assistant] Incorporated into GV.OC-01


[User] Explain WR-ID.BE-03.

[Assistant] Incorporated into GV.OC-01


[User] What is ID.BE-04?

[Assistant] Dependencies and critical functions for delivery of critical services are established


[User] Explain the requirement of ID.BE-04.

[Assistant] Dependencies and critical functions for delivery of critical services are established


[User] What outcome is expected by ID.BE-04?

[Assistant] Dependencies and critical functions for delivery of critical services are established


[User] What is WR-ID.BE-04?

[Assistant] Incorporated into GV.OC-04, GV.OC-05


[User] Explain WR-ID.BE-04.

[Assistant] Incorporated into GV.OC-04, GV.OC-05


[User] What is ID.BE-05?

[Assistant] Resilience requirements to support delivery of critical services are established for all operating states (e.g. under duress/attack, during recovery, normal operations)


[User] Explain the requirement of ID.BE-05.

[Assistant] Resilience requirements to support delivery of critical services are established for all operating states (e.g. under duress/attack, during recovery, normal operations)


[User] What outcome is expected by ID.BE-05?

[Assistant] Resilience requirements to support delivery of critical services are established for all operating states (e.g. under duress/attack, during recovery, normal operations)


[User] What is WR-ID.BE-05?

[Assistant] Incorporated into GV.OC-04


[User] Explain WR-ID.BE-05.

[Assistant] Incorporated into GV.OC-04


[User] What is WR-ID.BE?

[Assistant] Incorporated into GV.OC


[User] Explain WR-ID.BE.

[Assistant] Incorporated into GV.OC


[User] What is ID.GV-01?

[Assistant] Organizational cybersecurity policy is established and communicated


[User] Explain the requirement of ID.GV-01.

[Assistant] Organizational cybersecurity policy is established and communicated


[User] What outcome is expected by ID.GV-01?

[Assistant] Organizational cybersecurity policy is established and communicated


[User] What is WR-ID.GV-01?

[Assistant] Incorporated into GV.PO, GV.PO-01, GV.PO-02


[User] Explain WR-ID.GV-01.

[Assistant] Incorporated into GV.PO, GV.PO-01, GV.PO-02


[User] What is ID.GV-02?

[Assistant] Cybersecurity roles and responsibilities are coordinated and aligned with internal roles and external partners


[User] Explain the requirement of ID.GV-02.

[Assistant] Cybersecurity roles and responsibilities are coordinated and aligned with internal roles and external partners


[User] What outcome is expected by ID.GV-02?

[Assistant] Cybersecurity roles and responsibilities are coordinated and aligned with internal roles and external partners


[User] What is WR-ID.GV-02?

[Assistant] Incorporated into GV.OC-02, GV.RR, GV.RR-02


[User] Explain WR-ID.GV-02.

[Assistant] Incorporated into GV.OC-02, GV.RR, GV.RR-02


[User] What is ID.GV-03?

[Assistant] Legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations, are understood and managed


[User] Explain the requirement of ID.GV-03.

[Assistant] Legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations, are understood and managed


[User] What outcome is expected by ID.GV-03?

[Assistant] Legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations, are understood and managed


[User] What is WR-ID.GV-03?

[Assistant] Moved to GV.OC-03


[User] Explain WR-ID.GV-03.

[Assistant] Moved to GV.OC-03


[User] What is ID.GV-04?

[Assistant] Governance and risk management processes address cybersecurity risks


[User] Explain the requirement of ID.GV-04.

[Assistant] Governance and risk management processes address cybersecurity risks


[User] What outcome is expected by ID.GV-04?

[Assistant] Governance and risk management processes address cybersecurity risks


[User] What is WR-ID.GV-04?

[Assistant] Moved to GV.RM-04


[User] Explain WR-ID.GV-04.

[Assistant] Moved to GV.RM-04


[User] What is WR-ID.GV?

[Assistant] Incorporated into GV


[User] Explain WR-ID.GV.

[Assistant] Incorporated into GV


[User] What is ID.RM-01?

[Assistant] Risk management processes are established, managed, and agreed to by organizational stakeholders


[User] Explain the requirement of ID.RM-01.

[Assistant] Risk management processes are established, managed, and agreed to by organizational stakeholders


[User] What outcome is expected by ID.RM-01?

[Assistant] Risk management processes are established, managed, and agreed to by organizational stakeholders


[User] What is WR-ID.RM-01?

[Assistant] Incorporated into GV.RM-01, GV.RM-06, GV.RR-03


[User] Explain WR-ID.RM-01.

[Assistant] Incorporated into GV.RM-01, GV.RM-06, GV.RR-03


[User] What is ID.RM-02?

[Assistant] Organizational risk tolerance is determined and clearly expressed


[User] Explain the requirement of ID.RM-02.

[Assistant] Organizational risk tolerance is determined and clearly expressed


[User] What outcome is expected by ID.RM-02?

[Assistant] Organizational risk tolerance is determined and clearly expressed


[User] What is WR-ID.RM-02?

[Assistant] Incorporated into GV.RM-02, GV.RM-04


[User] Explain WR-ID.RM-02.

[Assistant] Incorporated into GV.RM-02, GV.RM-04


[User] What is ID.RM-03?

[Assistant] The organization’s determination of risk tolerance is informed by its role in critical infrastructure and sector specific risk analysis


[User] Explain the requirement of ID.RM-03.

[Assistant] The organization’s determination of risk tolerance is informed by its role in critical infrastructure and sector specific risk analysis


[User] What outcome is expected by ID.RM-03?

[Assistant] The organization’s determination of risk tolerance is informed by its role in critical infrastructure and sector specific risk analysis


[User] What is WR-ID.RM-03?

[Assistant] Moved into GV.RM-02


[User] Explain WR-ID.RM-03.

[Assistant] Moved into GV.RM-02


[User] What is WR-ID.RM?

[Assistant] Incorporated into GV.RM


[User] Explain WR-ID.RM.

[Assistant] Incorporated into GV.RM


[User] What is ID.SC-01?

[Assistant] Cyber supply chain risk management processes are identified, established, assessed, managed, and agreed to by organizational stakeholders


[User] Explain the requirement of ID.SC-01.

[Assistant] Cyber supply chain risk management processes are identified, established, assessed, managed, and agreed to by organizational stakeholders


[User] What outcome is expected by ID.SC-01?

[Assistant] Cyber supply chain risk management processes are identified, established, assessed, managed, and agreed to by organizational stakeholders


[User] What is WR-ID.SC-01?

[Assistant] Incorporated into GV.RM-05, GV.SC-01, GV.SC-06, GV.SC-09, GV.SC-10


[User] Explain WR-ID.SC-01.

[Assistant] Incorporated into GV.RM-05, GV.SC-01, GV.SC-06, GV.SC-09, GV.SC-10


[User] What is ID.SC-02?

[Assistant] Suppliers and third party partners of information systems, components, and services are identified, prioritized, and assessed using a cyber supply chain risk assessment process


[User] Explain the requirement of ID.SC-02.

[Assistant] Suppliers and third party partners of information systems, components, and services are identified, prioritized, and assessed using a cyber supply chain risk assessment process


[User] What outcome is expected by ID.SC-02?

[Assistant] Suppliers and third party partners of information systems, components, and services are identified, prioritized, and assessed using a cyber supply chain risk assessment process


[User] What is WR-ID.SC-02?

[Assistant] Incorporated into GV.OC-02, GV.SC-03, GV.SC-04, GV.SC-07, ID.RA-10


[User] Explain WR-ID.SC-02.

[Assistant] Incorporated into GV.OC-02, GV.SC-03, GV.SC-04, GV.SC-07, ID.RA-10


[User] What is ID.SC-03?

[Assistant] Contracts with suppliers and third-party partners are used to implement appropriate measures designed to meet the objectives of an organization’s cybersecurity program and Cyber Supply Chain Risk Management Plan.


[User] Explain the requirement of ID.SC-03.

[Assistant] Contracts with suppliers and third-party partners are used to implement appropriate measures designed to meet the objectives of an organization’s cybersecurity program and Cyber Supply Chain Risk Management Plan.


[User] What outcome is expected by ID.SC-03?

[Assistant] Contracts with suppliers and third-party partners are used to implement appropriate measures designed to meet the objectives of an organization’s cybersecurity program and Cyber Supply Chain Risk Management Plan.


[User] What is WR-ID.SC-03?

[Assistant] Moved to GV.SC-05


[User] Explain WR-ID.SC-03.

[Assistant] Moved to GV.SC-05


[User] What is ID.SC-04?

[Assistant] Suppliers and third-party partners are routinely assessed using audits, test results, or other forms of evaluations to confirm they are meeting their contractual obligations.


[User] Explain the requirement of ID.SC-04.

[Assistant] Suppliers and third-party partners are routinely assessed using audits, test results, or other forms of evaluations to confirm they are meeting their contractual obligations.


[User] What outcome is expected by ID.SC-04?

[Assistant] Suppliers and third-party partners are routinely assessed using audits, test results, or other forms of evaluations to confirm they are meeting their contractual obligations.


[User] What is WR-ID.SC-04?

[Assistant] Incorporated into GV.SC-07, ID.RA-10


[User] Explain WR-ID.SC-04.

[Assistant] Incorporated into GV.SC-07, ID.RA-10


[User] What is ID.SC-05?

[Assistant] Response and recovery planning and testing are conducted with suppliers and third-party providers


[User] Explain the requirement of ID.SC-05.

[Assistant] Response and recovery planning and testing are conducted with suppliers and third-party providers


[User] What outcome is expected by ID.SC-05?

[Assistant] Response and recovery planning and testing are conducted with suppliers and third-party providers


[User] What is WR-ID.SC-05?

[Assistant] Incorporated into GV.SC-08, ID.IM-02


[User] Explain WR-ID.SC-05.

[Assistant] Incorporated into GV.SC-08, ID.IM-02


[User] What is WR-ID.SC?

[Assistant] Incorporated into GV.SC


[User] Explain WR-ID.SC.

[Assistant] Incorporated into GV.SC


[User] What is PR? (PROTECT)

[Assistant] Safeguards to manage the organization's cybersecurity risks are used


[User] Summarize the scope of PR.

[Assistant] Safeguards to manage the organization's cybersecurity risks are used


[User] What does PR cover?

[Assistant] Safeguards to manage the organization's cybersecurity risks are used


[User] What is PR.AA? (Identity Management, Authentication, and Access Control)

[Assistant] Access to physical and logical assets is limited to authorized users, services, and hardware and  managed commensurate with the assessed risk of unauthorized access


[User] Summarize the scope of PR.AA.

[Assistant] Access to physical and logical assets is limited to authorized users, services, and hardware and  managed commensurate with the assessed risk of unauthorized access


[User] What does PR.AA cover?

[Assistant] Access to physical and logical assets is limited to authorized users, services, and hardware and  managed commensurate with the assessed risk of unauthorized access


[User] What is PR.AA-01?

[Assistant] Identities and credentials for authorized users, services, and hardware are managed by the organization


[User] Explain the requirement of PR.AA-01.

[Assistant] Identities and credentials for authorized users, services, and hardware are managed by the organization


[User] What outcome is expected by PR.AA-01?

[Assistant] Identities and credentials for authorized users, services, and hardware are managed by the organization


[User] What is first? (1st)

[Assistant] 1st Party Risk


[User] Explain first.

[Assistant] 1st Party Risk


[User] What is PR.AA-01.194? (Ex1)

[Assistant] Initiate requests for new access or additional access for employees, contractors, and others, and track, review, and fulfill the requests, with permission from system or data owners when needed


[User] Explain PR.AA-01.194.

[Assistant] Initiate requests for new access or additional access for employees, contractors, and others, and track, review, and fulfill the requests, with permission from system or data owners when needed


[User] What is PR.AA-01.195? (Ex2)

[Assistant] Issue, manage, and revoke cryptographic certificates and identity tokens, cryptographic keys (i.e., key management), and other credentials


[User] Explain PR.AA-01.195.

[Assistant] Issue, manage, and revoke cryptographic certificates and identity tokens, cryptographic keys (i.e., key management), and other credentials


[User] What is PR.AA-01.196? (Ex3)

[Assistant] Select a unique identifier for each device from immutable hardware characteristics or an identifier securely provisioned to the device


[User] Explain PR.AA-01.196.

[Assistant] Select a unique identifier for each device from immutable hardware characteristics or an identifier securely provisioned to the device


[User] What is PR.AA-01.197? (Ex4)

[Assistant] Physically label authorized hardware with an identifier for inventory and servicing purposes


[User] Explain PR.AA-01.197.

[Assistant] Physically label authorized hardware with an identifier for inventory and servicing purposes


[User] What is PR.AA-02?

[Assistant] Identities are proofed and bound to credentials based on the context of interactions


[User] Explain the requirement of PR.AA-02.

[Assistant] Identities are proofed and bound to credentials based on the context of interactions


[User] What outcome is expected by PR.AA-02?

[Assistant] Identities are proofed and bound to credentials based on the context of interactions


[User] What is first? (1st)

[Assistant] 1st Party Risk


[User] Explain first.

[Assistant] 1st Party Risk


[User] What is third? (3rd)

[Assistant] 3rd Party Risk


[User] Explain third.

[Assistant] 3rd Party Risk


[User] What is PR.AA-02.198? (Ex1)

[Assistant] Verify a person's claimed identity at enrollment time using government-issued identity credentials (e.g., passport, visa, driver's license)


[User] Explain PR.AA-02.198.

[Assistant] Verify a person's claimed identity at enrollment time using government-issued identity credentials (e.g., passport, visa, driver's license)


[User] What is PR.AA-02.199? (Ex2)

[Assistant] Issue a different credential for each person (i.e., no credential sharing)


[User] Explain PR.AA-02.199.

[Assistant] Issue a different credential for each person (i.e., no credential sharing)


[User] What is PR.AA-03?

[Assistant] Users, services, and hardware are authenticated


[User] Explain the requirement of PR.AA-03.

[Assistant] Users, services, and hardware are authenticated


[User] What outcome is expected by PR.AA-03?

[Assistant] Users, services, and hardware are authenticated


[User] What is first? (1st)

[Assistant] 1st Party Risk


[User] Explain first.

[Assistant] 1st Party Risk


[User] What is PR.AA-03.200? (Ex1)

[Assistant] Require multifactor authentication


[User] Explain PR.AA-03.200.

[Assistant] Require multifactor authentication


[User] What is PR.AA-03.201? (Ex2)

[Assistant] Enforce policies for the minimum strength of passwords, PINs, and similar authenticators


[User] Explain PR.AA-03.201.

[Assistant] Enforce policies for the minimum strength of passwords, PINs, and similar authenticators


[User] What is PR.AA-03.202? (Ex3)

[Assistant] Periodically reauthenticate users, services, and hardware based on risk (e.g., in zero trust architectures)


[User] Explain PR.AA-03.202.

[Assistant] Periodically reauthenticate users, services, and hardware based on risk (e.g., in zero trust architectures)


[User] What is PR.AA-03.203? (Ex4)

[Assistant] Ensure that authorized personnel can access accounts essential for protecting safety under emergency conditions


[User] Explain PR.AA-03.203.

[Assistant] Ensure that authorized personnel can access accounts essential for protecting safety under emergency conditions


[User] What is PR.AA-04?

[Assistant] Identity assertions are protected, conveyed, and verified


[User] Explain the requirement of PR.AA-04.

[Assistant] Identity assertions are protected, conveyed, and verified


[User] What outcome is expected by PR.AA-04?

[Assistant] Identity assertions are protected, conveyed, and verified


[User] What is first? (1st)

[Assistant] 1st Party Risk


[User] Explain first.

[Assistant] 1st Party Risk


[User] What is PR.AA-04.204? (Ex1)

[Assistant] Protect identity assertions that are used to convey authentication and user information through single sign-on systems


[User] Explain PR.AA-04.204.

[Assistant] Protect identity assertions that are used to convey authentication and user information through single sign-on systems


[User] What is PR.AA-04.205? (Ex2)

[Assistant] Protect identity assertions that are used to convey authentication and user information between federated systems


[User] Explain PR.AA-04.205.

[Assistant] Protect identity assertions that are used to convey authentication and user information between federated systems


[User] What is PR.AA-04.206? (Ex3)

[Assistant] Implement standards-based approaches for identity assertions in all contexts, and follow all guidance for the generation (e.g., data models, metadata), protection (e.g., digital signing, encryption), and verification (e.g., signature validation) of identity assertions


[User] Explain PR.AA-04.206.

[Assistant] Implement standards-based approaches for identity assertions in all contexts, and follow all guidance for the generation (e.g., data models, metadata), protection (e.g., digital signing, encryption), and verification (e.g., signature validation) of identity assertions


[User] What is PR.AA-05?

[Assistant] Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties


[User] Explain the requirement of PR.AA-05.

[Assistant] Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties


[User] What outcome is expected by PR.AA-05?

[Assistant] Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties


[User] What is first? (1st)

[Assistant] 1st Party Risk


[User] Explain first.

[Assistant] 1st Party Risk


[User] What is PR.AA-05.207? (Ex1)

[Assistant] Review logical and physical access privileges periodically and whenever someone changes roles or leaves the organization, and promptly rescind privileges that are no longer needed


[User] Explain PR.AA-05.207.

[Assistant] Review logical and physical access privileges periodically and whenever someone changes roles or leaves the organization, and promptly rescind privileges that are no longer needed


[User] What is PR.AA-05.208? (Ex2)

[Assistant] Take attributes of the requester and the requested resource into account for authorization decisions (e.g., geolocation, day/time, requester endpoint's cyber health)


[User] Explain PR.AA-05.208.

[Assistant] Take attributes of the requester and the requested resource into account for authorization decisions (e.g., geolocation, day/time, requester endpoint's cyber health)


[User] What is PR.AA-05.209? (Ex3)

[Assistant] Restrict access and privileges to the minimum necessary (e.g., zero trust architecture)


[User] Explain PR.AA-05.209.

[Assistant] Restrict access and privileges to the minimum necessary (e.g., zero trust architecture)


[User] What is PR.AA-05.210? (Ex4)

[Assistant] Periodically review the privileges associated with critical business functions to confirm proper separation of duties


[User] Explain PR.AA-05.210.

[Assistant] Periodically review the privileges associated with critical business functions to confirm proper separation of duties


[User] What is PR.AA-06?

[Assistant] Physical access to assets is managed, monitored, and enforced commensurate with risk


[User] Explain the requirement of PR.AA-06.

[Assistant] Physical access to assets is managed, monitored, and enforced commensurate with risk


[User] What outcome is expected by PR.AA-06?

[Assistant] Physical access to assets is managed, monitored, and enforced commensurate with risk


[User] What is first? (1st)

[Assistant] 1st Party Risk


[User] Explain first.

[Assistant] 1st Party Risk


[User] What is third? (3rd)

[Assistant] 3rd Party Risk


[User] Explain third.

[Assistant] 3rd Party Risk


[User] What is PR.AA-06.211? (Ex1)

[Assistant] Use security guards, security cameras, locked entrances, alarm systems, and other physical controls to monitor facilities and restrict access


[User] Explain PR.AA-06.211.

[Assistant] Use security guards, security cameras, locked entrances, alarm systems, and other physical controls to monitor facilities and restrict access


[User] What is PR.AA-06.212? (Ex2)

[Assistant] Employ additional physical security controls for areas that contain high-risk assets


[User] Explain PR.AA-06.212.

[Assistant] Employ additional physical security controls for areas that contain high-risk assets


[User] What is PR.AA-06.213? (Ex3)

[Assistant] Escort guests, vendors, and other third parties within areas that contain business-critical assets


[User] Explain PR.AA-06.213.

[Assistant] Escort guests, vendors, and other third parties within areas that contain business-critical assets


[User] What is PR.AT? (Awareness and Training)

[Assistant] The organization's personnel are provided with cybersecurity awareness and training so that they can perform their cybersecurity-related tasks


[User] Summarize the scope of PR.AT.

[Assistant] The organization's personnel are provided with cybersecurity awareness and training so that they can perform their cybersecurity-related tasks


[User] What does PR.AT cover?

[Assistant] The organization's personnel are provided with cybersecurity awareness and training so that they can perform their cybersecurity-related tasks


[User] What is PR.AT-01?

[Assistant] Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind


[User] Explain the requirement of PR.AT-01.

[Assistant] Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind


[User] What outcome is expected by PR.AT-01?

[Assistant] Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind


[User] What is first? (1st)

[Assistant] 1st Party Risk


[User] Explain first.

[Assistant] 1st Party Risk


[User] What is PR.AT-01.214? (Ex1)

[Assistant] Provide basic cybersecurity awareness and training to employees, contractors, partners, suppliers, and all other users of the organization's non-public resources


[User] Explain PR.AT-01.214.

[Assistant] Provide basic cybersecurity awareness and training to employees, contractors, partners, suppliers, and all other users of the organization's non-public resources


[User] What is PR.AT-01.215? (Ex2)

[Assistant] Train personnel to recognize social engineering attempts and other common attacks, report attacks and suspicious activity, comply with acceptable use policies, and perform basic cyber hygiene tasks (e.g., patching software, choosing passwords, protecting credentials)


[User] Explain PR.AT-01.215.

[Assistant] Train personnel to recognize social engineering attempts and other common attacks, report attacks and suspicious activity, comply with acceptable use policies, and perform basic cyber hygiene tasks (e.g., patching software, choosing passwords, protecting credentials)


[User] What is PR.AT-01.216? (Ex3)

[Assistant] Explain the consequences of cybersecurity policy violations, both to individual users and the organization as a whole


[User] Explain PR.AT-01.216.

[Assistant] Explain the consequences of cybersecurity policy violations, both to individual users and the organization as a whole


[User] What is PR.AT-01.217? (Ex4)

[Assistant] Periodically assess or test users on their understanding of basic cybersecurity practices


[User] Explain PR.AT-01.217.

[Assistant] Periodically assess or test users on their understanding of basic cybersecurity practices


[User] What is PR.AT-01.218? (Ex5)

[Assistant] Require annual refreshers to reinforce existing practices and introduce new practices


[User] Explain PR.AT-01.218.

[Assistant] Require annual refreshers to reinforce existing practices and introduce new practices


[User] What is PR.AT-02?

[Assistant] Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind


[User] Explain the requirement of PR.AT-02.

[Assistant] Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind


[User] What outcome is expected by PR.AT-02?

[Assistant] Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind


[User] What is first? (1st)

[Assistant] 1st Party Risk


[User] Explain first.

[Assistant] 1st Party Risk


[User] What is third? (3rd)

[Assistant] 3rd Party Risk


[User] Explain third.

[Assistant] 3rd Party Risk


[User] What is PR.AT-02.219? (Ex1)

[Assistant] Identify the specialized roles within the organization that require additional cybersecurity training, such as physical and cybersecurity personnel, finance personnel, senior leadership, and anyone with access to business-critical data


[User] Explain PR.AT-02.219.

[Assistant] Identify the specialized roles within the organization that require additional cybersecurity training, such as physical and cybersecurity personnel, finance personnel, senior leadership, and anyone with access to business-critical data


[User] What is PR.AT-02.220? (Ex2)

[Assistant] Provide role-based cybersecurity awareness and training to all those in specialized roles, including contractors, partners, suppliers, and other third parties


[User] Explain PR.AT-02.220.

[Assistant] Provide role-based cybersecurity awareness and training to all those in specialized roles, including contractors, partners, suppliers, and other third parties


[User] What is PR.AT-02.221? (Ex3)

[Assistant] Periodically assess or test users on their understanding of cybersecurity practices for their specialized roles


[User] Explain PR.AT-02.221.

[Assistant] Periodically assess or test users on their understanding of cybersecurity practices for their specialized roles


[User] What is PR.AT-02.222? (Ex4)

[Assistant] Require annual refreshers to reinforce existing practices and introduce new practices


[User] Explain PR.AT-02.222.

[Assistant] Require annual refreshers to reinforce existing practices and introduce new practices


[User] What is PR.AT-03?

[Assistant] Third-party stakeholders (e.g., suppliers, customers, partners) understand their roles and responsibilities


[User] Explain the requirement of PR.AT-03.

[Assistant] Third-party stakeholders (e.g., suppliers, customers, partners) understand their roles and responsibilities


[User] What outcome is expected by PR.AT-03?

[Assistant] Third-party stakeholders (e.g., suppliers, customers, partners) understand their roles and responsibilities


[User] What is WR-PR.AT-03?

[Assistant] Incorporated into PR.AT-01, PR.AT-02


[User] Explain WR-PR.AT-03.

[Assistant] Incorporated into PR.AT-01, PR.AT-02


[User] What is PR.AT-04?

[Assistant] Senior executives understand their roles and responsibilities


[User] Explain the requirement of PR.AT-04.

[Assistant] Senior executives understand their roles and responsibilities


[User] What outcome is expected by PR.AT-04?

[Assistant] Senior executives understand their roles and responsibilities


[User] What is WR-PR.AT-04?

[Assistant] Incorporated into PR.AT-02


[User] Explain WR-PR.AT-04.

[Assistant] Incorporated into PR.AT-02


[User] What is PR.AT-05?

[Assistant] Physical and cybersecurity personnel understand their roles and responsibilities


[User] Explain the requirement of PR.AT-05.

[Assistant] Physical and cybersecurity personnel understand their roles and responsibilities


[User] What outcome is expected by PR.AT-05?

[Assistant] Physical and cybersecurity personnel understand their roles and responsibilities


[User] What is WR-PR.AT-05?

[Assistant] Incorporated into PR.AT-02


[User] Explain WR-PR.AT-05.

[Assistant] Incorporated into PR.AT-02


[User] What is PR.DS? (Data Security)

[Assistant] Data are managed consistent with the organization's risk strategy to protect the confidentiality, integrity, and availability of information


[User] Summarize the scope of PR.DS.

[Assistant] Data are managed consistent with the organization's risk strategy to protect the confidentiality, integrity, and availability of information


[User] What does PR.DS cover?

[Assistant] Data are managed consistent with the organization's risk strategy to protect the confidentiality, integrity, and availability of information


[User] What is PR.DS-01?

[Assistant] The confidentiality, integrity, and availability of data-at-rest are protected


[User] Explain the requirement of PR.DS-01.

[Assistant] The confidentiality, integrity, and availability of data-at-rest are protected


[User] What outcome is expected by PR.DS-01?

[Assistant] The confidentiality, integrity, and availability of data-at-rest are protected


[User] What is first? (1st)

[Assistant] 1st Party Risk


[User] Explain first.

[Assistant] 1st Party Risk


[User] What is PR.DS-01.223? (Ex1)

[Assistant] Use encryption, digital signatures, and cryptographic hashes to protect the confidentiality and integrity of stored data in files, databases, virtual machine disk images, container images, and other resources


[User] Explain PR.DS-01.223.

[Assistant] Use encryption, digital signatures, and cryptographic hashes to protect the confidentiality and integrity of stored data in files, databases, virtual machine disk images, container images, and other resources


[User] What is PR.DS-01.224? (Ex2)

[Assistant] Use full disk encryption to protect data stored on user endpoints


[User] Explain PR.DS-01.224.

[Assistant] Use full disk encryption to protect data stored on user endpoints


[User] What is PR.DS-01.225? (Ex3)

[Assistant] Confirm the integrity of software by validating signatures


[User] Explain PR.DS-01.225.

[Assistant] Confirm the integrity of software by validating signatures


[User] What is PR.DS-01.226? (Ex4)

[Assistant] Restrict the use of removable media to prevent data exfiltration


[User] Explain PR.DS-01.226.

[Assistant] Restrict the use of removable media to prevent data exfiltration


[User] What is PR.DS-01.227? (Ex5)

[Assistant] Physically secure removable media containing unencrypted sensitive information, such as within locked offices or file cabinets


[User] Explain PR.DS-01.227.

[Assistant] Physically secure removable media containing unencrypted sensitive information, such as within locked offices or file cabinets


[User] What is PR.DS-02?

[Assistant] The confidentiality, integrity, and availability of data-in-transit are protected


[User] Explain the requirement of PR.DS-02.

[Assistant] The confidentiality, integrity, and availability of data-in-transit are protected


[User] What outcome is expected by PR.DS-02?

[Assistant] The confidentiality, integrity, and availability of data-in-transit are protected


[User] What is first? (1st)

[Assistant] 1st Party Risk


[User] Explain first.

[Assistant] 1st Party Risk


[User] What is PR.DS-02.228? (Ex1)

[Assistant] Use encryption, digital signatures, and cryptographic hashes to protect the confidentiality and integrity of network communications


[User] Explain PR.DS-02.228.

[Assistant] Use encryption, digital signatures, and cryptographic hashes to protect the confidentiality and integrity of network communications


[User] What is PR.DS-02.229? (Ex2)

[Assistant] Automatically encrypt or block outbound emails and other communications that contain sensitive data, depending on the data classification


[User] Explain PR.DS-02.229.

[Assistant] Automatically encrypt or block outbound emails and other communications that contain sensitive data, depending on the data classification


[User] What is PR.DS-02.230? (Ex3)

[Assistant] Block access to personal email, file sharing, file storage services, and other personal communications applications and services from organizational systems and networks


[User] Explain PR.DS-02.230.

[Assistant] Block access to personal email, file sharing, file storage services, and other personal communications applications and services from organizational systems and networks


[User] What is PR.DS-02.231? (Ex4)

[Assistant] Prevent reuse of sensitive data from production environments (e.g., customer records) in development, testing, and other non-production environments


[User] Explain PR.DS-02.231.

[Assistant] Prevent reuse of sensitive data from production environments (e.g., customer records) in development, testing, and other non-production environments


[User] What is PR.DS-03?

[Assistant] Assets are formally managed throughout removal, transfers, and disposition


[User] Explain the requirement of PR.DS-03.

[Assistant] Assets are formally managed throughout removal, transfers, and disposition


[User] What outcome is expected by PR.DS-03?

[Assistant] Assets are formally managed throughout removal, transfers, and disposition


[User] What is WR-PR.DS-03?

[Assistant] Incorporated into ID.AM-08, PR.PS-03


[User] Explain WR-PR.DS-03.

[Assistant] Incorporated into ID.AM-08, PR.PS-03


[User] What is PR.DS-04?

[Assistant] Adequate capacity to ensure availability is maintained


[User] Explain the requirement of PR.DS-04.

[Assistant] Adequate capacity to ensure availability is maintained


[User] What outcome is expected by PR.DS-04?

[Assistant] Adequate capacity to ensure availability is maintained


[User] What is WR-PR.DS-04?

[Assistant] Moved to PR.IR-04


[User] Explain WR-PR.DS-04.

[Assistant] Moved to PR.IR-04


[User] What is PR.DS-05?

[Assistant] Protections against data leaks are implemented


[User] Explain the requirement of PR.DS-05.

[Assistant] Protections against data leaks are implemented


[User] What outcome is expected by PR.DS-05?

[Assistant] Protections against data leaks are implemented


[User] What is WR-PR.DS-05?

[Assistant] Incorporated into PR.DS-01, PR.DS-02, PR.DS-10


[User] Explain WR-PR.DS-05.

[Assistant] Incorporated into PR.DS-01, PR.DS-02, PR.DS-10


[User] What is PR.DS-06?

[Assistant] Integrity checking mechanisms are used to verify software, firmware, and information integrity


[User] Explain the requirement of PR.DS-06.

[Assistant] Integrity checking mechanisms are used to verify software, firmware, and information integrity


[User] What outcome is expected by PR.DS-06?

[Assistant] Integrity checking mechanisms are used to verify software, firmware, and information integrity


[User] What is WR-PR.DS-06?

[Assistant] Incorporated into PR.DS-01, DE.CM-09


[User] Explain WR-PR.DS-06.

[Assistant] Incorporated into PR.DS-01, DE.CM-09


[User] What is PR.DS-07?

[Assistant] The development and testing environment(s) are separate from the production environment


[User] Explain the requirement of PR.DS-07.

[Assistant] The development and testing environment(s) are separate from the production environment


[User] What outcome is expected by PR.DS-07?

[Assistant] The development and testing environment(s) are separate from the production environment


[User] What is WR-PR.DS-07?

[Assistant] Incorporated into PR.IR-01


[User] Explain WR-PR.DS-07.

[Assistant] Incorporated into PR.IR-01


[User] What is PR.DS-08?

[Assistant] Integrity checking mechanisms are used to verify hardware integrity


[User] Explain the requirement of PR.DS-08.

[Assistant] Integrity checking mechanisms are used to verify hardware integrity


[User] What outcome is expected by PR.DS-08?

[Assistant] Integrity checking mechanisms are used to verify hardware integrity


[User] What is WR-PR.DS-08?

[Assistant] Incorporated into ID.RA-09, DE.CM-09


[User] Explain WR-PR.DS-08.

[Assistant] Incorporated into ID.RA-09, DE.CM-09


[User] What is PR.DS-10?

[Assistant] The confidentiality, integrity, and availability of data-in-use are protected


[User] Explain the requirement of PR.DS-10.

[Assistant] The confidentiality, integrity, and availability of data-in-use are protected


[User] What outcome is expected by PR.DS-10?

[Assistant] The confidentiality, integrity, and availability of data-in-use are protected


[User] What is first? (1st)

[Assistant] 1st Party Risk


[User] Explain first.

[Assistant] 1st Party Risk


[User] What is PR.DS-10.232? (Ex1)

[Assistant] Remove data that must remain confidential (e.g., from processors and memory) as soon as it is no longer needed


[User] Explain PR.DS-10.232.

[Assistant] Remove data that must remain confidential (e.g., from processors and memory) as soon as it is no longer needed


[User] What is PR.DS-10.233? (Ex2)

[Assistant] Protect data in use from access by other users and processes of the same platform


[User] Explain PR.DS-10.233.

[Assistant] Protect data in use from access by other users and processes of the same platform


[User] What is PR.DS-11?

[Assistant] Backups of data are created, protected, maintained, and tested


[User] Explain the requirement of PR.DS-11.

[Assistant] Backups of data are created, protected, maintained, and tested


[User] What outcome is expected by PR.DS-11?

[Assistant] Backups of data are created, protected, maintained, and tested


[User] What is first? (1st)

[Assistant] 1st Party Risk


[User] Explain first.

[Assistant] 1st Party Risk


[User] What is PR.DS-11.234? (Ex1)

[Assistant] Continuously back up critical data in near-real-time, and back up other data frequently at agreed-upon schedules


[User] Explain PR.DS-11.234.

[Assistant] Continuously back up critical data in near-real-time, and back up other data frequently at agreed-upon schedules


[User] What is PR.DS-11.235? (Ex2)

[Assistant] Test backups and restores for all types of data sources at least annually


[User] Explain PR.DS-11.235.

[Assistant] Test backups and restores for all types of data sources at least annually


[User] What is PR.DS-11.236? (Ex3)

[Assistant] Securely store some backups offline and offsite so that an incident or disaster will not damage them


[User] Explain PR.DS-11.236.

[Assistant] Securely store some backups offline and offsite so that an incident or disaster will not damage them


[User] What is PR.DS-11.237? (Ex4)

[Assistant] Enforce geographic separation and geolocation restrictions for data backup storage


[User] Explain PR.DS-11.237.

[Assistant] Enforce geographic separation and geolocation restrictions for data backup storage


[User] What is PR.PS? (Platform Security)

[Assistant] The hardware, software (e.g., firmware, operating systems, applications), and services of physical and virtual platforms are managed consistent with the organization's risk strategy to protect their confidentiality, integrity, and availability


[User] Summarize the scope of PR.PS.

[Assistant] The hardware, software (e.g., firmware, operating systems, applications), and services of physical and virtual platforms are managed consistent with the organization's risk strategy to protect their confidentiality, integrity, and availability


[User] What does PR.PS cover?

[Assistant] The hardware, software (e.g., firmware, operating systems, applications), and services of physical and virtual platforms are managed consistent with the organization's risk strategy to protect their confidentiality, integrity, and availability


[User] What is PR.PS-01?

[Assistant] Configuration management practices are established and applied


[User] Explain the requirement of PR.PS-01.

[Assistant] Configuration management practices are established and applied


[User] What outcome is expected by PR.PS-01?

[Assistant] Configuration management practices are established and applied


[User] What is first? (1st)

[Assistant] 1st Party Risk


[User] Explain first.

[Assistant] 1st Party Risk


[User] What is PR.PS-01.238? (Ex1)

[Assistant] Establish, test, deploy, and maintain hardened baselines that enforce the organization's cybersecurity policies and provide only essential capabilities (i.e., principle of least functionality)


[User] Explain PR.PS-01.238.

[Assistant] Establish, test, deploy, and maintain hardened baselines that enforce the organization's cybersecurity policies and provide only essential capabilities (i.e., principle of least functionality)


[User] What is PR.PS-01.239? (Ex2)

[Assistant] Review all default configuration settings that may potentially impact cybersecurity when installing or upgrading software


[User] Explain PR.PS-01.239.

[Assistant] Review all default configuration settings that may potentially impact cybersecurity when installing or upgrading software


[User] What is PR.PS-01.240? (Ex3)

[Assistant] Monitor implemented software for deviations from approved baselines


[User] Explain PR.PS-01.240.

[Assistant] Monitor implemented software for deviations from approved baselines


[User] What is PR.PS-02?

[Assistant] Software is maintained, replaced, and removed commensurate with risk


[User] Explain the requirement of PR.PS-02.

[Assistant] Software is maintained, replaced, and removed commensurate with risk


[User] What outcome is expected by PR.PS-02?

[Assistant] Software is maintained, replaced, and removed commensurate with risk


[User] What is first? (1st)

[Assistant] 1st Party Risk


[User] Explain first.

[Assistant] 1st Party Risk


[User] What is PR.PS-02.241? (Ex1)

[Assistant] Perform routine and emergency patching within the timeframes specified in the vulnerability management plan


[User] Explain PR.PS-02.241.

[Assistant] Perform routine and emergency patching within the timeframes specified in the vulnerability management plan


[User] What is PR.PS-02.242? (Ex2)

[Assistant] Update container images, and deploy new container instances to replace rather than update existing instances


[User] Explain PR.PS-02.242.

[Assistant] Update container images, and deploy new container instances to replace rather than update existing instances


[User] What is PR.PS-02.243? (Ex3)

[Assistant] Replace end-of-life software and service versions with supported, maintained versions


[User] Explain PR.PS-02.243.

[Assistant] Replace end-of-life software and service versions with supported, maintained versions


[User] What is PR.PS-02.244? (Ex4)

[Assistant] Uninstall and remove unauthorized software and services that pose undue risks


[User] Explain PR.PS-02.244.

[Assistant] Uninstall and remove unauthorized software and services that pose undue risks


[User] What is PR.PS-02.245? (Ex5)

[Assistant] Uninstall and remove any unnecessary software components (e.g., operating system utilities) that attackers might misuse


[User] Explain PR.PS-02.245.

[Assistant] Uninstall and remove any unnecessary software components (e.g., operating system utilities) that attackers might misuse


[User] What is PR.PS-02.246? (Ex6)

[Assistant] Define and implement plans for software and service end-of-life maintenance support and obsolescence


[User] Explain PR.PS-02.246.

[Assistant] Define and implement plans for software and service end-of-life maintenance support and obsolescence


[User] What is PR.PS-03?

[Assistant] Hardware is maintained, replaced, and removed commensurate with risk


[User] Explain the requirement of PR.PS-03.

[Assistant] Hardware is maintained, replaced, and removed commensurate with risk


[User] What outcome is expected by PR.PS-03?

[Assistant] Hardware is maintained, replaced, and removed commensurate with risk


[User] What is first? (1st)

[Assistant] 1st Party Risk


[User] Explain first.

[Assistant] 1st Party Risk


[User] What is third? (3rd)

[Assistant] 3rd Party Risk


[User] Explain third.

[Assistant] 3rd Party Risk


[User] What is PR.PS-03.247? (Ex1)

[Assistant] Replace hardware when it lacks needed security capabilities or when it cannot support software with needed security capabilities


[User] Explain PR.PS-03.247.

[Assistant] Replace hardware when it lacks needed security capabilities or when it cannot support software with needed security capabilities


[User] What is PR.PS-03.248? (Ex2)

[Assistant] Define and implement plans for hardware end-of-life maintenance support and obsolescence


[User] Explain PR.PS-03.248.

[Assistant] Define and implement plans for hardware end-of-life maintenance support and obsolescence


[User] What is PR.PS-03.249? (Ex3)

[Assistant] Perform hardware disposal in a secure, responsible, and auditable manner


[User] Explain PR.PS-03.249.

[Assistant] Perform hardware disposal in a secure, responsible, and auditable manner


[User] What is PR.PS-04?

[Assistant] Log records are generated and made available for continuous monitoring


[User] Explain the requirement of PR.PS-04.

[Assistant] Log records are generated and made available for continuous monitoring


[User] What outcome is expected by PR.PS-04?

[Assistant] Log records are generated and made available for continuous monitoring


[User] What is first? (1st)

[Assistant] 1st Party Risk


[User] Explain first.

[Assistant] 1st Party Risk


[User] What is PR.PS-04.250? (Ex1)

[Assistant] Configure all operating systems, applications, and services (including cloud-based services) to generate log records


[User] Explain PR.PS-04.250.

[Assistant] Configure all operating systems, applications, and services (including cloud-based services) to generate log records


[User] What is PR.PS-04.251? (Ex2)

[Assistant] Configure log generators to securely share their logs with the organization's logging infrastructure systems and services


[User] Explain PR.PS-04.251.

[Assistant] Configure log generators to securely share their logs with the organization's logging infrastructure systems and services


[User] What is PR.PS-04.252? (Ex3)

[Assistant] Configure log generators to record the data needed by zero-trust architectures


[User] Explain PR.PS-04.252.

[Assistant] Configure log generators to record the data needed by zero-trust architectures


[User] What is PR.PS-05?

[Assistant] Installation and execution of unauthorized software are prevented


[User] Explain the requirement of PR.PS-05.

[Assistant] Installation and execution of unauthorized software are prevented


[User] What outcome is expected by PR.PS-05?

[Assistant] Installation and execution of unauthorized software are prevented


[User] What is first? (1st)

[Assistant] 1st Party Risk


[User] Explain first.

[Assistant] 1st Party Risk


[User] What is PR.PS-05.253? (Ex1)

[Assistant] When risk warrants it, restrict software execution to permitted products only or deny the execution of prohibited and unauthorized software


[User] Explain PR.PS-05.253.

[Assistant] When risk warrants it, restrict software execution to permitted products only or deny the execution of prohibited and unauthorized software


[User] What is PR.PS-05.254? (Ex2)

[Assistant] Verify the source of new software and the software's integrity before installing it


[User] Explain PR.PS-05.254.

[Assistant] Verify the source of new software and the software's integrity before installing it


[User] What is PR.PS-05.255? (Ex3)

[Assistant] Configure platforms to use only approved DNS services that block access to known malicious domains


[User] Explain PR.PS-05.255.

[Assistant] Configure platforms to use only approved DNS services that block access to known malicious domains


[User] What is PR.PS-05.256? (Ex4)

[Assistant] Configure platforms to allow the installation of organization-approved software only


[User] Explain PR.PS-05.256.

[Assistant] Configure platforms to allow the installation of organization-approved software only


[User] What is PR.PS-06?

[Assistant] Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle


[User] Explain the requirement of PR.PS-06.

[Assistant] Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle


[User] What outcome is expected by PR.PS-06?

[Assistant] Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle


[User] What is first? (1st)

[Assistant] 1st Party Risk


[User] Explain first.

[Assistant] 1st Party Risk


[User] What is PR.PS-06.257? (Ex1)

[Assistant] Protect all components of organization-developed software from tampering and unauthorized access


[User] Explain PR.PS-06.257.

[Assistant] Protect all components of organization-developed software from tampering and unauthorized access


[User] What is PR.PS-06.258? (Ex2)

[Assistant] Secure all software produced by the organization, with minimal vulnerabilities in their releases


[User] Explain PR.PS-06.258.

[Assistant] Secure all software produced by the organization, with minimal vulnerabilities in their releases


[User] What is PR.PS-06.259? (Ex3)

[Assistant] Maintain the software used in production environments, and securely dispose of software once it is no longer needed


[User] Explain PR.PS-06.259.

[Assistant] Maintain the software used in production environments, and securely dispose of software once it is no longer needed


[User] What is PR.IR? (Technology Infrastructure Resilience)

[Assistant] Security architectures are managed with the organization's risk strategy to protect asset confidentiality, integrity, and availability, and organizational resilience


[User] Summarize the scope of PR.IR.

[Assistant] Security architectures are managed with the organization's risk strategy to protect asset confidentiality, integrity, and availability, and organizational resilience


[User] What does PR.IR cover?

[Assistant] Security architectures are managed with the organization's risk strategy to protect asset confidentiality, integrity, and availability, and organizational resilience


[User] What is PR.IR-01?

[Assistant] Networks and environments are protected from unauthorized logical access and usage


[User] Explain the requirement of PR.IR-01.

[Assistant] Networks and environments are protected from unauthorized logical access and usage


[User] What outcome is expected by PR.IR-01?

[Assistant] Networks and environments are protected from unauthorized logical access and usage


[User] What is first? (1st)

[Assistant] 1st Party Risk


[User] Explain first.

[Assistant] 1st Party Risk


[User] What is third? (3rd)

[Assistant] 3rd Party Risk


[User] Explain third.

[Assistant] 3rd Party Risk


[User] What is PR.IR-01.260? (Ex1)

[Assistant] Logically segment organization networks and cloud-based platforms according to trust boundaries and platform types (e.g., IT, IoT, OT, mobile, guests), and permit required communications only between segments


[User] Explain PR.IR-01.260.

[Assistant] Logically segment organization networks and cloud-based platforms according to trust boundaries and platform types (e.g., IT, IoT, OT, mobile, guests), and permit required communications only between segments


[User] What is PR.IR-01.261? (Ex2)

[Assistant] Logically segment organization networks from external networks, and permit only necessary communications to enter the organization's networks from the external networks


[User] Explain PR.IR-01.261.

[Assistant] Logically segment organization networks from external networks, and permit only necessary communications to enter the organization's networks from the external networks


[User] What is PR.IR-01.262? (Ex3)

[Assistant] Implement zero trust architectures to restrict network access to each resource to the minimum necessary


[User] Explain PR.IR-01.262.

[Assistant] Implement zero trust architectures to restrict network access to each resource to the minimum necessary


[User] What is PR.IR-01.263? (Ex4)

[Assistant] Check the cyber health of endpoints before allowing them to access and use production resources


[User] Explain PR.IR-01.263.

[Assistant] Check the cyber health of endpoints before allowing them to access and use production resources


[User] What is PR.IR-02?

[Assistant] The organization's technology assets are protected from environmental threats


[User] Explain the requirement of PR.IR-02.

[Assistant] The organization's technology assets are protected from environmental threats


[User] What outcome is expected by PR.IR-02?

[Assistant] The organization's technology assets are protected from environmental threats


[User] What is first? (1st)

[Assistant] 1st Party Risk


[User] Explain first.

[Assistant] 1st Party Risk


[User] What is third? (3rd)

[Assistant] 3rd Party Risk


[User] Explain third.

[Assistant] 3rd Party Risk


[User] What is PR.IR-02.264? (Ex1)

[Assistant] Protect organizational equipment from known environmental threats, such as flooding, fire, wind, and excessive heat and humidity


[User] Explain PR.IR-02.264.

[Assistant] Protect organizational equipment from known environmental threats, such as flooding, fire, wind, and excessive heat and humidity


[User] What is PR.IR-02.265? (Ex2)

[Assistant] Include protection from environmental threats and provisions for adequate operating infrastructure in requirements for service providers that operate systems on the organization's behalf


[User] Explain PR.IR-02.265.

[Assistant] Include protection from environmental threats and provisions for adequate operating infrastructure in requirements for service providers that operate systems on the organization's behalf


[User] What is PR.IR-03?

[Assistant] Mechanisms are implemented to achieve resilience requirements in normal and adverse situations


[User] Explain the requirement of PR.IR-03.

[Assistant] Mechanisms are implemented to achieve resilience requirements in normal and adverse situations


[User] What outcome is expected by PR.IR-03?

[Assistant] Mechanisms are implemented to achieve resilience requirements in normal and adverse situations


[User] What is first? (1st)

[Assistant] 1st Party Risk


[User] Explain first.

[Assistant] 1st Party Risk


[User] What is PR.IR-03.266? (Ex1)

[Assistant] Avoid single points of failure in systems and infrastructure


[User] Explain PR.IR-03.266.

[Assistant] Avoid single points of failure in systems and infrastructure


[User] What is PR.IR-03.267? (Ex2)

[Assistant] Use load balancing to increase capacity and improve reliability


[User] Explain PR.IR-03.267.

[Assistant] Use load balancing to increase capacity and improve reliability


[User] What is PR.IR-03.268? (Ex3)

[Assistant] Use high-availability components like redundant storage and power supplies to improve system reliability


[User] Explain PR.IR-03.268.

[Assistant] Use high-availability components like redundant storage and power supplies to improve system reliability


[User] What is PR.IR-04?

[Assistant] Adequate resource capacity to ensure availability is maintained


[User] Explain the requirement of PR.IR-04.

[Assistant] Adequate resource capacity to ensure availability is maintained


[User] What outcome is expected by PR.IR-04?

[Assistant] Adequate resource capacity to ensure availability is maintained


[User] What is PR.IR-04.269? (Ex1)

[Assistant] Monitor usage of storage, power, compute, network bandwidth, and other resources


[User] Explain PR.IR-04.269.

[Assistant] Monitor usage of storage, power, compute, network bandwidth, and other resources


[User] What is PR.IR-04.270? (Ex2)

[Assistant] Forecast future needs, and scale resources accordingly


[User] Explain PR.IR-04.270.

[Assistant] Forecast future needs, and scale resources accordingly


[User] What is PR.AC-01?

[Assistant] Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users and processes


[User] Explain the requirement of PR.AC-01.

[Assistant] Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users and processes


[User] What outcome is expected by PR.AC-01?

[Assistant] Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users and processes


[User] What is WR-PR.AC-01?

[Assistant] Incorporated into PR.AA-01, PR.AA-05


[User] Explain WR-PR.AC-01.

[Assistant] Incorporated into PR.AA-01, PR.AA-05


[User] What is PR.AC-02?

[Assistant] Physical access to assets is managed and protected


[User] Explain the requirement of PR.AC-02.

[Assistant] Physical access to assets is managed and protected


[User] What outcome is expected by PR.AC-02?

[Assistant] Physical access to assets is managed and protected


[User] What is WR-PR.AC-02?

[Assistant] Moved to PR.AA-06


[User] Explain WR-PR.AC-02.

[Assistant] Moved to PR.AA-06


[User] What is PR.AC-03?

[Assistant] Remote access is managed


[User] Explain the requirement of PR.AC-03.

[Assistant] Remote access is managed


[User] What outcome is expected by PR.AC-03?

[Assistant] Remote access is managed


[User] What is WR-PR.AC-03?

[Assistant] Incorporated into PR.AA-03, PR.AA-05, PR.IR-01


[User] Explain WR-PR.AC-03.

[Assistant] Incorporated into PR.AA-03, PR.AA-05, PR.IR-01


[User] What is PR.AC-04?

[Assistant] Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties


[User] Explain the requirement of PR.AC-04.

[Assistant] Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties


[User] What outcome is expected by PR.AC-04?

[Assistant] Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties


[User] What is WR-PR.AC-04?

[Assistant] Moved to PR.AA-05


[User] Explain WR-PR.AC-04.

[Assistant] Moved to PR.AA-05


[User] What is PR.AC-05?

[Assistant] Network integrity is protected (e.g., network segregation, network segmentation)


[User] Explain the requirement of PR.AC-05.

[Assistant] Network integrity is protected (e.g., network segregation, network segmentation)


[User] What outcome is expected by PR.AC-05?

[Assistant] Network integrity is protected (e.g., network segregation, network segmentation)


[User] What is WR-PR.AC-05?

[Assistant] Incorporated into PR.IR-01


[User] Explain WR-PR.AC-05.

[Assistant] Incorporated into PR.IR-01


[User] What is PR.AC-06?

[Assistant] Identities are proofed and bound to credentials and asserted in interactions


[User] Explain the requirement of PR.AC-06.

[Assistant] Identities are proofed and bound to credentials and asserted in interactions


[User] What outcome is expected by PR.AC-06?

[Assistant] Identities are proofed and bound to credentials and asserted in interactions


[User] What is WR-PR.AC-06?

[Assistant] Moved to PR.AA-02


[User] Explain WR-PR.AC-06.

[Assistant] Moved to PR.AA-02


[User] What is PR.AC-07?

[Assistant] Users, devices, and other assets are authenticated (e.g., single-factor, multi-factor) commensurate with the risk of the transaction (e.g., individuals’ security and privacy risks and other organizational risks)


[User] Explain the requirement of PR.AC-07.

[Assistant] Users, devices, and other assets are authenticated (e.g., single-factor, multi-factor) commensurate with the risk of the transaction (e.g., individuals’ security and privacy risks and other organizational risks)


[User] What outcome is expected by PR.AC-07?

[Assistant] Users, devices, and other assets are authenticated (e.g., single-factor, multi-factor) commensurate with the risk of the transaction (e.g., individuals’ security and privacy risks and other organizational risks)


[User] What is WR-PR.AC-07?

[Assistant] Moved to PR.AA-03


[User] Explain WR-PR.AC-07.

[Assistant] Moved to PR.AA-03


[User] What is WR-PR.AC?

[Assistant] Moved to PR.AA


[User] Explain WR-PR.AC.

[Assistant] Moved to PR.AA


[User] What is PR.IP-01?

[Assistant] A baseline configuration of information technology/industrial control systems is created and maintained incorporating security principles (e.g. concept of least functionality)


[User] Explain the requirement of PR.IP-01.

[Assistant] A baseline configuration of information technology/industrial control systems is created and maintained incorporating security principles (e.g. concept of least functionality)


[User] What outcome is expected by PR.IP-01?

[Assistant] A baseline configuration of information technology/industrial control systems is created and maintained incorporating security principles (e.g. concept of least functionality)


[User] What is WR-PR.IP-01?

[Assistant] Incorporated into PR.PS-01


[User] Explain WR-PR.IP-01.

[Assistant] Incorporated into PR.PS-01


[User] What is PR.IP-02?

[Assistant] A System Development Life Cycle to manage systems is implemented


[User] Explain the requirement of PR.IP-02.

[Assistant] A System Development Life Cycle to manage systems is implemented


[User] What outcome is expected by PR.IP-02?

[Assistant] A System Development Life Cycle to manage systems is implemented


[User] What is WR-PR.IP-02?

[Assistant] Incorporated into ID.AM-08, PR.PS-06


[User] Explain WR-PR.IP-02.

[Assistant] Incorporated into ID.AM-08, PR.PS-06


[User] What is PR.IP-03?

[Assistant] Configuration change control processes are in place


[User] Explain the requirement of PR.IP-03.

[Assistant] Configuration change control processes are in place


[User] What outcome is expected by PR.IP-03?

[Assistant] Configuration change control processes are in place


[User] What is WR-PR.IP-03?

[Assistant] Incorporated into PR.PS-01, ID.RA-07


[User] Explain WR-PR.IP-03.

[Assistant] Incorporated into PR.PS-01, ID.RA-07


[User] What is PR.IP-04?

[Assistant] Backups of information are conducted, maintained, and tested


[User] Explain the requirement of PR.IP-04.

[Assistant] Backups of information are conducted, maintained, and tested


[User] What outcome is expected by PR.IP-04?

[Assistant] Backups of information are conducted, maintained, and tested


[User] What is WR-PR.IP-04?

[Assistant] Moved to PR.DS-11


[User] Explain WR-PR.IP-04.

[Assistant] Moved to PR.DS-11


[User] What is PR.IP-05?

[Assistant] Policy and regulations regarding the physical operating environment for organizational assets are met


[User] Explain the requirement of PR.IP-05.

[Assistant] Policy and regulations regarding the physical operating environment for organizational assets are met


[User] What outcome is expected by PR.IP-05?

[Assistant] Policy and regulations regarding the physical operating environment for organizational assets are met


[User] What is WR-PR.IP-05?

[Assistant] Moved to PR.IR-02


[User] Explain WR-PR.IP-05.

[Assistant] Moved to PR.IR-02


[User] What is PR.IP-06?

[Assistant] Data is destroyed according to policy


[User] Explain the requirement of PR.IP-06.

[Assistant] Data is destroyed according to policy


[User] What outcome is expected by PR.IP-06?

[Assistant] Data is destroyed according to policy


[User] What is WR-PR.IP-06?

[Assistant] Incorporated into ID.AM-08


[User] Explain WR-PR.IP-06.

[Assistant] Incorporated into ID.AM-08


[User] What is PR.IP-07?

[Assistant] Protection processes are improved


[User] Explain the requirement of PR.IP-07.

[Assistant] Protection processes are improved


[User] What outcome is expected by PR.IP-07?

[Assistant] Protection processes are improved


[User] What is WR-PR.IP-07?

[Assistant] Incorporated into ID.IM, ID.IM-03


[User] Explain WR-PR.IP-07.

[Assistant] Incorporated into ID.IM, ID.IM-03


[User] What is PR.IP-08?

[Assistant] Effectiveness of protection technologies is shared


[User] Explain the requirement of PR.IP-08.

[Assistant] Effectiveness of protection technologies is shared


[User] What outcome is expected by PR.IP-08?

[Assistant] Effectiveness of protection technologies is shared


[User] What is WR-PR.IP-08?

[Assistant] Moved to ID.IM-03


[User] Explain WR-PR.IP-08.

[Assistant] Moved to ID.IM-03


[User] What is PR.IP-09?

[Assistant] Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed


[User] Explain the requirement of PR.IP-09.

[Assistant] Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed


[User] What outcome is expected by PR.IP-09?

[Assistant] Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed


[User] What is WR-PR.IP-09?

[Assistant] Moved to ID.IM-04


[User] Explain WR-PR.IP-09.

[Assistant] Moved to ID.IM-04


[User] What is PR.IP-10?

[Assistant] Response and recovery plans are tested


[User] Explain the requirement of PR.IP-10.

[Assistant] Response and recovery plans are tested


[User] What outcome is expected by PR.IP-10?

[Assistant] Response and recovery plans are tested


[User] What is WR-PR.IP-10?

[Assistant] Incorporated into ID.IM-02, ID.IM-04


[User] Explain WR-PR.IP-10.

[Assistant] Incorporated into ID.IM-02, ID.IM-04


[User] What is PR.IP-11?

[Assistant] Cybersecurity is included in human resources practices (e.g., deprovisioning, personnel screening)


[User] Explain the requirement of PR.IP-11.

[Assistant] Cybersecurity is included in human resources practices (e.g., deprovisioning, personnel screening)


[User] What outcome is expected by PR.IP-11?

[Assistant] Cybersecurity is included in human resources practices (e.g., deprovisioning, personnel screening)


[User] What is WR-PR.IP-11?

[Assistant] Moved to GV.RR-04


[User] Explain WR-PR.IP-11.

[Assistant] Moved to GV.RR-04


[User] What is PR.IP-12?

[Assistant] A vulnerability management plan is developed and implemented


[User] Explain the requirement of PR.IP-12.

[Assistant] A vulnerability management plan is developed and implemented


[User] What outcome is expected by PR.IP-12?

[Assistant] A vulnerability management plan is developed and implemented


[User] What is WR-PR.IP-12?

[Assistant] Incorporated into ID.RA-01, PR.PS-02


[User] Explain WR-PR.IP-12.

[Assistant] Incorporated into ID.RA-01, PR.PS-02


[User] What is WR-PR.IP?

[Assistant] Incorporated into other Categories and Functions


[User] Explain WR-PR.IP.

[Assistant] Incorporated into other Categories and Functions


[User] What is PR.MA-01?

[Assistant] Maintenance and repair of organizational assets are performed and logged, with approved and controlled tools


[User] Explain the requirement of PR.MA-01.

[Assistant] Maintenance and repair of organizational assets are performed and logged, with approved and controlled tools


[User] What outcome is expected by PR.MA-01?

[Assistant] Maintenance and repair of organizational assets are performed and logged, with approved and controlled tools


[User] What is WR-PR.MA-01?

[Assistant] Incorporated into ID.AM-08, PR.PS-03


[User] Explain WR-PR.MA-01.

[Assistant] Incorporated into ID.AM-08, PR.PS-03


[User] What is PR.MA-02?

[Assistant] Remote maintenance of organizational assets is approved, logged, and performed in a manner that prevents unauthorized access


[User] Explain the requirement of PR.MA-02.

[Assistant] Remote maintenance of organizational assets is approved, logged, and performed in a manner that prevents unauthorized access


[User] What outcome is expected by PR.MA-02?

[Assistant] Remote maintenance of organizational assets is approved, logged, and performed in a manner that prevents unauthorized access


[User] What is WR-PR.MA-02?

[Assistant] Incorporated into ID.AM-08, PR.PS-02


[User] Explain WR-PR.MA-02.

[Assistant] Incorporated into ID.AM-08, PR.PS-02


[User] What is WR-PR.MA?

[Assistant] Incorporated into ID.AM-08


[User] Explain WR-PR.MA.

[Assistant] Incorporated into ID.AM-08


[User] What is PR.PT-01?

[Assistant] Audit/log records are determined, documented, implemented, and reviewed in accordance with policy


[User] Explain the requirement of PR.PT-01.

[Assistant] Audit/log records are determined, documented, implemented, and reviewed in accordance with policy


[User] What outcome is expected by PR.PT-01?

[Assistant] Audit/log records are determined, documented, implemented, and reviewed in accordance with policy


[User] What is WR-PR.PT-01?

[Assistant] Incorporated into PR.PS-04


[User] Explain WR-PR.PT-01.

[Assistant] Incorporated into PR.PS-04


[User] What is PR.PT-02?

[Assistant] Removable media is protected and its use restricted according to policy


[User] Explain the requirement of PR.PT-02.

[Assistant] Removable media is protected and its use restricted according to policy


[User] What outcome is expected by PR.PT-02?

[Assistant] Removable media is protected and its use restricted according to policy


[User] What is WR-PR.PT-02?

[Assistant] Incorporated into PR.DS-01, PR.PS-01


[User] Explain WR-PR.PT-02.

[Assistant] Incorporated into PR.DS-01, PR.PS-01


[User] What is PR.PT-03?

[Assistant] The principle of least functionality is incorporated by configuring systems to provide only essential capabilities


[User] Explain the requirement of PR.PT-03.

[Assistant] The principle of least functionality is incorporated by configuring systems to provide only essential capabilities


[User] What outcome is expected by PR.PT-03?

[Assistant] The principle of least functionality is incorporated by configuring systems to provide only essential capabilities


[User] What is WR-PR.PT-03?

[Assistant] Incorporated into PR.PS-01


[User] Explain WR-PR.PT-03.

[Assistant] Incorporated into PR.PS-01


[User] What is PR.PT-04?

[Assistant] Communications and control networks are protected


[User] Explain the requirement of PR.PT-04.

[Assistant] Communications and control networks are protected


[User] What outcome is expected by PR.PT-04?

[Assistant] Communications and control networks are protected


[User] What is WR-PR.PT-04?

[Assistant] Incorporated into PR.AA-06, PR.IR-01


[User] Explain WR-PR.PT-04.

[Assistant] Incorporated into PR.AA-06, PR.IR-01


[User] What is PR.PT-05?

[Assistant] Mechanisms (e.g., failsafe, load balancing, hot swap) are implemented to achieve resilience requirements in normal and adverse situations


[User] Explain the requirement of PR.PT-05.

[Assistant] Mechanisms (e.g., failsafe, load balancing, hot swap) are implemented to achieve resilience requirements in normal and adverse situations


[User] What outcome is expected by PR.PT-05?

[Assistant] Mechanisms (e.g., failsafe, load balancing, hot swap) are implemented to achieve resilience requirements in normal and adverse situations


[User] What is WR-PR.PT-05?

[Assistant] Moved to PR.IR-03


[User] Explain WR-PR.PT-05.

[Assistant] Moved to PR.IR-03


[User] What is WR-PR.PT?

[Assistant] Incorporated into other Protect Categories


[User] Explain WR-PR.PT.

[Assistant] Incorporated into other Protect Categories


[User] What is DE? (DETECT)

[Assistant] Possible cybersecurity attacks and compromises are found and analyzed


[User] Summarize the scope of DE.

[Assistant] Possible cybersecurity attacks and compromises are found and analyzed


[User] What does DE cover?

[Assistant] Possible cybersecurity attacks and compromises are found and analyzed


[User] What is DE.CM? (Continuous Monitoring)

[Assistant] Assets are monitored to find anomalies, indicators of compromise, and other potentially adverse events


[User] Summarize the scope of DE.CM.

[Assistant] Assets are monitored to find anomalies, indicators of compromise, and other potentially adverse events


[User] What does DE.CM cover?

[Assistant] Assets are monitored to find anomalies, indicators of compromise, and other potentially adverse events


[User] What is DE.CM-01?

[Assistant] Networks and network services are monitored to find potentially adverse events


[User] Explain the requirement of DE.CM-01.

[Assistant] Networks and network services are monitored to find potentially adverse events


[User] What outcome is expected by DE.CM-01?

[Assistant] Networks and network services are monitored to find potentially adverse events


[User] What is DE.CM-01.271? (Ex1)

[Assistant] Monitor DNS, BGP, and other network services for adverse events


[User] Explain DE.CM-01.271.

[Assistant] Monitor DNS, BGP, and other network services for adverse events


[User] What is DE.CM-01.272? (Ex2)

[Assistant] Monitor wired and wireless networks for connections from unauthorized endpoints


[User] Explain DE.CM-01.272.

[Assistant] Monitor wired and wireless networks for connections from unauthorized endpoints


[User] What is DE.CM-01.273? (Ex3)

[Assistant] Monitor facilities for unauthorized or rogue wireless networks


[User] Explain DE.CM-01.273.

[Assistant] Monitor facilities for unauthorized or rogue wireless networks


[User] What is DE.CM-01.274? (Ex4)

[Assistant] Compare actual network flows against baselines to detect deviations


[User] Explain DE.CM-01.274.

[Assistant] Compare actual network flows against baselines to detect deviations


[User] What is DE.CM-01.275? (Ex5)

[Assistant] Monitor network communications to identify changes in security postures for zero trust purposes


[User] Explain DE.CM-01.275.

[Assistant] Monitor network communications to identify changes in security postures for zero trust purposes


[User] What is first? (1st)

[Assistant] 1st Party Risk


[User] Explain first.

[Assistant] 1st Party Risk


[User] What is DE.CM-02?

[Assistant] The physical environment is monitored to find potentially adverse events


[User] Explain the requirement of DE.CM-02.

[Assistant] The physical environment is monitored to find potentially adverse events


[User] What outcome is expected by DE.CM-02?

[Assistant] The physical environment is monitored to find potentially adverse events


[User] What is DE.CM-02.276? (Ex1)

[Assistant] Monitor logs from physical access control systems (e.g., badge readers) to find unusual access patterns (e.g., deviations from the norm) and failed access attempts


[User] Explain DE.CM-02.276.

[Assistant] Monitor logs from physical access control systems (e.g., badge readers) to find unusual access patterns (e.g., deviations from the norm) and failed access attempts


[User] What is DE.CM-02.277? (Ex2)

[Assistant] Review and monitor physical access records (e.g., from visitor registration, sign-in sheets)


[User] Explain DE.CM-02.277.

[Assistant] Review and monitor physical access records (e.g., from visitor registration, sign-in sheets)


[User] What is DE.CM-02.278? (Ex3)

[Assistant] Monitor physical access controls (e.g., locks, latches, hinge pins, alarms) for signs of tampering


[User] Explain DE.CM-02.278.

[Assistant] Monitor physical access controls (e.g., locks, latches, hinge pins, alarms) for signs of tampering


[User] What is DE.CM-02.279? (Ex4)

[Assistant] Monitor the physical environment using alarm systems, cameras, and security guards


[User] Explain DE.CM-02.279.

[Assistant] Monitor the physical environment using alarm systems, cameras, and security guards


[User] What is first? (1st)

[Assistant] 1st Party Risk


[User] Explain first.

[Assistant] 1st Party Risk


[User] What is DE.CM-03?

[Assistant] Personnel activity and technology usage are monitored to find potentially adverse events


[User] Explain the requirement of DE.CM-03.

[Assistant] Personnel activity and technology usage are monitored to find potentially adverse events


[User] What outcome is expected by DE.CM-03?

[Assistant] Personnel activity and technology usage are monitored to find potentially adverse events


[User] What is DE.CM-03.280? (Ex1)

[Assistant] Use behavior analytics software to detect anomalous user activity to mitigate insider threats


[User] Explain DE.CM-03.280.

[Assistant] Use behavior analytics software to detect anomalous user activity to mitigate insider threats


[User] What is DE.CM-03.281? (Ex2)

[Assistant] Monitor logs from logical access control systems to find unusual access patterns and failed access attempts


[User] Explain DE.CM-03.281.

[Assistant] Monitor logs from logical access control systems to find unusual access patterns and failed access attempts


[User] What is DE.CM-03.282? (Ex3)

[Assistant] Continuously monitor deception technology, including user accounts, for any usage


[User] Explain DE.CM-03.282.

[Assistant] Continuously monitor deception technology, including user accounts, for any usage


[User] What is first? (1st)

[Assistant] 1st Party Risk


[User] Explain first.

[Assistant] 1st Party Risk


[User] What is DE.CM-04?

[Assistant] Malicious code is detected


[User] Explain the requirement of DE.CM-04.

[Assistant] Malicious code is detected


[User] What outcome is expected by DE.CM-04?

[Assistant] Malicious code is detected


[User] What is WR-DE.CM-04?

[Assistant] Incorporated into DE.CM-01, DE.CM-09


[User] Explain WR-DE.CM-04.

[Assistant] Incorporated into DE.CM-01, DE.CM-09


[User] What is DE.CM-05?

[Assistant] Unauthorized mobile code is detected


[User] Explain the requirement of DE.CM-05.

[Assistant] Unauthorized mobile code is detected


[User] What outcome is expected by DE.CM-05?

[Assistant] Unauthorized mobile code is detected


[User] What is WR-DE.CM-05?

[Assistant] Incorporated into DE.CM-01, DE.CM-09


[User] Explain WR-DE.CM-05.

[Assistant] Incorporated into DE.CM-01, DE.CM-09


[User] What is DE.CM-06?

[Assistant] External service provider activities and services are monitored to find potentially adverse events


[User] Explain the requirement of DE.CM-06.

[Assistant] External service provider activities and services are monitored to find potentially adverse events


[User] What outcome is expected by DE.CM-06?

[Assistant] External service provider activities and services are monitored to find potentially adverse events


[User] What is DE.CM-06.283? (Ex1)

[Assistant] Monitor remote and onsite administration and maintenance activities that external providers perform on organizational systems


[User] Explain DE.CM-06.283.

[Assistant] Monitor remote and onsite administration and maintenance activities that external providers perform on organizational systems


[User] What is DE.CM-06.284? (Ex2)

[Assistant] Monitor activity from cloud-based services, internet service providers, and other service providers for deviations from expected behavior


[User] Explain DE.CM-06.284.

[Assistant] Monitor activity from cloud-based services, internet service providers, and other service providers for deviations from expected behavior


[User] What is third? (3rd)

[Assistant] 3rd Party Risk


[User] Explain third.

[Assistant] 3rd Party Risk


[User] What is DE.CM-07?

[Assistant] Monitoring for unauthorized personnel, connections, devices, and software is performed


[User] Explain the requirement of DE.CM-07.

[Assistant] Monitoring for unauthorized personnel, connections, devices, and software is performed


[User] What outcome is expected by DE.CM-07?

[Assistant] Monitoring for unauthorized personnel, connections, devices, and software is performed


[User] What is WR-DE.CM-07?

[Assistant] Incorporated into DE.CM-01, DE.CM-03, DE.CM-06, DE.CM-09


[User] Explain WR-DE.CM-07.

[Assistant] Incorporated into DE.CM-01, DE.CM-03, DE.CM-06, DE.CM-09


[User] What is DE.CM-08?

[Assistant] Vulnerability scans are performed


[User] Explain the requirement of DE.CM-08.

[Assistant] Vulnerability scans are performed


[User] What outcome is expected by DE.CM-08?

[Assistant] Vulnerability scans are performed


[User] What is WR-DE.CM-08?

[Assistant] Incorporated into ID.RA-01


[User] Explain WR-DE.CM-08.

[Assistant] Incorporated into ID.RA-01


[User] What is DE.CM-09?

[Assistant] Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events


[User] Explain the requirement of DE.CM-09.

[Assistant] Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events


[User] What outcome is expected by DE.CM-09?

[Assistant] Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events


[User] What is DE.CM-09.285? (Ex1)

[Assistant] Monitor email, web, file sharing, collaboration services, and other common attack vectors to detect malware, phishing, data leaks and exfiltration, and other adverse events


[User] Explain DE.CM-09.285.

[Assistant] Monitor email, web, file sharing, collaboration services, and other common attack vectors to detect malware, phishing, data leaks and exfiltration, and other adverse events


[User] What is DE.CM-09.286? (Ex2)

[Assistant] Monitor authentication attempts to identify attacks against credentials and unauthorized credential reuse


[User] Explain DE.CM-09.286.

[Assistant] Monitor authentication attempts to identify attacks against credentials and unauthorized credential reuse


[User] What is DE.CM-09.287? (Ex3)

[Assistant] Monitor software configurations for deviations from security baselines


[User] Explain DE.CM-09.287.

[Assistant] Monitor software configurations for deviations from security baselines


[User] What is DE.CM-09.288? (Ex4)

[Assistant] Monitor hardware and software for signs of tampering


[User] Explain DE.CM-09.288.

[Assistant] Monitor hardware and software for signs of tampering


[User] What is DE.CM-09.289? (Ex5)

[Assistant] Use technologies with a presence on endpoints to detect cyber health issues (e.g., missing patches, malware infections, unauthorized software), and redirect the endpoints to a remediation environment before access is authorized


[User] Explain DE.CM-09.289.

[Assistant] Use technologies with a presence on endpoints to detect cyber health issues (e.g., missing patches, malware infections, unauthorized software), and redirect the endpoints to a remediation environment before access is authorized


[User] What is first? (1st)

[Assistant] 1st Party Risk


[User] Explain first.

[Assistant] 1st Party Risk


[User] What is DE.AE? (Adverse Event Analysis)

[Assistant] Anomalies, indicators of compromise, and other potentially adverse events are analyzed to characterize the events and detect cybersecurity incidents


[User] Summarize the scope of DE.AE.

[Assistant] Anomalies, indicators of compromise, and other potentially adverse events are analyzed to characterize the events and detect cybersecurity incidents


[User] What does DE.AE cover?

[Assistant] Anomalies, indicators of compromise, and other potentially adverse events are analyzed to characterize the events and detect cybersecurity incidents


[User] What is DE.AE-01?

[Assistant] A baseline of network operations and expected data flows for users and systems is established and managed


[User] Explain the requirement of DE.AE-01.

[Assistant] A baseline of network operations and expected data flows for users and systems is established and managed


[User] What outcome is expected by DE.AE-01?

[Assistant] A baseline of network operations and expected data flows for users and systems is established and managed


[User] What is WR-DE.AE-01?

[Assistant] Incorporated into ID.AM-03


[User] Explain WR-DE.AE-01.

[Assistant] Incorporated into ID.AM-03


[User] What is DE.AE-02?

[Assistant] Potentially adverse events are analyzed to better understand associated activities


[User] Explain the requirement of DE.AE-02.

[Assistant] Potentially adverse events are analyzed to better understand associated activities


[User] What outcome is expected by DE.AE-02?

[Assistant] Potentially adverse events are analyzed to better understand associated activities


[User] What is DE.AE-02.290? (Ex1)

[Assistant] Use security information and event management (SIEM) or other tools to continuously monitor log events for known malicious and suspicious activity


[User] Explain DE.AE-02.290.

[Assistant] Use security information and event management (SIEM) or other tools to continuously monitor log events for known malicious and suspicious activity


[User] What is DE.AE-02.291? (Ex2)

[Assistant] Utilize up-to-date cyber threat intelligence in log analysis tools to improve detection accuracy and characterize threat actors, their methods, and indicators of compromise


[User] Explain DE.AE-02.291.

[Assistant] Utilize up-to-date cyber threat intelligence in log analysis tools to improve detection accuracy and characterize threat actors, their methods, and indicators of compromise


[User] What is DE.AE-02.292? (Ex3)

[Assistant] Regularly conduct manual reviews of log events for technologies that cannot be sufficiently monitored through automation


[User] Explain DE.AE-02.292.

[Assistant] Regularly conduct manual reviews of log events for technologies that cannot be sufficiently monitored through automation


[User] What is DE.AE-02.293? (Ex4)

[Assistant] Use log analysis tools to generate reports on their findings


[User] Explain DE.AE-02.293.

[Assistant] Use log analysis tools to generate reports on their findings


[User] What is first? (1st)

[Assistant] 1st Party Risk


[User] Explain first.

[Assistant] 1st Party Risk


[User] What is DE.AE-03?

[Assistant] Information is correlated from multiple sources


[User] Explain the requirement of DE.AE-03.

[Assistant] Information is correlated from multiple sources


[User] What outcome is expected by DE.AE-03?

[Assistant] Information is correlated from multiple sources


[User] What is DE.AE-03.294? (Ex1)

[Assistant] Constantly transfer log data generated by other sources to a relatively small number of log servers


[User] Explain DE.AE-03.294.

[Assistant] Constantly transfer log data generated by other sources to a relatively small number of log servers


[User] What is DE.AE-03.295? (Ex2)

[Assistant] Use event correlation technology (e.g., SIEM) to collect information captured by multiple sources


[User] Explain DE.AE-03.295.

[Assistant] Use event correlation technology (e.g., SIEM) to collect information captured by multiple sources


[User] What is DE.AE-03.296? (Ex3)

[Assistant] Utilize cyber threat intelligence to help correlate events among log sources


[User] Explain DE.AE-03.296.

[Assistant] Utilize cyber threat intelligence to help correlate events among log sources


[User] What is first? (1st)

[Assistant] 1st Party Risk


[User] Explain first.

[Assistant] 1st Party Risk


[User] What is DE.AE-04?

[Assistant] The estimated impact and scope of adverse events are understood


[User] Explain the requirement of DE.AE-04.

[Assistant] The estimated impact and scope of adverse events are understood


[User] What outcome is expected by DE.AE-04?

[Assistant] The estimated impact and scope of adverse events are understood


[User] What is DE.AE-04.297? (Ex1)

[Assistant] Use SIEMs or other tools to estimate impact and scope, and review and refine the estimates


[User] Explain DE.AE-04.297.

[Assistant] Use SIEMs or other tools to estimate impact and scope, and review and refine the estimates


[User] What is DE.AE-04.298? (Ex2)

[Assistant] A person creates their own estimates of impact and scope


[User] Explain DE.AE-04.298.

[Assistant] A person creates their own estimates of impact and scope


[User] What is first? (1st)

[Assistant] 1st Party Risk


[User] Explain first.

[Assistant] 1st Party Risk


[User] What is DE.AE-05?

[Assistant] Incident alert thresholds are established


[User] Explain the requirement of DE.AE-05.

[Assistant] Incident alert thresholds are established