[User] What is GV.SC-07.099? (Ex2)

[Assistant] Evaluate third parties' evidence of compliance with contractual cybersecurity requirements, such as self-attestations, warranties, certifications, and other artifacts


[User] Explain GV.SC-07.099.

[Assistant] Evaluate third parties' evidence of compliance with contractual cybersecurity requirements, such as self-attestations, warranties, certifications, and other artifacts


[User] What is GV.SC-07.100? (Ex3)

[Assistant] Monitor critical suppliers to ensure that they are fulfilling their security obligations throughout the supplier relationship lifecycle using a variety of methods and techniques, such as inspections, audits, tests, or other forms of evaluation


[User] Explain GV.SC-07.100.

[Assistant] Monitor critical suppliers to ensure that they are fulfilling their security obligations throughout the supplier relationship lifecycle using a variety of methods and techniques, such as inspections, audits, tests, or other forms of evaluation


[User] What is GV.SC-07.101? (Ex4)

[Assistant] Monitor critical suppliers, services, and products for changes to their risk profiles, and reevaluate supplier criticality and risk impact accordingly


[User] Explain GV.SC-07.101.

[Assistant] Monitor critical suppliers, services, and products for changes to their risk profiles, and reevaluate supplier criticality and risk impact accordingly


[User] What is GV.SC-07.102? (Ex5)

[Assistant] Plan for unexpected supplier and supply chain-related interruptions to ensure business continuity


[User] Explain GV.SC-07.102.

[Assistant] Plan for unexpected supplier and supply chain-related interruptions to ensure business continuity


[User] What is GV.SC-08.103? (Ex1)

[Assistant] Define and use rules and protocols for reporting incident response and recovery activities and the status between the organization and its suppliers


[User] Explain GV.SC-08.103.

[Assistant] Define and use rules and protocols for reporting incident response and recovery activities and the status between the organization and its suppliers


[User] What is GV.SC-08.104? (Ex2)

[Assistant] Identify and document the roles and responsibilities of the organization and its suppliers for incident response


[User] Explain GV.SC-08.104.

[Assistant] Identify and document the roles and responsibilities of the organization and its suppliers for incident response


[User] What is GV.SC-08.105? (Ex3)

[Assistant] Include critical suppliers in incident response exercises and simulations


[User] Explain GV.SC-08.105.

[Assistant] Include critical suppliers in incident response exercises and simulations


[User] What is GV.SC-08.106? (Ex4)

[Assistant] Define and coordinate crisis communication methods and protocols between the organization and its critical suppliers


[User] Explain GV.SC-08.106.

[Assistant] Define and coordinate crisis communication methods and protocols between the organization and its critical suppliers


[User] What is GV.SC-08.107? (Ex5)

[Assistant] Conduct collaborative lessons learned sessions with critical suppliers


[User] Explain GV.SC-08.107.

[Assistant] Conduct collaborative lessons learned sessions with critical suppliers


[User] What is GV.SC-09.108? (Ex1)

[Assistant] Policies and procedures require provenance records for all acquired technology products and services


[User] Explain GV.SC-09.108.

[Assistant] Policies and procedures require provenance records for all acquired technology products and services


[User] What is GV.SC-09.109? (Ex2)

[Assistant] Periodically provide risk reporting to leaders about how acquired components are proven to be untampered and authentic


[User] Explain GV.SC-09.109.

[Assistant] Periodically provide risk reporting to leaders about how acquired components are proven to be untampered and authentic


[User] What is GV.SC-09.110? (Ex3)

[Assistant] Communicate regularly among cybersecurity risk managers and operations personnel about the need to acquire software patches, updates, and upgrades only from authenticated and trustworthy software providers


[User] Explain GV.SC-09.110.

[Assistant] Communicate regularly among cybersecurity risk managers and operations personnel about the need to acquire software patches, updates, and upgrades only from authenticated and trustworthy software providers


[User] What is GV.SC-09.111? (Ex4)

[Assistant] Review policies to ensure that they require approved supplier personnel to perform maintenance on supplier products


[User] Explain GV.SC-09.111.

[Assistant] Review policies to ensure that they require approved supplier personnel to perform maintenance on supplier products


[User] What is GV.SC-09.112? (Ex5)

[Assistant] Policies and procedure require checking upgrades to critical hardware for unauthorized changes


[User] Explain GV.SC-09.112.

[Assistant] Policies and procedure require checking upgrades to critical hardware for unauthorized changes


[User] What is GV.SC-10.113? (Ex1)

[Assistant] Establish processes for terminating critical relationships under both normal and adverse circumstances


[User] Explain GV.SC-10.113.

[Assistant] Establish processes for terminating critical relationships under both normal and adverse circumstances


[User] What is GV.SC-10.114? (Ex2)

[Assistant] Define and implement plans for component end-of-life maintenance support and obsolescence


[User] Explain GV.SC-10.114.

[Assistant] Define and implement plans for component end-of-life maintenance support and obsolescence


[User] What is GV.SC-10.115? (Ex3)

[Assistant] Verify that supplier access to organization resources is deactivated promptly when it is no longer needed


[User] Explain GV.SC-10.115.

[Assistant] Verify that supplier access to organization resources is deactivated promptly when it is no longer needed


[User] What is GV.SC-10.116? (Ex4)

[Assistant] Verify that assets containing the organization's data are returned or properly disposed of in a timely, controlled, and safe manner


[User] Explain GV.SC-10.116.

[Assistant] Verify that assets containing the organization's data are returned or properly disposed of in a timely, controlled, and safe manner


[User] What is GV.SC-10.117? (Ex5)

[Assistant] Develop and execute a plan for terminating or transitioning supplier relationships that takes supply chain security risk and resiliency into account


[User] Explain GV.SC-10.117.

[Assistant] Develop and execute a plan for terminating or transitioning supplier relationships that takes supply chain security risk and resiliency into account


[User] What is GV.SC-10.118? (Ex6)

[Assistant] Mitigate risks to data and systems created by supplier termination


[User] Explain GV.SC-10.118.

[Assistant] Mitigate risks to data and systems created by supplier termination


[User] What is GV.SC-10.119? (Ex7)

[Assistant] Manage data leakage risks associated with supplier termination


[User] Explain GV.SC-10.119.

[Assistant] Manage data leakage risks associated with supplier termination


[User] What is ID.AM-01.120? (Ex1)

[Assistant] Maintain inventories for all types of hardware, including IT, IoT, OT, and mobile devices


[User] Explain ID.AM-01.120.

[Assistant] Maintain inventories for all types of hardware, including IT, IoT, OT, and mobile devices


[User] What is ID.AM-01.121? (Ex2)

[Assistant] Constantly monitor networks to detect new hardware and automatically update inventories


[User] Explain ID.AM-01.121.

[Assistant] Constantly monitor networks to detect new hardware and automatically update inventories


[User] What is ID.AM-02.122? (Ex1)

[Assistant] Maintain inventories for all types of software and services, including commercial-off-the-shelf, open-source, custom applications, API services, and cloud-based applications and services


[User] Explain ID.AM-02.122.

[Assistant] Maintain inventories for all types of software and services, including commercial-off-the-shelf, open-source, custom applications, API services, and cloud-based applications and services


[User] What is ID.AM-02.123? (Ex2)

[Assistant] Constantly monitor all platforms, including containers and virtual machines, for software and service inventory changes


[User] Explain ID.AM-02.123.

[Assistant] Constantly monitor all platforms, including containers and virtual machines, for software and service inventory changes


[User] What is ID.AM-02.124? (Ex3)

[Assistant] Maintain an inventory of the organization's systems


[User] Explain ID.AM-02.124.

[Assistant] Maintain an inventory of the organization's systems


[User] What is ID.AM-03.125? (Ex1)

[Assistant] Maintain baselines of communication and data flows within the organization's wired and wireless networks


[User] Explain ID.AM-03.125.

[Assistant] Maintain baselines of communication and data flows within the organization's wired and wireless networks


[User] What is ID.AM-03.126? (Ex2)

[Assistant] Maintain baselines of communication and data flows between the organization and third parties


[User] Explain ID.AM-03.126.

[Assistant] Maintain baselines of communication and data flows between the organization and third parties


[User] What is ID.AM-03.127? (Ex3)

[Assistant] Maintain baselines of communication and data flows for the organization's infrastructure-as-a-service (IaaS) usage


[User] Explain ID.AM-03.127.

[Assistant] Maintain baselines of communication and data flows for the organization's infrastructure-as-a-service (IaaS) usage


[User] What is ID.AM-03.128? (Ex4)

[Assistant] Maintain documentation of expected network ports, protocols, and services that are typically used among authorized systems


[User] Explain ID.AM-03.128.

[Assistant] Maintain documentation of expected network ports, protocols, and services that are typically used among authorized systems


[User] What is ID.AM-04.129? (Ex1)

[Assistant] Inventory all external services used by the organization, including third-party infrastructure-as-a-service (IaaS), platform-as-a-service (PaaS), and software-as-a-service (SaaS) offerings; APIs; and other externally hosted application services


[User] Explain ID.AM-04.129.

[Assistant] Inventory all external services used by the organization, including third-party infrastructure-as-a-service (IaaS), platform-as-a-service (PaaS), and software-as-a-service (SaaS) offerings; APIs; and other externally hosted application services


[User] What is ID.AM-04.130? (Ex2)

[Assistant] Update the inventory when a new external service is going to be utilized to ensure adequate cybersecurity risk management monitoring of the organization's use of that service


[User] Explain ID.AM-04.130.

[Assistant] Update the inventory when a new external service is going to be utilized to ensure adequate cybersecurity risk management monitoring of the organization's use of that service


[User] What is ID.AM-05.131? (Ex1)

[Assistant] Define criteria for prioritizing each class of assets


[User] Explain ID.AM-05.131.

[Assistant] Define criteria for prioritizing each class of assets


[User] What is ID.AM-05.132? (Ex2)

[Assistant] Apply the prioritization criteria to assets


[User] Explain ID.AM-05.132.

[Assistant] Apply the prioritization criteria to assets


[User] What is ID.AM-05.133? (Ex3)

[Assistant] Track the asset priorities and update them periodically or when significant changes to the organization occur


[User] Explain ID.AM-05.133.

[Assistant] Track the asset priorities and update them periodically or when significant changes to the organization occur


[User] What is ID.AM-07.134? (Ex1)

[Assistant] Maintain a list of the designated data types of interest (e.g., personally identifiable information, protected health information, financial account numbers, organization intellectual property, operational technology data)


[User] Explain ID.AM-07.134.

[Assistant] Maintain a list of the designated data types of interest (e.g., personally identifiable information, protected health information, financial account numbers, organization intellectual property, operational technology data)


[User] What is ID.AM-07.135? (Ex2)

[Assistant] Continuously discover and analyze ad hoc data to identify new instances of designated data types


[User] Explain ID.AM-07.135.

[Assistant] Continuously discover and analyze ad hoc data to identify new instances of designated data types


[User] What is ID.AM-07.136? (Ex3)

[Assistant] Assign data classifications to designated data types through tags or labels


[User] Explain ID.AM-07.136.

[Assistant] Assign data classifications to designated data types through tags or labels


[User] What is ID.AM-07.137? (Ex4)

[Assistant] Track the provenance, data owner, and geolocation of each instance of designated data types


[User] Explain ID.AM-07.137.

[Assistant] Track the provenance, data owner, and geolocation of each instance of designated data types


[User] What is ID.AM-08.138? (Ex1)

[Assistant] Integrate cybersecurity considerations throughout the life cycles of systems, hardware, software, and services


[User] Explain ID.AM-08.138.

[Assistant] Integrate cybersecurity considerations throughout the life cycles of systems, hardware, software, and services


[User] What is ID.AM-08.139? (Ex2)

[Assistant] Integrate cybersecurity considerations into product life cycles


[User] Explain ID.AM-08.139.

[Assistant] Integrate cybersecurity considerations into product life cycles


[User] What is ID.AM-08.140? (Ex3)

[Assistant] Identify unofficial uses of technology to meet mission objectives (i.e., shadow IT)


[User] Explain ID.AM-08.140.

[Assistant] Identify unofficial uses of technology to meet mission objectives (i.e., shadow IT)


[User] What is ID.AM-08.141? (Ex4)

[Assistant] Periodically identify redundant systems, hardware, software, and services that unnecessarily increase the organization's attack surface


[User] Explain ID.AM-08.141.

[Assistant] Periodically identify redundant systems, hardware, software, and services that unnecessarily increase the organization's attack surface


[User] What is ID.AM-08.142? (Ex5)

[Assistant] Properly configure and secure systems, hardware, software, and services prior to their deployment in production


[User] Explain ID.AM-08.142.

[Assistant] Properly configure and secure systems, hardware, software, and services prior to their deployment in production


[User] What is ID.AM-08.143? (Ex6)

[Assistant] Update inventories when systems, hardware, software, and services are moved or transferred within the organization


[User] Explain ID.AM-08.143.

[Assistant] Update inventories when systems, hardware, software, and services are moved or transferred within the organization


[User] What is ID.AM-08.144? (Ex7)

[Assistant] Securely destroy stored data based on the organization's data retention policy using the prescribed destruction method, and keep and manage a record of the destructions


[User] Explain ID.AM-08.144.

[Assistant] Securely destroy stored data based on the organization's data retention policy using the prescribed destruction method, and keep and manage a record of the destructions


[User] What is ID.AM-08.145? (Ex8)

[Assistant] Securely sanitize data storage when hardware is being retired, decommissioned, reassigned, or sent for repairs or replacement


[User] Explain ID.AM-08.145.

[Assistant] Securely sanitize data storage when hardware is being retired, decommissioned, reassigned, or sent for repairs or replacement


[User] What is ID.AM-08.146? (Ex9)

[Assistant] Offer methods for destroying paper, storage media, and other physical forms of data storage


[User] Explain ID.AM-08.146.

[Assistant] Offer methods for destroying paper, storage media, and other physical forms of data storage


[User] What is ID.RA-01.147? (Ex1)

[Assistant] Use vulnerability management technologies to identify unpatched and misconfigured software


[User] Explain ID.RA-01.147.

[Assistant] Use vulnerability management technologies to identify unpatched and misconfigured software


[User] What is ID.RA-01.148? (Ex2)

[Assistant] Assess network and system architectures for design and implementation weaknesses that affect cybersecurity


[User] Explain ID.RA-01.148.

[Assistant] Assess network and system architectures for design and implementation weaknesses that affect cybersecurity


[User] What is ID.RA-01.149? (Ex3)

[Assistant] Review, analyze, or test organization-developed software to identify design, coding, and default configuration vulnerabilities


[User] Explain ID.RA-01.149.

[Assistant] Review, analyze, or test organization-developed software to identify design, coding, and default configuration vulnerabilities


[User] What is ID.RA-01.150? (Ex4)

[Assistant] Assess facilities that house critical computing assets for physical vulnerabilities and resilience issues


[User] Explain ID.RA-01.150.

[Assistant] Assess facilities that house critical computing assets for physical vulnerabilities and resilience issues


[User] What is ID.RA-01.151? (Ex5)

[Assistant] Monitor sources of cyber threat intelligence for information on new vulnerabilities in products and services


[User] Explain ID.RA-01.151.

[Assistant] Monitor sources of cyber threat intelligence for information on new vulnerabilities in products and services


[User] What is ID.RA-01.152? (Ex6)

[Assistant] Review processes and procedures for weaknesses that could be exploited to affect cybersecurity


[User] Explain ID.RA-01.152.

[Assistant] Review processes and procedures for weaknesses that could be exploited to affect cybersecurity


[User] What is ID.RA-02.153? (Ex1)

[Assistant] Configure cybersecurity tools and technologies with detection or response capabilities to securely ingest cyber threat intelligence feeds


[User] Explain ID.RA-02.153.

[Assistant] Configure cybersecurity tools and technologies with detection or response capabilities to securely ingest cyber threat intelligence feeds


[User] What is ID.RA-02.154? (Ex2)

[Assistant] Receive and review advisories from reputable third parties on current threat actors and their tactics, techniques, and procedures (TTPs)


[User] Explain ID.RA-02.154.

[Assistant] Receive and review advisories from reputable third parties on current threat actors and their tactics, techniques, and procedures (TTPs)


[User] What is ID.RA-02.155? (Ex3)

[Assistant] Monitor sources of cyber threat intelligence for information on the types of vulnerabilities that emerging technologies may have


[User] Explain ID.RA-02.155.

[Assistant] Monitor sources of cyber threat intelligence for information on the types of vulnerabilities that emerging technologies may have


[User] What is ID.RA-03.156? (Ex1)

[Assistant] Use cyber threat intelligence to maintain awareness of the types of threat actors likely to target the organization and the TTPs they are likely to use


[User] Explain ID.RA-03.156.

[Assistant] Use cyber threat intelligence to maintain awareness of the types of threat actors likely to target the organization and the TTPs they are likely to use


[User] What is ID.RA-03.157? (Ex2)

[Assistant] Perform threat hunting to look for signs of threat actors within the environment


[User] Explain ID.RA-03.157.

[Assistant] Perform threat hunting to look for signs of threat actors within the environment


[User] What is ID.RA-03.158? (Ex3)

[Assistant] Implement processes for identifying internal threat actors


[User] Explain ID.RA-03.158.

[Assistant] Implement processes for identifying internal threat actors


[User] What is ID.RA-04.159? (Ex1)

[Assistant] Business leaders and cybersecurity risk management practitioners work together to estimate the likelihood and impact of risk scenarios and record them in risk registers


[User] Explain ID.RA-04.159.

[Assistant] Business leaders and cybersecurity risk management practitioners work together to estimate the likelihood and impact of risk scenarios and record them in risk registers


[User] What is ID.RA-04.160? (Ex2)

[Assistant] Enumerate the potential business impacts of unauthorized access to the organization's communications, systems, and data processed in or by those systems


[User] Explain ID.RA-04.160.

[Assistant] Enumerate the potential business impacts of unauthorized access to the organization's communications, systems, and data processed in or by those systems


[User] What is ID.RA-04.161? (Ex3)

[Assistant] Account for the potential impacts of cascading failures for systems of systems


[User] Explain ID.RA-04.161.

[Assistant] Account for the potential impacts of cascading failures for systems of systems


[User] What is ID.RA-05.162? (Ex1)

[Assistant] Develop threat models to better understand risks to the data and identify appropriate risk responses


[User] Explain ID.RA-05.162.

[Assistant] Develop threat models to better understand risks to the data and identify appropriate risk responses


[User] What is ID.RA-05.163? (Ex2)

[Assistant] Prioritize cybersecurity resource allocations and investments based on estimated likelihoods and impacts


[User] Explain ID.RA-05.163.

[Assistant] Prioritize cybersecurity resource allocations and investments based on estimated likelihoods and impacts


[User] What is ID.RA-06.164? (Ex1)

[Assistant] Apply the vulnerability management plan's criteria for deciding whether to accept, transfer, mitigate, or avoid risk


[User] Explain ID.RA-06.164.

[Assistant] Apply the vulnerability management plan's criteria for deciding whether to accept, transfer, mitigate, or avoid risk


[User] What is ID.RA-06.165? (Ex2)

[Assistant] Apply the vulnerability management plan's criteria for selecting compensating controls to mitigate risk


[User] Explain ID.RA-06.165.

[Assistant] Apply the vulnerability management plan's criteria for selecting compensating controls to mitigate risk


[User] What is ID.RA-06.166? (Ex3)

[Assistant] Track the progress of risk response implementation (e.g., plan of action and milestones [POA&M], risk register, risk detail report)


[User] Explain ID.RA-06.166.

[Assistant] Track the progress of risk response implementation (e.g., plan of action and milestones [POA&M], risk register, risk detail report)


[User] What is ID.RA-06.167? (Ex4)

[Assistant] Use risk assessment findings to inform risk response decisions and actions


[User] Explain ID.RA-06.167.

[Assistant] Use risk assessment findings to inform risk response decisions and actions


[User] What is ID.RA-06.168? (Ex5)

[Assistant] Communicate planned risk responses to affected stakeholders in priority order


[User] Explain ID.RA-06.168.

[Assistant] Communicate planned risk responses to affected stakeholders in priority order


[User] What is ID.RA-07.169? (Ex1)

[Assistant] Implement and follow procedures for the formal documentation, review, testing, and approval of proposed changes and requested exceptions


[User] Explain ID.RA-07.169.

[Assistant] Implement and follow procedures for the formal documentation, review, testing, and approval of proposed changes and requested exceptions


[User] What is ID.RA-07.170? (Ex2)

[Assistant] Document the possible risks of making or not making each proposed change, and provide guidance on rolling back changes


[User] Explain ID.RA-07.170.

[Assistant] Document the possible risks of making or not making each proposed change, and provide guidance on rolling back changes


[User] What is ID.RA-07.171? (Ex3)

[Assistant] Document the risks related to each requested exception and the plan for responding to those risks


[User] Explain ID.RA-07.171.

[Assistant] Document the risks related to each requested exception and the plan for responding to those risks


[User] What is ID.RA-07.172? (Ex4)

[Assistant] Periodically review risks that were accepted based upon planned future actions or milestones


[User] Explain ID.RA-07.172.

[Assistant] Periodically review risks that were accepted based upon planned future actions or milestones


[User] What is ID.RA-08.173? (Ex1)

[Assistant] Conduct vulnerability information sharing between the organization and its suppliers following the rules and protocols defined in contracts


[User] Explain ID.RA-08.173.

[Assistant] Conduct vulnerability information sharing between the organization and its suppliers following the rules and protocols defined in contracts


[User] What is ID.RA-08.174? (Ex2)

[Assistant] Assign responsibilities and verify the execution of procedures for processing, analyzing the impact of, and responding to cybersecurity threat, vulnerability, or incident disclosures by suppliers, customers, partners, and government cybersecurity organizations


[User] Explain ID.RA-08.174.

[Assistant] Assign responsibilities and verify the execution of procedures for processing, analyzing the impact of, and responding to cybersecurity threat, vulnerability, or incident disclosures by suppliers, customers, partners, and government cybersecurity organizations


[User] What is ID.RA-09.175? (Ex1)

[Assistant] Assess the authenticity and cybersecurity of critical technology products and services prior to acquisition and use


[User] Explain ID.RA-09.175.

[Assistant] Assess the authenticity and cybersecurity of critical technology products and services prior to acquisition and use


[User] What is ID.RA-10.176? (Ex1)

[Assistant] Conduct supplier risk assessments against business and applicable cybersecurity requirements, including the supply chain


[User] Explain ID.RA-10.176.

[Assistant] Conduct supplier risk assessments against business and applicable cybersecurity requirements, including the supply chain


[User] What is ID.IM-01.177? (Ex1)

[Assistant] Perform self-assessments of critical services that take current threats and TTPs into consideration


[User] Explain ID.IM-01.177.

[Assistant] Perform self-assessments of critical services that take current threats and TTPs into consideration


[User] What is ID.IM-01.178? (Ex2)

[Assistant] Invest in third-party assessments or independent audits of the effectiveness of the organization's cybersecurity program to identify areas that need improvement


[User] Explain ID.IM-01.178.

[Assistant] Invest in third-party assessments or independent audits of the effectiveness of the organization's cybersecurity program to identify areas that need improvement


[User] What is ID.IM-01.179? (Ex3)

[Assistant] Constantly evaluate compliance with selected cybersecurity requirements through automated means


[User] Explain ID.IM-01.179.

[Assistant] Constantly evaluate compliance with selected cybersecurity requirements through automated means


[User] What is ID.IM-02.180? (Ex1)

[Assistant] Identify improvements for future incident response activities based on findings from incident response assessments (e.g., tabletop exercises and simulations, tests, internal reviews, independent audits)


[User] Explain ID.IM-02.180.

[Assistant] Identify improvements for future incident response activities based on findings from incident response assessments (e.g., tabletop exercises and simulations, tests, internal reviews, independent audits)


[User] What is ID.IM-02.181? (Ex2)

[Assistant] Identify improvements for future business continuity, disaster recovery, and incident response activities based on exercises performed in coordination with critical service providers and product suppliers


[User] Explain ID.IM-02.181.

[Assistant] Identify improvements for future business continuity, disaster recovery, and incident response activities based on exercises performed in coordination with critical service providers and product suppliers


[User] What is ID.IM-02.182? (Ex3)

[Assistant] Involve internal stakeholders (e.g., senior executives, legal department, HR) in security tests and exercises as appropriate


[User] Explain ID.IM-02.182.

[Assistant] Involve internal stakeholders (e.g., senior executives, legal department, HR) in security tests and exercises as appropriate


[User] What is ID.IM-02.183? (Ex4)

[Assistant] Perform penetration testing to identify opportunities to improve the security posture of selected high-risk systems as approved by leadership


[User] Explain ID.IM-02.183.

[Assistant] Perform penetration testing to identify opportunities to improve the security posture of selected high-risk systems as approved by leadership


[User] What is ID.IM-02.184? (Ex5)

[Assistant] Exercise contingency plans for responding to and recovering from the discovery that products or services did not originate with the contracted supplier or partner or were altered before receipt


[User] Explain ID.IM-02.184.

[Assistant] Exercise contingency plans for responding to and recovering from the discovery that products or services did not originate with the contracted supplier or partner or were altered before receipt


[User] What is ID.IM-02.185? (Ex6)

[Assistant] Collect and analyze performance metrics using security tools and services to inform improvements to the cybersecurity program


[User] Explain ID.IM-02.185.

[Assistant] Collect and analyze performance metrics using security tools and services to inform improvements to the cybersecurity program


[User] What is ID.IM-03.186? (Ex1)

[Assistant] Conduct collaborative lessons learned sessions with suppliers


[User] Explain ID.IM-03.186.

[Assistant] Conduct collaborative lessons learned sessions with suppliers


[User] What is ID.IM-03.187? (Ex2)

[Assistant] Annually review cybersecurity policies, processes, and procedures to take lessons learned into account


[User] Explain ID.IM-03.187.

[Assistant] Annually review cybersecurity policies, processes, and procedures to take lessons learned into account


[User] What is ID.IM-03.188? (Ex3)

[Assistant] Use metrics to assess operational cybersecurity performance over time


[User] Explain ID.IM-03.188.

[Assistant] Use metrics to assess operational cybersecurity performance over time


[User] What is ID.IM-04.189? (Ex1)

[Assistant] Establish contingency plans (e.g., incident response, business continuity, disaster recovery) for responding to and recovering from adverse events that can interfere with operations, expose confidential information, or otherwise endanger the organization's mission and viability


[User] Explain ID.IM-04.189.

[Assistant] Establish contingency plans (e.g., incident response, business continuity, disaster recovery) for responding to and recovering from adverse events that can interfere with operations, expose confidential information, or otherwise endanger the organization's mission and viability


[User] What is ID.IM-04.190? (Ex2)

[Assistant] Include contact and communication information, processes for handling common scenarios, and criteria for prioritization, escalation, and elevation in all contingency plans


[User] Explain ID.IM-04.190.

[Assistant] Include contact and communication information, processes for handling common scenarios, and criteria for prioritization, escalation, and elevation in all contingency plans


[User] What is ID.IM-04.191? (Ex3)

[Assistant] Create a vulnerability management plan to identify and assess all types of vulnerabilities and to prioritize, test, and implement risk responses


[User] Explain ID.IM-04.191.

[Assistant] Create a vulnerability management plan to identify and assess all types of vulnerabilities and to prioritize, test, and implement risk responses


[User] What is ID.IM-04.192? (Ex4)

[Assistant] Communicate cybersecurity plans (including updates) to those responsible for carrying them out and to affected parties


[User] Explain ID.IM-04.192.

[Assistant] Communicate cybersecurity plans (including updates) to those responsible for carrying them out and to affected parties


[User] What is ID.IM-04.193? (Ex5)

[Assistant] Review and update all cybersecurity plans annually or when a need for significant improvements is identified


[User] Explain ID.IM-04.193.

[Assistant] Review and update all cybersecurity plans annually or when a need for significant improvements is identified


[User] What is PR.AA-01.194? (Ex1)

[Assistant] Initiate requests for new access or additional access for employees, contractors, and others, and track, review, and fulfill the requests, with permission from system or data owners when needed


[User] Explain PR.AA-01.194.

[Assistant] Initiate requests for new access or additional access for employees, contractors, and others, and track, review, and fulfill the requests, with permission from system or data owners when needed


[User] What is PR.AA-01.195? (Ex2)

[Assistant] Issue, manage, and revoke cryptographic certificates and identity tokens, cryptographic keys (i.e., key management), and other credentials


[User] Explain PR.AA-01.195.

[Assistant] Issue, manage, and revoke cryptographic certificates and identity tokens, cryptographic keys (i.e., key management), and other credentials


[User] What is PR.AA-01.196? (Ex3)

[Assistant] Select a unique identifier for each device from immutable hardware characteristics or an identifier securely provisioned to the device


[User] Explain PR.AA-01.196.

[Assistant] Select a unique identifier for each device from immutable hardware characteristics or an identifier securely provisioned to the device


[User] What is PR.AA-01.197? (Ex4)

[Assistant] Physically label authorized hardware with an identifier for inventory and servicing purposes


[User] Explain PR.AA-01.197.

[Assistant] Physically label authorized hardware with an identifier for inventory and servicing purposes


[User] What is PR.AA-02.198? (Ex1)

[Assistant] Verify a person's claimed identity at enrollment time using government-issued identity credentials (e.g., passport, visa, driver's license)


[User] Explain PR.AA-02.198.

[Assistant] Verify a person's claimed identity at enrollment time using government-issued identity credentials (e.g., passport, visa, driver's license)


[User] What is PR.AA-02.199? (Ex2)

[Assistant] Issue a different credential for each person (i.e., no credential sharing)


[User] Explain PR.AA-02.199.

[Assistant] Issue a different credential for each person (i.e., no credential sharing)


[User] What is PR.AA-03.200? (Ex1)

[Assistant] Require multifactor authentication


[User] Explain PR.AA-03.200.

[Assistant] Require multifactor authentication


[User] What is PR.AA-03.201? (Ex2)

[Assistant] Enforce policies for the minimum strength of passwords, PINs, and similar authenticators


[User] Explain PR.AA-03.201.

[Assistant] Enforce policies for the minimum strength of passwords, PINs, and similar authenticators


[User] What is PR.AA-03.202? (Ex3)

[Assistant] Periodically reauthenticate users, services, and hardware based on risk (e.g., in zero trust architectures)


[User] Explain PR.AA-03.202.

[Assistant] Periodically reauthenticate users, services, and hardware based on risk (e.g., in zero trust architectures)


[User] What is PR.AA-03.203? (Ex4)

[Assistant] Ensure that authorized personnel can access accounts essential for protecting safety under emergency conditions


[User] Explain PR.AA-03.203.

[Assistant] Ensure that authorized personnel can access accounts essential for protecting safety under emergency conditions


[User] What is PR.AA-04.204? (Ex1)

[Assistant] Protect identity assertions that are used to convey authentication and user information through single sign-on systems


[User] Explain PR.AA-04.204.

[Assistant] Protect identity assertions that are used to convey authentication and user information through single sign-on systems


[User] What is PR.AA-04.205? (Ex2)

[Assistant] Protect identity assertions that are used to convey authentication and user information between federated systems


[User] Explain PR.AA-04.205.

[Assistant] Protect identity assertions that are used to convey authentication and user information between federated systems


[User] What is PR.AA-04.206? (Ex3)

[Assistant] Implement standards-based approaches for identity assertions in all contexts, and follow all guidance for the generation (e.g., data models, metadata), protection (e.g., digital signing, encryption), and verification (e.g., signature validation) of identity assertions


[User] Explain PR.AA-04.206.

[Assistant] Implement standards-based approaches for identity assertions in all contexts, and follow all guidance for the generation (e.g., data models, metadata), protection (e.g., digital signing, encryption), and verification (e.g., signature validation) of identity assertions


[User] What is PR.AA-05.207? (Ex1)

[Assistant] Review logical and physical access privileges periodically and whenever someone changes roles or leaves the organization, and promptly rescind privileges that are no longer needed


[User] Explain PR.AA-05.207.

[Assistant] Review logical and physical access privileges periodically and whenever someone changes roles or leaves the organization, and promptly rescind privileges that are no longer needed


[User] What is PR.AA-05.208? (Ex2)

[Assistant] Take attributes of the requester and the requested resource into account for authorization decisions (e.g., geolocation, day/time, requester endpoint's cyber health)


[User] Explain PR.AA-05.208.

[Assistant] Take attributes of the requester and the requested resource into account for authorization decisions (e.g., geolocation, day/time, requester endpoint's cyber health)


[User] What is PR.AA-05.209? (Ex3)

[Assistant] Restrict access and privileges to the minimum necessary (e.g., zero trust architecture)


[User] Explain PR.AA-05.209.

[Assistant] Restrict access and privileges to the minimum necessary (e.g., zero trust architecture)


[User] What is PR.AA-05.210? (Ex4)

[Assistant] Periodically review the privileges associated with critical business functions to confirm proper separation of duties


[User] Explain PR.AA-05.210.

[Assistant] Periodically review the privileges associated with critical business functions to confirm proper separation of duties


[User] What is PR.AA-06.211? (Ex1)

[Assistant] Use security guards, security cameras, locked entrances, alarm systems, and other physical controls to monitor facilities and restrict access


[User] Explain PR.AA-06.211.

[Assistant] Use security guards, security cameras, locked entrances, alarm systems, and other physical controls to monitor facilities and restrict access


[User] What is PR.AA-06.212? (Ex2)

[Assistant] Employ additional physical security controls for areas that contain high-risk assets


[User] Explain PR.AA-06.212.

[Assistant] Employ additional physical security controls for areas that contain high-risk assets


[User] What is PR.AA-06.213? (Ex3)

[Assistant] Escort guests, vendors, and other third parties within areas that contain business-critical assets


[User] Explain PR.AA-06.213.

[Assistant] Escort guests, vendors, and other third parties within areas that contain business-critical assets


[User] What is PR.AT-01.214? (Ex1)

[Assistant] Provide basic cybersecurity awareness and training to employees, contractors, partners, suppliers, and all other users of the organization's non-public resources


[User] Explain PR.AT-01.214.

[Assistant] Provide basic cybersecurity awareness and training to employees, contractors, partners, suppliers, and all other users of the organization's non-public resources


[User] What is PR.AT-01.215? (Ex2)

[Assistant] Train personnel to recognize social engineering attempts and other common attacks, report attacks and suspicious activity, comply with acceptable use policies, and perform basic cyber hygiene tasks (e.g., patching software, choosing passwords, protecting credentials)


[User] Explain PR.AT-01.215.

[Assistant] Train personnel to recognize social engineering attempts and other common attacks, report attacks and suspicious activity, comply with acceptable use policies, and perform basic cyber hygiene tasks (e.g., patching software, choosing passwords, protecting credentials)


[User] What is PR.AT-01.216? (Ex3)

[Assistant] Explain the consequences of cybersecurity policy violations, both to individual users and the organization as a whole


[User] Explain PR.AT-01.216.

[Assistant] Explain the consequences of cybersecurity policy violations, both to individual users and the organization as a whole


[User] What is PR.AT-01.217? (Ex4)

[Assistant] Periodically assess or test users on their understanding of basic cybersecurity practices


[User] Explain PR.AT-01.217.

[Assistant] Periodically assess or test users on their understanding of basic cybersecurity practices


[User] What is PR.AT-01.218? (Ex5)

[Assistant] Require annual refreshers to reinforce existing practices and introduce new practices


[User] Explain PR.AT-01.218.

[Assistant] Require annual refreshers to reinforce existing practices and introduce new practices


[User] What is PR.AT-02.219? (Ex1)

[Assistant] Identify the specialized roles within the organization that require additional cybersecurity training, such as physical and cybersecurity personnel, finance personnel, senior leadership, and anyone with access to business-critical data


[User] Explain PR.AT-02.219.

[Assistant] Identify the specialized roles within the organization that require additional cybersecurity training, such as physical and cybersecurity personnel, finance personnel, senior leadership, and anyone with access to business-critical data


[User] What is PR.AT-02.220? (Ex2)

[Assistant] Provide role-based cybersecurity awareness and training to all those in specialized roles, including contractors, partners, suppliers, and other third parties


[User] Explain PR.AT-02.220.

[Assistant] Provide role-based cybersecurity awareness and training to all those in specialized roles, including contractors, partners, suppliers, and other third parties


[User] What is PR.AT-02.221? (Ex3)

[Assistant] Periodically assess or test users on their understanding of cybersecurity practices for their specialized roles


[User] Explain PR.AT-02.221.

[Assistant] Periodically assess or test users on their understanding of cybersecurity practices for their specialized roles


[User] What is PR.AT-02.222? (Ex4)

[Assistant] Require annual refreshers to reinforce existing practices and introduce new practices


[User] Explain PR.AT-02.222.

[Assistant] Require annual refreshers to reinforce existing practices and introduce new practices


[User] What is PR.DS-01.223? (Ex1)

[Assistant] Use encryption, digital signatures, and cryptographic hashes to protect the confidentiality and integrity of stored data in files, databases, virtual machine disk images, container images, and other resources


[User] Explain PR.DS-01.223.

[Assistant] Use encryption, digital signatures, and cryptographic hashes to protect the confidentiality and integrity of stored data in files, databases, virtual machine disk images, container images, and other resources


[User] What is PR.DS-01.224? (Ex2)

[Assistant] Use full disk encryption to protect data stored on user endpoints


[User] Explain PR.DS-01.224.

[Assistant] Use full disk encryption to protect data stored on user endpoints


[User] What is PR.DS-01.225? (Ex3)

[Assistant] Confirm the integrity of software by validating signatures


[User] Explain PR.DS-01.225.

[Assistant] Confirm the integrity of software by validating signatures


[User] What is PR.DS-01.226? (Ex4)

[Assistant] Restrict the use of removable media to prevent data exfiltration


[User] Explain PR.DS-01.226.

[Assistant] Restrict the use of removable media to prevent data exfiltration


[User] What is PR.DS-01.227? (Ex5)

[Assistant] Physically secure removable media containing unencrypted sensitive information, such as within locked offices or file cabinets


[User] Explain PR.DS-01.227.

[Assistant] Physically secure removable media containing unencrypted sensitive information, such as within locked offices or file cabinets


[User] What is PR.DS-02.228? (Ex1)

[Assistant] Use encryption, digital signatures, and cryptographic hashes to protect the confidentiality and integrity of network communications


[User] Explain PR.DS-02.228.

[Assistant] Use encryption, digital signatures, and cryptographic hashes to protect the confidentiality and integrity of network communications


[User] What is PR.DS-02.229? (Ex2)

[Assistant] Automatically encrypt or block outbound emails and other communications that contain sensitive data, depending on the data classification


[User] Explain PR.DS-02.229.

[Assistant] Automatically encrypt or block outbound emails and other communications that contain sensitive data, depending on the data classification


[User] What is PR.DS-02.230? (Ex3)

[Assistant] Block access to personal email, file sharing, file storage services, and other personal communications applications and services from organizational systems and networks


[User] Explain PR.DS-02.230.

[Assistant] Block access to personal email, file sharing, file storage services, and other personal communications applications and services from organizational systems and networks


[User] What is PR.DS-02.231? (Ex4)

[Assistant] Prevent reuse of sensitive data from production environments (e.g., customer records) in development, testing, and other non-production environments


[User] Explain PR.DS-02.231.

[Assistant] Prevent reuse of sensitive data from production environments (e.g., customer records) in development, testing, and other non-production environments


[User] What is PR.DS-10.232? (Ex1)

[Assistant] Remove data that must remain confidential (e.g., from processors and memory) as soon as it is no longer needed


[User] Explain PR.DS-10.232.

[Assistant] Remove data that must remain confidential (e.g., from processors and memory) as soon as it is no longer needed


[User] What is PR.DS-10.233? (Ex2)

[Assistant] Protect data in use from access by other users and processes of the same platform


[User] Explain PR.DS-10.233.

[Assistant] Protect data in use from access by other users and processes of the same platform


[User] What is PR.DS-11.234? (Ex1)

[Assistant] Continuously back up critical data in near-real-time, and back up other data frequently at agreed-upon schedules


[User] Explain PR.DS-11.234.

[Assistant] Continuously back up critical data in near-real-time, and back up other data frequently at agreed-upon schedules


[User] What is PR.DS-11.235? (Ex2)

[Assistant] Test backups and restores for all types of data sources at least annually


[User] Explain PR.DS-11.235.

[Assistant] Test backups and restores for all types of data sources at least annually


[User] What is PR.DS-11.236? (Ex3)

[Assistant] Securely store some backups offline and offsite so that an incident or disaster will not damage them


[User] Explain PR.DS-11.236.

[Assistant] Securely store some backups offline and offsite so that an incident or disaster will not damage them


[User] What is PR.DS-11.237? (Ex4)

[Assistant] Enforce geographic separation and geolocation restrictions for data backup storage


[User] Explain PR.DS-11.237.

[Assistant] Enforce geographic separation and geolocation restrictions for data backup storage


[User] What is PR.PS-01.238? (Ex1)

[Assistant] Establish, test, deploy, and maintain hardened baselines that enforce the organization's cybersecurity policies and provide only essential capabilities (i.e., principle of least functionality)


[User] Explain PR.PS-01.238.

[Assistant] Establish, test, deploy, and maintain hardened baselines that enforce the organization's cybersecurity policies and provide only essential capabilities (i.e., principle of least functionality)


[User] What is PR.PS-01.239? (Ex2)

[Assistant] Review all default configuration settings that may potentially impact cybersecurity when installing or upgrading software


[User] Explain PR.PS-01.239.

[Assistant] Review all default configuration settings that may potentially impact cybersecurity when installing or upgrading software


[User] What is PR.PS-01.240? (Ex3)

[Assistant] Monitor implemented software for deviations from approved baselines


[User] Explain PR.PS-01.240.

[Assistant] Monitor implemented software for deviations from approved baselines


[User] What is PR.PS-02.241? (Ex1)

[Assistant] Perform routine and emergency patching within the timeframes specified in the vulnerability management plan


[User] Explain PR.PS-02.241.

[Assistant] Perform routine and emergency patching within the timeframes specified in the vulnerability management plan


[User] What is PR.PS-02.242? (Ex2)

[Assistant] Update container images, and deploy new container instances to replace rather than update existing instances


[User] Explain PR.PS-02.242.

[Assistant] Update container images, and deploy new container instances to replace rather than update existing instances


[User] What is PR.PS-02.243? (Ex3)

[Assistant] Replace end-of-life software and service versions with supported, maintained versions


[User] Explain PR.PS-02.243.

[Assistant] Replace end-of-life software and service versions with supported, maintained versions


[User] What is PR.PS-02.244? (Ex4)

[Assistant] Uninstall and remove unauthorized software and services that pose undue risks


[User] Explain PR.PS-02.244.

[Assistant] Uninstall and remove unauthorized software and services that pose undue risks


[User] What is PR.PS-02.245? (Ex5)

[Assistant] Uninstall and remove any unnecessary software components (e.g., operating system utilities) that attackers might misuse


[User] Explain PR.PS-02.245.

[Assistant] Uninstall and remove any unnecessary software components (e.g., operating system utilities) that attackers might misuse


[User] What is PR.PS-02.246? (Ex6)

[Assistant] Define and implement plans for software and service end-of-life maintenance support and obsolescence


[User] Explain PR.PS-02.246.

[Assistant] Define and implement plans for software and service end-of-life maintenance support and obsolescence


[User] What is PR.PS-03.247? (Ex1)

[Assistant] Replace hardware when it lacks needed security capabilities or when it cannot support software with needed security capabilities


[User] Explain PR.PS-03.247.

[Assistant] Replace hardware when it lacks needed security capabilities or when it cannot support software with needed security capabilities


[User] What is PR.PS-03.248? (Ex2)

[Assistant] Define and implement plans for hardware end-of-life maintenance support and obsolescence


[User] Explain PR.PS-03.248.

[Assistant] Define and implement plans for hardware end-of-life maintenance support and obsolescence


[User] What is PR.PS-03.249? (Ex3)

[Assistant] Perform hardware disposal in a secure, responsible, and auditable manner


[User] Explain PR.PS-03.249.

[Assistant] Perform hardware disposal in a secure, responsible, and auditable manner


[User] What is PR.PS-04.250? (Ex1)

[Assistant] Configure all operating systems, applications, and services (including cloud-based services) to generate log records


[User] Explain PR.PS-04.250.

[Assistant] Configure all operating systems, applications, and services (including cloud-based services) to generate log records


[User] What is PR.PS-04.251? (Ex2)

[Assistant] Configure log generators to securely share their logs with the organization's logging infrastructure systems and services


[User] Explain PR.PS-04.251.

[Assistant] Configure log generators to securely share their logs with the organization's logging infrastructure systems and services


[User] What is PR.PS-04.252? (Ex3)

[Assistant] Configure log generators to record the data needed by zero-trust architectures


[User] Explain PR.PS-04.252.

[Assistant] Configure log generators to record the data needed by zero-trust architectures


[User] What is PR.PS-05.253? (Ex1)

[Assistant] When risk warrants it, restrict software execution to permitted products only or deny the execution of prohibited and unauthorized software


[User] Explain PR.PS-05.253.

[Assistant] When risk warrants it, restrict software execution to permitted products only or deny the execution of prohibited and unauthorized software


[User] What is PR.PS-05.254? (Ex2)

[Assistant] Verify the source of new software and the software's integrity before installing it


[User] Explain PR.PS-05.254.

[Assistant] Verify the source of new software and the software's integrity before installing it


[User] What is PR.PS-05.255? (Ex3)

[Assistant] Configure platforms to use only approved DNS services that block access to known malicious domains


[User] Explain PR.PS-05.255.

[Assistant] Configure platforms to use only approved DNS services that block access to known malicious domains


[User] What is PR.PS-05.256? (Ex4)

[Assistant] Configure platforms to allow the installation of organization-approved software only


[User] Explain PR.PS-05.256.

[Assistant] Configure platforms to allow the installation of organization-approved software only


[User] What is PR.PS-06.257? (Ex1)

[Assistant] Protect all components of organization-developed software from tampering and unauthorized access


[User] Explain PR.PS-06.257.

[Assistant] Protect all components of organization-developed software from tampering and unauthorized access


[User] What is PR.PS-06.258? (Ex2)

[Assistant] Secure all software produced by the organization, with minimal vulnerabilities in their releases


[User] Explain PR.PS-06.258.

[Assistant] Secure all software produced by the organization, with minimal vulnerabilities in their releases


[User] What is PR.PS-06.259? (Ex3)

[Assistant] Maintain the software used in production environments, and securely dispose of software once it is no longer needed


[User] Explain PR.PS-06.259.

[Assistant] Maintain the software used in production environments, and securely dispose of software once it is no longer needed


[User] What is PR.IR-01.260? (Ex1)

[Assistant] Logically segment organization networks and cloud-based platforms according to trust boundaries and platform types (e.g., IT, IoT, OT, mobile, guests), and permit required communications only between segments


[User] Explain PR.IR-01.260.

[Assistant] Logically segment organization networks and cloud-based platforms according to trust boundaries and platform types (e.g., IT, IoT, OT, mobile, guests), and permit required communications only between segments


[User] What is PR.IR-01.261? (Ex2)

[Assistant] Logically segment organization networks from external networks, and permit only necessary communications to enter the organization's networks from the external networks


[User] Explain PR.IR-01.261.

[Assistant] Logically segment organization networks from external networks, and permit only necessary communications to enter the organization's networks from the external networks


[User] What is PR.IR-01.262? (Ex3)

[Assistant] Implement zero trust architectures to restrict network access to each resource to the minimum necessary


[User] Explain PR.IR-01.262.

[Assistant] Implement zero trust architectures to restrict network access to each resource to the minimum necessary


[User] What is PR.IR-01.263? (Ex4)

[Assistant] Check the cyber health of endpoints before allowing them to access and use production resources


[User] Explain PR.IR-01.263.

[Assistant] Check the cyber health of endpoints before allowing them to access and use production resources


[User] What is PR.IR-02.264? (Ex1)

[Assistant] Protect organizational equipment from known environmental threats, such as flooding, fire, wind, and excessive heat and humidity


[User] Explain PR.IR-02.264.

[Assistant] Protect organizational equipment from known environmental threats, such as flooding, fire, wind, and excessive heat and humidity


[User] What is PR.IR-02.265? (Ex2)

[Assistant] Include protection from environmental threats and provisions for adequate operating infrastructure in requirements for service providers that operate systems on the organization's behalf


[User] Explain PR.IR-02.265.

[Assistant] Include protection from environmental threats and provisions for adequate operating infrastructure in requirements for service providers that operate systems on the organization's behalf


[User] What is PR.IR-03.266? (Ex1)

[Assistant] Avoid single points of failure in systems and infrastructure


[User] Explain PR.IR-03.266.

[Assistant] Avoid single points of failure in systems and infrastructure


[User] What is PR.IR-03.267? (Ex2)

[Assistant] Use load balancing to increase capacity and improve reliability


[User] Explain PR.IR-03.267.

[Assistant] Use load balancing to increase capacity and improve reliability


[User] What is PR.IR-03.268? (Ex3)

[Assistant] Use high-availability components like redundant storage and power supplies to improve system reliability


[User] Explain PR.IR-03.268.

[Assistant] Use high-availability components like redundant storage and power supplies to improve system reliability


[User] What is PR.IR-04.269? (Ex1)

[Assistant] Monitor usage of storage, power, compute, network bandwidth, and other resources


[User] Explain PR.IR-04.269.

[Assistant] Monitor usage of storage, power, compute, network bandwidth, and other resources


[User] What is PR.IR-04.270? (Ex2)

[Assistant] Forecast future needs, and scale resources accordingly


[User] Explain PR.IR-04.270.

[Assistant] Forecast future needs, and scale resources accordingly


[User] What is DE.CM-01.271? (Ex1)

[Assistant] Monitor DNS, BGP, and other network services for adverse events


[User] Explain DE.CM-01.271.

[Assistant] Monitor DNS, BGP, and other network services for adverse events


[User] What is DE.CM-01.272? (Ex2)

[Assistant] Monitor wired and wireless networks for connections from unauthorized endpoints


[User] Explain DE.CM-01.272.

[Assistant] Monitor wired and wireless networks for connections from unauthorized endpoints


[User] What is DE.CM-01.273? (Ex3)

[Assistant] Monitor facilities for unauthorized or rogue wireless networks


[User] Explain DE.CM-01.273.

[Assistant] Monitor facilities for unauthorized or rogue wireless networks


[User] What is DE.CM-01.274? (Ex4)

[Assistant] Compare actual network flows against baselines to detect deviations


[User] Explain DE.CM-01.274.

[Assistant] Compare actual network flows against baselines to detect deviations


[User] What is DE.CM-01.275? (Ex5)

[Assistant] Monitor network communications to identify changes in security postures for zero trust purposes


[User] Explain DE.CM-01.275.

[Assistant] Monitor network communications to identify changes in security postures for zero trust purposes


[User] What is DE.CM-02.276? (Ex1)

[Assistant] Monitor logs from physical access control systems (e.g., badge readers) to find unusual access patterns (e.g., deviations from the norm) and failed access attempts


[User] Explain DE.CM-02.276.

[Assistant] Monitor logs from physical access control systems (e.g., badge readers) to find unusual access patterns (e.g., deviations from the norm) and failed access attempts


[User] What is DE.CM-02.277? (Ex2)

[Assistant] Review and monitor physical access records (e.g., from visitor registration, sign-in sheets)


[User] Explain DE.CM-02.277.

[Assistant] Review and monitor physical access records (e.g., from visitor registration, sign-in sheets)


[User] What is DE.CM-02.278? (Ex3)

[Assistant] Monitor physical access controls (e.g., locks, latches, hinge pins, alarms) for signs of tampering


[User] Explain DE.CM-02.278.

[Assistant] Monitor physical access controls (e.g., locks, latches, hinge pins, alarms) for signs of tampering


[User] What is DE.CM-02.279? (Ex4)

[Assistant] Monitor the physical environment using alarm systems, cameras, and security guards


[User] Explain DE.CM-02.279.

[Assistant] Monitor the physical environment using alarm systems, cameras, and security guards


[User] What is DE.CM-03.280? (Ex1)

[Assistant] Use behavior analytics software to detect anomalous user activity to mitigate insider threats


[User] Explain DE.CM-03.280.

[Assistant] Use behavior analytics software to detect anomalous user activity to mitigate insider threats


[User] What is DE.CM-03.281? (Ex2)

[Assistant] Monitor logs from logical access control systems to find unusual access patterns and failed access attempts


[User] Explain DE.CM-03.281.

[Assistant] Monitor logs from logical access control systems to find unusual access patterns and failed access attempts


[User] What is DE.CM-03.282? (Ex3)

[Assistant] Continuously monitor deception technology, including user accounts, for any usage


[User] Explain DE.CM-03.282.

[Assistant] Continuously monitor deception technology, including user accounts, for any usage


[User] What is DE.CM-06.283? (Ex1)

[Assistant] Monitor remote and onsite administration and maintenance activities that external providers perform on organizational systems


[User] Explain DE.CM-06.283.

[Assistant] Monitor remote and onsite administration and maintenance activities that external providers perform on organizational systems


[User] What is DE.CM-06.284? (Ex2)

[Assistant] Monitor activity from cloud-based services, internet service providers, and other service providers for deviations from expected behavior


[User] Explain DE.CM-06.284.

[Assistant] Monitor activity from cloud-based services, internet service providers, and other service providers for deviations from expected behavior


[User] What is DE.CM-09.285? (Ex1)

[Assistant] Monitor email, web, file sharing, collaboration services, and other common attack vectors to detect malware, phishing, data leaks and exfiltration, and other adverse events


[User] Explain DE.CM-09.285.

[Assistant] Monitor email, web, file sharing, collaboration services, and other common attack vectors to detect malware, phishing, data leaks and exfiltration, and other adverse events


[User] What is DE.CM-09.286? (Ex2)

[Assistant] Monitor authentication attempts to identify attacks against credentials and unauthorized credential reuse


[User] Explain DE.CM-09.286.

[Assistant] Monitor authentication attempts to identify attacks against credentials and unauthorized credential reuse


[User] What is DE.CM-09.287? (Ex3)

[Assistant] Monitor software configurations for deviations from security baselines


[User] Explain DE.CM-09.287.

[Assistant] Monitor software configurations for deviations from security baselines


[User] What is DE.CM-09.288? (Ex4)

[Assistant] Monitor hardware and software for signs of tampering


[User] Explain DE.CM-09.288.

[Assistant] Monitor hardware and software for signs of tampering


[User] What is DE.CM-09.289? (Ex5)

[Assistant] Use technologies with a presence on endpoints to detect cyber health issues (e.g., missing patches, malware infections, unauthorized software), and redirect the endpoints to a remediation environment before access is authorized


[User] Explain DE.CM-09.289.

[Assistant] Use technologies with a presence on endpoints to detect cyber health issues (e.g., missing patches, malware infections, unauthorized software), and redirect the endpoints to a remediation environment before access is authorized


[User] What is DE.AE-02.290? (Ex1)

[Assistant] Use security information and event management (SIEM) or other tools to continuously monitor log events for known malicious and suspicious activity


[User] Explain DE.AE-02.290.

[Assistant] Use security information and event management (SIEM) or other tools to continuously monitor log events for known malicious and suspicious activity


[User] What is DE.AE-02.291? (Ex2)

[Assistant] Utilize up-to-date cyber threat intelligence in log analysis tools to improve detection accuracy and characterize threat actors, their methods, and indicators of compromise


[User] Explain DE.AE-02.291.

[Assistant] Utilize up-to-date cyber threat intelligence in log analysis tools to improve detection accuracy and characterize threat actors, their methods, and indicators of compromise


[User] What is DE.AE-02.292? (Ex3)

[Assistant] Regularly conduct manual reviews of log events for technologies that cannot be sufficiently monitored through automation


[User] Explain DE.AE-02.292.

[Assistant] Regularly conduct manual reviews of log events for technologies that cannot be sufficiently monitored through automation


[User] What is DE.AE-02.293? (Ex4)

[Assistant] Use log analysis tools to generate reports on their findings


[User] Explain DE.AE-02.293.

[Assistant] Use log analysis tools to generate reports on their findings


[User] What is DE.AE-03.294? (Ex1)

[Assistant] Constantly transfer log data generated by other sources to a relatively small number of log servers


[User] Explain DE.AE-03.294.

[Assistant] Constantly transfer log data generated by other sources to a relatively small number of log servers


[User] What is DE.AE-03.295? (Ex2)

[Assistant] Use event correlation technology (e.g., SIEM) to collect information captured by multiple sources


[User] Explain DE.AE-03.295.

[Assistant] Use event correlation technology (e.g., SIEM) to collect information captured by multiple sources


[User] What is DE.AE-03.296? (Ex3)

[Assistant] Utilize cyber threat intelligence to help correlate events among log sources


[User] Explain DE.AE-03.296.

[Assistant] Utilize cyber threat intelligence to help correlate events among log sources


[User] What is DE.AE-04.297? (Ex1)

[Assistant] Use SIEMs or other tools to estimate impact and scope, and review and refine the estimates


[User] Explain DE.AE-04.297.

[Assistant] Use SIEMs or other tools to estimate impact and scope, and review and refine the estimates


[User] What is DE.AE-04.298? (Ex2)

[Assistant] A person creates their own estimates of impact and scope


[User] Explain DE.AE-04.298.

[Assistant] A person creates their own estimates of impact and scope


[User] What is DE.AE-06.299? (Ex1)

[Assistant] Use cybersecurity software to generate alerts and provide them to the security operations center (SOC), incident responders, and incident response tools


[User] Explain DE.AE-06.299.

[Assistant] Use cybersecurity software to generate alerts and provide them to the security operations center (SOC), incident responders, and incident response tools


[User] What is DE.AE-06.300? (Ex2)

[Assistant] Incident responders and other authorized personnel can access log analysis findings at all times


[User] Explain DE.AE-06.300.

[Assistant] Incident responders and other authorized personnel can access log analysis findings at all times


[User] What is DE.AE-06.301? (Ex3)

[Assistant] Automatically create and assign tickets in the organization's ticketing system when certain types of alerts occur


[User] Explain DE.AE-06.301.

[Assistant] Automatically create and assign tickets in the organization's ticketing system when certain types of alerts occur


[User] What is DE.AE-06.302? (Ex4)

[Assistant] Manually create and assign tickets in the organization's ticketing system when technical staff discover indicators of compromise


[User] Explain DE.AE-06.302.

[Assistant] Manually create and assign tickets in the organization's ticketing system when technical staff discover indicators of compromise


[User] What is DE.AE-07.303? (Ex1)

[Assistant] Securely provide cyber threat intelligence feeds to detection technologies, processes, and personnel


[User] Explain DE.AE-07.303.

[Assistant] Securely provide cyber threat intelligence feeds to detection technologies, processes, and personnel


[User] What is DE.AE-07.304? (Ex2)

[Assistant] Securely provide information from asset inventories to detection technologies, processes, and personnel


[User] Explain DE.AE-07.304.

[Assistant] Securely provide information from asset inventories to detection technologies, processes, and personnel


[User] What is DE.AE-07.305? (Ex3)

[Assistant] Rapidly acquire and analyze vulnerability disclosures for the organization's technologies from suppliers, vendors, and third-party security advisories


[User] Explain DE.AE-07.305.

[Assistant] Rapidly acquire and analyze vulnerability disclosures for the organization's technologies from suppliers, vendors, and third-party security advisories


[User] What is DE.AE-08.306? (Ex1)

[Assistant] Apply incident criteria to known and assumed characteristics of activity in order to determine whether an incident should be declared


[User] Explain DE.AE-08.306.

[Assistant] Apply incident criteria to known and assumed characteristics of activity in order to determine whether an incident should be declared


[User] What is DE.AE-08.307? (Ex2)

[Assistant] Take known false positives into account when applying incident criteria


[User] Explain DE.AE-08.307.

[Assistant] Take known false positives into account when applying incident criteria


[User] What is RS.MA-01.308? (Ex1)

[Assistant] Detection technologies automatically report confirmed incidents


[User] Explain RS.MA-01.308.

[Assistant] Detection technologies automatically report confirmed incidents


[User] What is RS.MA-01.309? (Ex2)

[Assistant] Request incident response assistance from the organization's incident response outsourcer


[User] Explain RS.MA-01.309.

[Assistant] Request incident response assistance from the organization's incident response outsourcer


[User] What is RS.MA-01.310? (Ex3)

[Assistant] Designate an incident lead for each incident


[User] Explain RS.MA-01.310.

[Assistant] Designate an incident lead for each incident


[User] What is RS.MA-01.311? (Ex4)

[Assistant] Initiate execution of additional cybersecurity plans as needed to support incident response (for example, business continuity and disaster recovery)


[User] Explain RS.MA-01.311.

[Assistant] Initiate execution of additional cybersecurity plans as needed to support incident response (for example, business continuity and disaster recovery)


[User] What is RS.MA-02.312? (Ex1)

[Assistant] Preliminarily review incident reports to confirm that they are cybersecurity-related and necessitate incident response activities


[User] Explain RS.MA-02.312.

[Assistant] Preliminarily review incident reports to confirm that they are cybersecurity-related and necessitate incident response activities


[User] What is RS.MA-02.313? (Ex2)

[Assistant] Apply criteria to estimate the severity of an incident


[User] Explain RS.MA-02.313.

[Assistant] Apply criteria to estimate the severity of an incident


[User] What is RS.MA-03.314? (Ex1)

[Assistant] Further review and categorize incidents based on the type of incident (e.g., data breach, ransomware, DDoS, account compromise)


[User] Explain RS.MA-03.314.

[Assistant] Further review and categorize incidents based on the type of incident (e.g., data breach, ransomware, DDoS, account compromise)


[User] What is RS.MA-03.315? (Ex2)

[Assistant] Prioritize incidents based on their scope, likely impact, and time-critical nature


[User] Explain RS.MA-03.315.

[Assistant] Prioritize incidents based on their scope, likely impact, and time-critical nature


[User] What is RS.MA-03.316? (Ex3)

[Assistant] Select incident response strategies for active incidents by balancing the need to quickly recover from an incident with the need to observe the attacker or conduct a more thorough investigation


[User] Explain RS.MA-03.316.

[Assistant] Select incident response strategies for active incidents by balancing the need to quickly recover from an incident with the need to observe the attacker or conduct a more thorough investigation


[User] What is RS.MA-04.317? (Ex1)

[Assistant] Track and validate the status of all ongoing incidents


[User] Explain RS.MA-04.317.

[Assistant] Track and validate the status of all ongoing incidents


[User] What is RS.MA-04.318? (Ex2)

[Assistant] Coordinate incident escalation or elevation with designated internal and external stakeholders


[User] Explain RS.MA-04.318.

[Assistant] Coordinate incident escalation or elevation with designated internal and external stakeholders


[User] What is RS.MA-05.319? (Ex1)

[Assistant] Apply incident recovery criteria to known and assumed characteristics of the incident to determine whether incident recovery processes should be initiated


[User] Explain RS.MA-05.319.

[Assistant] Apply incident recovery criteria to known and assumed characteristics of the incident to determine whether incident recovery processes should be initiated


[User] What is RS.MA-05.320? (Ex2)

[Assistant] Take the possible operational disruption of incident recovery activities into account


[User] Explain RS.MA-05.320.

[Assistant] Take the possible operational disruption of incident recovery activities into account


[User] What is RS.AN-03.321? (Ex1)

[Assistant] Determine the sequence of events that occurred during the incident and which assets and resources were involved in each event


[User] Explain RS.AN-03.321.

[Assistant] Determine the sequence of events that occurred during the incident and which assets and resources were involved in each event


[User] What is RS.AN-03.322? (Ex2)

[Assistant] Attempt to determine what vulnerabilities, threats, and threat actors were directly or indirectly involved in the incident


[User] Explain RS.AN-03.322.

[Assistant] Attempt to determine what vulnerabilities, threats, and threat actors were directly or indirectly involved in the incident


[User] What is RS.AN-03.323? (Ex3)

[Assistant] Analyze the incident to find the underlying, systemic root causes


[User] Explain RS.AN-03.323.

[Assistant] Analyze the incident to find the underlying, systemic root causes


[User] What is RS.AN-03.324? (Ex4)

[Assistant] Check any cyber deception technology for additional information on attacker behavior


[User] Explain RS.AN-03.324.

[Assistant] Check any cyber deception technology for additional information on attacker behavior


[User] What is RS.AN-06.325? (Ex1)

[Assistant] Require each incident responder and others (e.g., system administrators, cybersecurity engineers) who perform incident response tasks to record their actions and make the record immutable


[User] Explain RS.AN-06.325.

[Assistant] Require each incident responder and others (e.g., system administrators, cybersecurity engineers) who perform incident response tasks to record their actions and make the record immutable


[User] What is RS.AN-06.326? (Ex2)

[Assistant] Require the incident lead to document the incident in detail and be responsible for preserving the integrity of the documentation and the sources of all information being reported


[User] Explain RS.AN-06.326.

[Assistant] Require the incident lead to document the incident in detail and be responsible for preserving the integrity of the documentation and the sources of all information being reported


[User] What is RS.AN-07.327? (Ex1)

[Assistant] Collect, preserve, and safeguard the integrity of all pertinent incident data and metadata (e.g., data source, date/time of collection) based on evidence preservation and chain-of-custody procedures


[User] Explain RS.AN-07.327.

[Assistant] Collect, preserve, and safeguard the integrity of all pertinent incident data and metadata (e.g., data source, date/time of collection) based on evidence preservation and chain-of-custody procedures


[User] What is RS.AN-08.328? (Ex1)

[Assistant] Review other potential targets of the incident to search for indicators of compromise and evidence of persistence


[User] Explain RS.AN-08.328.

[Assistant] Review other potential targets of the incident to search for indicators of compromise and evidence of persistence


[User] What is RS.AN-08.329? (Ex2)

[Assistant] Automatically run tools on targets to look for indicators of compromise and evidence of persistence


[User] Explain RS.AN-08.329.

[Assistant] Automatically run tools on targets to look for indicators of compromise and evidence of persistence


[User] What is RS.CO-02.330? (Ex1)

[Assistant] Follow the organization's breach notification procedures after discovering a data breach incident, including notifying affected customers


[User] Explain RS.CO-02.330.

[Assistant] Follow the organization's breach notification procedures after discovering a data breach incident, including notifying affected customers


[User] What is RS.CO-02.331? (Ex2)

[Assistant] Notify business partners and customers of incidents in accordance with contractual requirements


[User] Explain RS.CO-02.331.

[Assistant] Notify business partners and customers of incidents in accordance with contractual requirements


[User] What is RS.CO-02.332? (Ex3)

[Assistant] Notify law enforcement agencies and regulatory bodies of incidents based on criteria in the incident response plan and management approval


[User] Explain RS.CO-02.332.

[Assistant] Notify law enforcement agencies and regulatory bodies of incidents based on criteria in the incident response plan and management approval


[User] What is RS.CO-03.333? (Ex1)

[Assistant] Securely share information consistent with response plans and information sharing agreements


[User] Explain RS.CO-03.333.

[Assistant] Securely share information consistent with response plans and information sharing agreements


[User] What is RS.CO-03.334? (Ex2)

[Assistant] Voluntarily share information about an attacker's observed TTPs, with all sensitive data removed, with an Information Sharing and Analysis Center (ISAC)


[User] Explain RS.CO-03.334.

[Assistant] Voluntarily share information about an attacker's observed TTPs, with all sensitive data removed, with an Information Sharing and Analysis Center (ISAC)


[User] What is RS.CO-03.335? (Ex3)

[Assistant] Notify HR when malicious insider activity occurs


[User] Explain RS.CO-03.335.

[Assistant] Notify HR when malicious insider activity occurs


[User] What is RS.CO-03.336? (Ex4)

[Assistant] Regularly update senior leadership on the status of major incidents


[User] Explain RS.CO-03.336.

[Assistant] Regularly update senior leadership on the status of major incidents


[User] What is RS.CO-03.337? (Ex5)

[Assistant] Follow the rules and protocols defined in contracts for incident information sharing between the organization and its suppliers


[User] Explain RS.CO-03.337.

[Assistant] Follow the rules and protocols defined in contracts for incident information sharing between the organization and its suppliers


[User] What is RS.CO-03.338? (Ex6)

[Assistant] Coordinate crisis communication methods between the organization and its critical suppliers


[User] Explain RS.CO-03.338.

[Assistant] Coordinate crisis communication methods between the organization and its critical suppliers


[User] What is RS.MI-01.339? (Ex1)

[Assistant] Cybersecurity technologies (e.g., antivirus software) and cybersecurity features of other technologies (e.g., operating systems, network infrastructure devices) automatically perform containment actions


[User] Explain RS.MI-01.339.

[Assistant] Cybersecurity technologies (e.g., antivirus software) and cybersecurity features of other technologies (e.g., operating systems, network infrastructure devices) automatically perform containment actions


[User] What is RS.MI-01.340? (Ex2)

[Assistant] Allow incident responders to manually select and perform containment actions


[User] Explain RS.MI-01.340.

[Assistant] Allow incident responders to manually select and perform containment actions


[User] What is RS.MI-01.341? (Ex3)

[Assistant] Allow a third party (e.g., internet service provider, managed security service provider) to perform containment actions on behalf of the organization


[User] Explain RS.MI-01.341.

[Assistant] Allow a third party (e.g., internet service provider, managed security service provider) to perform containment actions on behalf of the organization


[User] What is RS.MI-01.342? (Ex4)

[Assistant] Automatically transfer compromised endpoints to a remediation virtual local area network (VLAN)


[User] Explain RS.MI-01.342.

[Assistant] Automatically transfer compromised endpoints to a remediation virtual local area network (VLAN)


[User] What is RS.MI-02.343? (Ex1)

[Assistant] Cybersecurity technologies and cybersecurity features of other technologies (e.g., operating systems, network infrastructure devices) automatically perform eradication actions


[User] Explain RS.MI-02.343.

[Assistant] Cybersecurity technologies and cybersecurity features of other technologies (e.g., operating systems, network infrastructure devices) automatically perform eradication actions


[User] What is RS.MI-02.344? (Ex2)

[Assistant] Allow incident responders to manually select and perform eradication actions


[User] Explain RS.MI-02.344.

[Assistant] Allow incident responders to manually select and perform eradication actions


[User] What is RS.MI-02.345? (Ex3)

[Assistant] Allow a third party (e.g., managed security service provider) to perform eradication actions on behalf of the organization


[User] Explain RS.MI-02.345.

[Assistant] Allow a third party (e.g., managed security service provider) to perform eradication actions on behalf of the organization


[User] What is RC.RP-01.346? (Ex1)

[Assistant] Begin recovery procedures during or after incident response processes


[User] Explain RC.RP-01.346.

[Assistant] Begin recovery procedures during or after incident response processes


[User] What is RC.RP-01.347? (Ex2)

[Assistant] Make all individuals with recovery responsibilities aware of the plans for recovery and the authorizations required to implement each aspect of the plans


[User] Explain RC.RP-01.347.

[Assistant] Make all individuals with recovery responsibilities aware of the plans for recovery and the authorizations required to implement each aspect of the plans


[User] What is RC.RP-02.348? (Ex1)

[Assistant] Select recovery actions based on the criteria defined in the incident response plan and available resources


[User] Explain RC.RP-02.348.

[Assistant] Select recovery actions based on the criteria defined in the incident response plan and available resources


[User] What is RC.RP-02.349? (Ex2)

[Assistant] Change planned recovery actions based on a reassessment of organizational needs and resources


[User] Explain RC.RP-02.349.

[Assistant] Change planned recovery actions based on a reassessment of organizational needs and resources


[User] What is RC.RP-03.350? (Ex1)

[Assistant] Check restoration assets for indicators of compromise, file corruption, and other integrity issues before use


[User] Explain RC.RP-03.350.

[Assistant] Check restoration assets for indicators of compromise, file corruption, and other integrity issues before use


[User] What is RC.RP-04.351? (Ex1)

[Assistant] Use business impact and system categorization records (including service delivery objectives) to validate that essential services are restored in the appropriate order


[User] Explain RC.RP-04.351.

[Assistant] Use business impact and system categorization records (including service delivery objectives) to validate that essential services are restored in the appropriate order


[User] What is RC.RP-04.352? (Ex2)

[Assistant] Work with system owners to confirm the successful restoration of systems and the return to normal operations


[User] Explain RC.RP-04.352.

[Assistant] Work with system owners to confirm the successful restoration of systems and the return to normal operations


[User] What is RC.RP-04.353? (Ex3)

[Assistant] Monitor the performance of restored systems to verify the adequacy of the restoration


[User] Explain RC.RP-04.353.

[Assistant] Monitor the performance of restored systems to verify the adequacy of the restoration


[User] What is RC.RP-05.354? (Ex1)

[Assistant] Check restored assets for indicators of compromise and remediation of root causes of the incident before production use


[User] Explain RC.RP-05.354.

[Assistant] Check restored assets for indicators of compromise and remediation of root causes of the incident before production use


[User] What is RC.RP-05.355? (Ex2)

[Assistant] Verify the correctness and adequacy of the restoration actions taken before putting a restored system online


[User] Explain RC.RP-05.355.

[Assistant] Verify the correctness and adequacy of the restoration actions taken before putting a restored system online


[User] What is RC.RP-06.356? (Ex1)

[Assistant] Prepare an after-action report that documents the incident itself, the response and recovery actions taken, and lessons learned


[User] Explain RC.RP-06.356.

[Assistant] Prepare an after-action report that documents the incident itself, the response and recovery actions taken, and lessons learned


[User] What is RC.RP-06.357? (Ex2)

[Assistant] Declare the end of incident recovery once the criteria are met


[User] Explain RC.RP-06.357.

[Assistant] Declare the end of incident recovery once the criteria are met


[User] What is RC.CO-03.358? (Ex1)

[Assistant] Securely share recovery information, including restoration progress, consistent with response plans and information sharing agreements


[User] Explain RC.CO-03.358.

[Assistant] Securely share recovery information, including restoration progress, consistent with response plans and information sharing agreements


[User] What is RC.CO-03.359? (Ex2)

[Assistant] Regularly update senior leadership on recovery status and restoration progress for major incidents


[User] Explain RC.CO-03.359.

[Assistant] Regularly update senior leadership on recovery status and restoration progress for major incidents


[User] What is RC.CO-03.360? (Ex3)

[Assistant] Follow the rules and protocols defined in contracts for incident information sharing between the organization and its suppliers


[User] Explain RC.CO-03.360.

[Assistant] Follow the rules and protocols defined in contracts for incident information sharing between the organization and its suppliers


[User] What is RC.CO-03.361? (Ex4)

[Assistant] Coordinate crisis communication between the organization and its critical suppliers


[User] Explain RC.CO-03.361.

[Assistant] Coordinate crisis communication between the organization and its critical suppliers


[User] What is RC.CO-04.362? (Ex1)

[Assistant] Follow the organization's breach notification procedures for recovering from a data breach incident


[User] Explain RC.CO-04.362.

[Assistant] Follow the organization's breach notification procedures for recovering from a data breach incident


[User] What is RC.CO-04.363? (Ex2)

[Assistant] Explain the steps being taken to recover from the incident and to prevent a recurrence


[User] Explain RC.CO-04.363.

[Assistant] Explain the steps being taken to recover from the incident and to prevent a recurrence


[User] What is GV.OC-01?

[Assistant] The organizational mission is understood and informs cybersecurity risk management


[User] Explain the requirement of GV.OC-01.

[Assistant] The organizational mission is understood and informs cybersecurity risk management


[User] What outcome is expected by GV.OC-01?

[Assistant] The organizational mission is understood and informs cybersecurity risk management


[User] What is GV.OC-02?

[Assistant] Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered


[User] Explain the requirement of GV.OC-02.

[Assistant] Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered


[User] What outcome is expected by GV.OC-02?

[Assistant] Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered


[User] What is GV.OC-03?

[Assistant] Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed


[User] Explain the requirement of GV.OC-03.

[Assistant] Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed


[User] What outcome is expected by GV.OC-03?

[Assistant] Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed


[User] What is GV.OC-04?

[Assistant] Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated


[User] Explain the requirement of GV.OC-04.

[Assistant] Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated


[User] What outcome is expected by GV.OC-04?

[Assistant] Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated


[User] What is GV.OC-05?

[Assistant] Outcomes, capabilities, and services that the organization depends on are understood and communicated


[User] Explain the requirement of GV.OC-05.

[Assistant] Outcomes, capabilities, and services that the organization depends on are understood and communicated


[User] What outcome is expected by GV.OC-05?

[Assistant] Outcomes, capabilities, and services that the organization depends on are understood and communicated


[User] What is GV.RM-01?

[Assistant] Risk management objectives are established and agreed to by organizational stakeholders


[User] Explain the requirement of GV.RM-01.

[Assistant] Risk management objectives are established and agreed to by organizational stakeholders


[User] What outcome is expected by GV.RM-01?

[Assistant] Risk management objectives are established and agreed to by organizational stakeholders


[User] What is GV.RM-02?

[Assistant] Risk appetite and risk tolerance statements are established, communicated, and maintained


[User] Explain the requirement of GV.RM-02.

[Assistant] Risk appetite and risk tolerance statements are established, communicated, and maintained


[User] What outcome is expected by GV.RM-02?

[Assistant] Risk appetite and risk tolerance statements are established, communicated, and maintained


[User] What is GV.RM-03?

[Assistant] Cybersecurity risk management activities and outcomes are included in enterprise risk management processes


[User] Explain the requirement of GV.RM-03.

[Assistant] Cybersecurity risk management activities and outcomes are included in enterprise risk management processes


[User] What outcome is expected by GV.RM-03?

[Assistant] Cybersecurity risk management activities and outcomes are included in enterprise risk management processes


[User] What is GV.RM-04?

[Assistant] Strategic direction that describes appropriate risk response options is established and communicated


[User] Explain the requirement of GV.RM-04.

[Assistant] Strategic direction that describes appropriate risk response options is established and communicated


[User] What outcome is expected by GV.RM-04?

[Assistant] Strategic direction that describes appropriate risk response options is established and communicated


[User] What is GV.RM-05?

[Assistant] Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties


[User] Explain the requirement of GV.RM-05.

[Assistant] Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties


[User] What outcome is expected by GV.RM-05?

[Assistant] Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties


[User] What is GV.RM-06?

[Assistant] A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated


[User] Explain the requirement of GV.RM-06.

[Assistant] A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated


[User] What outcome is expected by GV.RM-06?

[Assistant] A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated


[User] What is GV.RM-07?

[Assistant] Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions


[User] Explain the requirement of GV.RM-07.

[Assistant] Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions


[User] What outcome is expected by GV.RM-07?

[Assistant] Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions


[User] What is GV.RR-01?

[Assistant] Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving


[User] Explain the requirement of GV.RR-01.

[Assistant] Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving


[User] What outcome is expected by GV.RR-01?

[Assistant] Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving


[User] What is GV.RR-02?

[Assistant] Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced


[User] Explain the requirement of GV.RR-02.

[Assistant] Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced


[User] What outcome is expected by GV.RR-02?

[Assistant] Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced


[User] What is GV.RR-03?

[Assistant] Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies


[User] Explain the requirement of GV.RR-03.

[Assistant] Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies


[User] What outcome is expected by GV.RR-03?

[Assistant] Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies


[User] What is GV.RR-04?

[Assistant] Cybersecurity is included in human resources practices


[User] Explain the requirement of GV.RR-04.

[Assistant] Cybersecurity is included in human resources practices


[User] What outcome is expected by GV.RR-04?

[Assistant] Cybersecurity is included in human resources practices


[User] What is GV.PO-01?

[Assistant] Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced


[User] Explain the requirement of GV.PO-01.

[Assistant] Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced


[User] What outcome is expected by GV.PO-01?

[Assistant] Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced


[User] What is GV.PO-02?

[Assistant] Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission


[User] Explain the requirement of GV.PO-02.

[Assistant] Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission


[User] What outcome is expected by GV.PO-02?

[Assistant] Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission


[User] What is GV.OV-01?

[Assistant] Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction


[User] Explain the requirement of GV.OV-01.

[Assistant] Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction


[User] What outcome is expected by GV.OV-01?

[Assistant] Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction


[User] What is GV.OV-02?

[Assistant] The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks


[User] Explain the requirement of GV.OV-02.

[Assistant] The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks


[User] What outcome is expected by GV.OV-02?

[Assistant] The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks


[User] What is GV.OV-03?

[Assistant] Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed


[User] Explain the requirement of GV.OV-03.

[Assistant] Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed


[User] What outcome is expected by GV.OV-03?

[Assistant] Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed


[User] What is GV.SC-01?

[Assistant] A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders


[User] Explain the requirement of GV.SC-01.

[Assistant] A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders


[User] What outcome is expected by GV.SC-01?

[Assistant] A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders


[User] What is GV.SC-02?

[Assistant] Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally


[User] Explain the requirement of GV.SC-02.

[Assistant] Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally


[User] What outcome is expected by GV.SC-02?

[Assistant] Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally


[User] What is GV.SC-03?

[Assistant] Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes


[User] Explain the requirement of GV.SC-03.

[Assistant] Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes


[User] What outcome is expected by GV.SC-03?

[Assistant] Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes


[User] What is GV.SC-04?

[Assistant] Suppliers are known and prioritized by criticality


[User] Explain the requirement of GV.SC-04.

[Assistant] Suppliers are known and prioritized by criticality