[User] What outcome is expected by DE.AE-05?

[Assistant] Incident alert thresholds are established


[User] What is WR-DE.AE-05?

[Assistant] Moved to DE.AE-08


[User] Explain WR-DE.AE-05.

[Assistant] Moved to DE.AE-08


[User] What is DE.AE-06?

[Assistant] Information on adverse events is provided to authorized staff and tools


[User] Explain the requirement of DE.AE-06.

[Assistant] Information on adverse events is provided to authorized staff and tools


[User] What outcome is expected by DE.AE-06?

[Assistant] Information on adverse events is provided to authorized staff and tools


[User] What is DE.AE-06.299? (Ex1)

[Assistant] Use cybersecurity software to generate alerts and provide them to the security operations center (SOC), incident responders, and incident response tools


[User] Explain DE.AE-06.299.

[Assistant] Use cybersecurity software to generate alerts and provide them to the security operations center (SOC), incident responders, and incident response tools


[User] What is DE.AE-06.300? (Ex2)

[Assistant] Incident responders and other authorized personnel can access log analysis findings at all times


[User] Explain DE.AE-06.300.

[Assistant] Incident responders and other authorized personnel can access log analysis findings at all times


[User] What is DE.AE-06.301? (Ex3)

[Assistant] Automatically create and assign tickets in the organization's ticketing system when certain types of alerts occur


[User] Explain DE.AE-06.301.

[Assistant] Automatically create and assign tickets in the organization's ticketing system when certain types of alerts occur


[User] What is DE.AE-06.302? (Ex4)

[Assistant] Manually create and assign tickets in the organization's ticketing system when technical staff discover indicators of compromise


[User] Explain DE.AE-06.302.

[Assistant] Manually create and assign tickets in the organization's ticketing system when technical staff discover indicators of compromise


[User] What is first? (1st)

[Assistant] 1st Party Risk


[User] Explain first.

[Assistant] 1st Party Risk


[User] What is DE.AE-07?

[Assistant] Cyber threat intelligence and other contextual information are integrated into the analysis


[User] Explain the requirement of DE.AE-07.

[Assistant] Cyber threat intelligence and other contextual information are integrated into the analysis


[User] What outcome is expected by DE.AE-07?

[Assistant] Cyber threat intelligence and other contextual information are integrated into the analysis


[User] What is DE.AE-07.303? (Ex1)

[Assistant] Securely provide cyber threat intelligence feeds to detection technologies, processes, and personnel


[User] Explain DE.AE-07.303.

[Assistant] Securely provide cyber threat intelligence feeds to detection technologies, processes, and personnel


[User] What is DE.AE-07.304? (Ex2)

[Assistant] Securely provide information from asset inventories to detection technologies, processes, and personnel


[User] Explain DE.AE-07.304.

[Assistant] Securely provide information from asset inventories to detection technologies, processes, and personnel


[User] What is DE.AE-07.305? (Ex3)

[Assistant] Rapidly acquire and analyze vulnerability disclosures for the organization's technologies from suppliers, vendors, and third-party security advisories


[User] Explain DE.AE-07.305.

[Assistant] Rapidly acquire and analyze vulnerability disclosures for the organization's technologies from suppliers, vendors, and third-party security advisories


[User] What is first? (1st)

[Assistant] 1st Party Risk


[User] Explain first.

[Assistant] 1st Party Risk


[User] What is DE.AE-08?

[Assistant] Incidents are declared when adverse events meet the defined incident criteria


[User] Explain the requirement of DE.AE-08.

[Assistant] Incidents are declared when adverse events meet the defined incident criteria


[User] What outcome is expected by DE.AE-08?

[Assistant] Incidents are declared when adverse events meet the defined incident criteria


[User] What is DE.AE-08.306? (Ex1)

[Assistant] Apply incident criteria to known and assumed characteristics of activity in order to determine whether an incident should be declared


[User] Explain DE.AE-08.306.

[Assistant] Apply incident criteria to known and assumed characteristics of activity in order to determine whether an incident should be declared


[User] What is DE.AE-08.307? (Ex2)

[Assistant] Take known false positives into account when applying incident criteria


[User] Explain DE.AE-08.307.

[Assistant] Take known false positives into account when applying incident criteria


[User] What is first? (1st)

[Assistant] 1st Party Risk


[User] Explain first.

[Assistant] 1st Party Risk


[User] What is DE.DP-01?

[Assistant] Roles and responsibilities for detection are well defined to ensure accountability


[User] Explain the requirement of DE.DP-01.

[Assistant] Roles and responsibilities for detection are well defined to ensure accountability


[User] What outcome is expected by DE.DP-01?

[Assistant] Roles and responsibilities for detection are well defined to ensure accountability


[User] What is WR-DE.DP-01?

[Assistant] Incorporated into GV.RR-02


[User] Explain WR-DE.DP-01.

[Assistant] Incorporated into GV.RR-02


[User] What is DE.DP-02?

[Assistant] Detection activities comply with all applicable requirements


[User] Explain the requirement of DE.DP-02.

[Assistant] Detection activities comply with all applicable requirements


[User] What outcome is expected by DE.DP-02?

[Assistant] Detection activities comply with all applicable requirements


[User] What is WR-DE.DP-02?

[Assistant] Incorporated into DE.AE


[User] Explain WR-DE.DP-02.

[Assistant] Incorporated into DE.AE


[User] What is DE.DP-03?

[Assistant] Detection processes are tested


[User] Explain the requirement of DE.DP-03.

[Assistant] Detection processes are tested


[User] What outcome is expected by DE.DP-03?

[Assistant] Detection processes are tested


[User] What is WR-DE.DP-03?

[Assistant] Incorporated into ID.IM-02


[User] Explain WR-DE.DP-03.

[Assistant] Incorporated into ID.IM-02


[User] What is DE.DP-04?

[Assistant] Event detection information is communicated


[User] Explain the requirement of DE.DP-04.

[Assistant] Event detection information is communicated


[User] What outcome is expected by DE.DP-04?

[Assistant] Event detection information is communicated


[User] What is WR-DE.DP-04?

[Assistant] Incorporated into DE.AE-06


[User] Explain WR-DE.DP-04.

[Assistant] Incorporated into DE.AE-06


[User] What is DE.DP-05?

[Assistant] Detection processes are continuously improved


[User] Explain the requirement of DE.DP-05.

[Assistant] Detection processes are continuously improved


[User] What outcome is expected by DE.DP-05?

[Assistant] Detection processes are continuously improved


[User] What is WR-DE.DP-05?

[Assistant] Incorporated into ID.IM, ID.IM-03


[User] Explain WR-DE.DP-05.

[Assistant] Incorporated into ID.IM, ID.IM-03


[User] What is WR-DE.DP?

[Assistant] Incorporated into other Categories and Functions


[User] Explain WR-DE.DP.

[Assistant] Incorporated into other Categories and Functions


[User] What is RS? (RESPOND)

[Assistant] Actions regarding a detected cybersecurity incident are taken


[User] Summarize the scope of RS.

[Assistant] Actions regarding a detected cybersecurity incident are taken


[User] What does RS cover?

[Assistant] Actions regarding a detected cybersecurity incident are taken


[User] What is RS.MA? (Incident Management)

[Assistant] Responses to detected cybersecurity incidents are managed


[User] Summarize the scope of RS.MA.

[Assistant] Responses to detected cybersecurity incidents are managed


[User] What does RS.MA cover?

[Assistant] Responses to detected cybersecurity incidents are managed


[User] What is RS.MA-01?

[Assistant] The incident response plan is executed in coordination with relevant third parties once an incident is declared


[User] Explain the requirement of RS.MA-01.

[Assistant] The incident response plan is executed in coordination with relevant third parties once an incident is declared


[User] What outcome is expected by RS.MA-01?

[Assistant] The incident response plan is executed in coordination with relevant third parties once an incident is declared


[User] What is RS.MA-01.308? (Ex1)

[Assistant] Detection technologies automatically report confirmed incidents


[User] Explain RS.MA-01.308.

[Assistant] Detection technologies automatically report confirmed incidents


[User] What is RS.MA-01.309? (Ex2)

[Assistant] Request incident response assistance from the organization's incident response outsourcer


[User] Explain RS.MA-01.309.

[Assistant] Request incident response assistance from the organization's incident response outsourcer


[User] What is RS.MA-01.310? (Ex3)

[Assistant] Designate an incident lead for each incident


[User] Explain RS.MA-01.310.

[Assistant] Designate an incident lead for each incident


[User] What is RS.MA-01.311? (Ex4)

[Assistant] Initiate execution of additional cybersecurity plans as needed to support incident response (for example, business continuity and disaster recovery)


[User] Explain RS.MA-01.311.

[Assistant] Initiate execution of additional cybersecurity plans as needed to support incident response (for example, business continuity and disaster recovery)


[User] What is third? (3rd)

[Assistant] 3rd Party Risk


[User] Explain third.

[Assistant] 3rd Party Risk


[User] What is RS.MA-02?

[Assistant] Incident reports are triaged and validated


[User] Explain the requirement of RS.MA-02.

[Assistant] Incident reports are triaged and validated


[User] What outcome is expected by RS.MA-02?

[Assistant] Incident reports are triaged and validated


[User] What is first? (1st)

[Assistant] 1st Party Risk


[User] Explain first.

[Assistant] 1st Party Risk


[User] What is RS.MA-02.312? (Ex1)

[Assistant] Preliminarily review incident reports to confirm that they are cybersecurity-related and necessitate incident response activities


[User] Explain RS.MA-02.312.

[Assistant] Preliminarily review incident reports to confirm that they are cybersecurity-related and necessitate incident response activities


[User] What is RS.MA-02.313? (Ex2)

[Assistant] Apply criteria to estimate the severity of an incident


[User] Explain RS.MA-02.313.

[Assistant] Apply criteria to estimate the severity of an incident


[User] What is RS.MA-03?

[Assistant] Incidents are categorized and prioritized


[User] Explain the requirement of RS.MA-03.

[Assistant] Incidents are categorized and prioritized


[User] What outcome is expected by RS.MA-03?

[Assistant] Incidents are categorized and prioritized


[User] What is first? (1st)

[Assistant] 1st Party Risk


[User] Explain first.

[Assistant] 1st Party Risk


[User] What is RS.MA-03.314? (Ex1)

[Assistant] Further review and categorize incidents based on the type of incident (e.g., data breach, ransomware, DDoS, account compromise)


[User] Explain RS.MA-03.314.

[Assistant] Further review and categorize incidents based on the type of incident (e.g., data breach, ransomware, DDoS, account compromise)


[User] What is RS.MA-03.315? (Ex2)

[Assistant] Prioritize incidents based on their scope, likely impact, and time-critical nature


[User] Explain RS.MA-03.315.

[Assistant] Prioritize incidents based on their scope, likely impact, and time-critical nature


[User] What is RS.MA-03.316? (Ex3)

[Assistant] Select incident response strategies for active incidents by balancing the need to quickly recover from an incident with the need to observe the attacker or conduct a more thorough investigation


[User] Explain RS.MA-03.316.

[Assistant] Select incident response strategies for active incidents by balancing the need to quickly recover from an incident with the need to observe the attacker or conduct a more thorough investigation


[User] What is RS.MA-04?

[Assistant] Incidents are escalated or elevated as needed


[User] Explain the requirement of RS.MA-04.

[Assistant] Incidents are escalated or elevated as needed


[User] What outcome is expected by RS.MA-04?

[Assistant] Incidents are escalated or elevated as needed


[User] What is first? (1st)

[Assistant] 1st Party Risk


[User] Explain first.

[Assistant] 1st Party Risk


[User] What is RS.MA-04.317? (Ex1)

[Assistant] Track and validate the status of all ongoing incidents


[User] Explain RS.MA-04.317.

[Assistant] Track and validate the status of all ongoing incidents


[User] What is RS.MA-04.318? (Ex2)

[Assistant] Coordinate incident escalation or elevation with designated internal and external stakeholders


[User] Explain RS.MA-04.318.

[Assistant] Coordinate incident escalation or elevation with designated internal and external stakeholders


[User] What is RS.MA-05?

[Assistant] The criteria for initiating incident recovery are applied


[User] Explain the requirement of RS.MA-05.

[Assistant] The criteria for initiating incident recovery are applied


[User] What outcome is expected by RS.MA-05?

[Assistant] The criteria for initiating incident recovery are applied


[User] What is first? (1st)

[Assistant] 1st Party Risk


[User] Explain first.

[Assistant] 1st Party Risk


[User] What is RS.MA-05.319? (Ex1)

[Assistant] Apply incident recovery criteria to known and assumed characteristics of the incident to determine whether incident recovery processes should be initiated


[User] Explain RS.MA-05.319.

[Assistant] Apply incident recovery criteria to known and assumed characteristics of the incident to determine whether incident recovery processes should be initiated


[User] What is RS.MA-05.320? (Ex2)

[Assistant] Take the possible operational disruption of incident recovery activities into account


[User] Explain RS.MA-05.320.

[Assistant] Take the possible operational disruption of incident recovery activities into account


[User] What is RS.AN? (Incident Analysis)

[Assistant] Investigations are conducted to ensure effective response and support forensics and recovery activities


[User] Summarize the scope of RS.AN.

[Assistant] Investigations are conducted to ensure effective response and support forensics and recovery activities


[User] What does RS.AN cover?

[Assistant] Investigations are conducted to ensure effective response and support forensics and recovery activities


[User] What is RS.AN-01?

[Assistant] Notifications from detection systems are investigated


[User] Explain the requirement of RS.AN-01.

[Assistant] Notifications from detection systems are investigated


[User] What outcome is expected by RS.AN-01?

[Assistant] Notifications from detection systems are investigated


[User] What is WR-RS.AN-01?

[Assistant] Incorporated into RS.MA-02


[User] Explain WR-RS.AN-01.

[Assistant] Incorporated into RS.MA-02


[User] What is RS.AN-02?

[Assistant] The impact of the incident is understood


[User] Explain the requirement of RS.AN-02.

[Assistant] The impact of the incident is understood


[User] What outcome is expected by RS.AN-02?

[Assistant] The impact of the incident is understood


[User] What is WR-RS.AN-02?

[Assistant] Incorporated into RS.MA-02, RS.MA-03, RS.MA-04


[User] Explain WR-RS.AN-02.

[Assistant] Incorporated into RS.MA-02, RS.MA-03, RS.MA-04


[User] What is RS.AN-03?

[Assistant] Analysis is performed to establish what has taken place during an incident and the root cause of the incident


[User] Explain the requirement of RS.AN-03.

[Assistant] Analysis is performed to establish what has taken place during an incident and the root cause of the incident


[User] What outcome is expected by RS.AN-03?

[Assistant] Analysis is performed to establish what has taken place during an incident and the root cause of the incident


[User] What is first? (1st)

[Assistant] 1st Party Risk


[User] Explain first.

[Assistant] 1st Party Risk


[User] What is RS.AN-03.321? (Ex1)

[Assistant] Determine the sequence of events that occurred during the incident and which assets and resources were involved in each event


[User] Explain RS.AN-03.321.

[Assistant] Determine the sequence of events that occurred during the incident and which assets and resources were involved in each event


[User] What is RS.AN-03.322? (Ex2)

[Assistant] Attempt to determine what vulnerabilities, threats, and threat actors were directly or indirectly involved in the incident


[User] Explain RS.AN-03.322.

[Assistant] Attempt to determine what vulnerabilities, threats, and threat actors were directly or indirectly involved in the incident


[User] What is RS.AN-03.323? (Ex3)

[Assistant] Analyze the incident to find the underlying, systemic root causes


[User] Explain RS.AN-03.323.

[Assistant] Analyze the incident to find the underlying, systemic root causes


[User] What is RS.AN-03.324? (Ex4)

[Assistant] Check any cyber deception technology for additional information on attacker behavior


[User] Explain RS.AN-03.324.

[Assistant] Check any cyber deception technology for additional information on attacker behavior


[User] What is RS.AN-04?

[Assistant] Incidents are categorized consistent with response plans


[User] Explain the requirement of RS.AN-04.

[Assistant] Incidents are categorized consistent with response plans


[User] What outcome is expected by RS.AN-04?

[Assistant] Incidents are categorized consistent with response plans


[User] What is WR-RS.AN-04?

[Assistant] Moved to RS.MA-03


[User] Explain WR-RS.AN-04.

[Assistant] Moved to RS.MA-03


[User] What is RS.AN-05?

[Assistant] Processes are established to receive, analyze and respond to vulnerabilities disclosed to the organization from internal and external sources (e.g. internal testing, security bulletins, or security researchers)


[User] Explain the requirement of RS.AN-05.

[Assistant] Processes are established to receive, analyze and respond to vulnerabilities disclosed to the organization from internal and external sources (e.g. internal testing, security bulletins, or security researchers)


[User] What outcome is expected by RS.AN-05?

[Assistant] Processes are established to receive, analyze and respond to vulnerabilities disclosed to the organization from internal and external sources (e.g. internal testing, security bulletins, or security researchers)


[User] What is WR-RS.AN-05?

[Assistant] Moved to ID.RA-08


[User] Explain WR-RS.AN-05.

[Assistant] Moved to ID.RA-08


[User] What is RS.AN-06?

[Assistant] Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved


[User] Explain the requirement of RS.AN-06.

[Assistant] Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved


[User] What outcome is expected by RS.AN-06?

[Assistant] Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved


[User] What is first? (1st)

[Assistant] 1st Party Risk


[User] Explain first.

[Assistant] 1st Party Risk


[User] What is RS.AN-06.325? (Ex1)

[Assistant] Require each incident responder and others (e.g., system administrators, cybersecurity engineers) who perform incident response tasks to record their actions and make the record immutable


[User] Explain RS.AN-06.325.

[Assistant] Require each incident responder and others (e.g., system administrators, cybersecurity engineers) who perform incident response tasks to record their actions and make the record immutable


[User] What is RS.AN-06.326? (Ex2)

[Assistant] Require the incident lead to document the incident in detail and be responsible for preserving the integrity of the documentation and the sources of all information being reported


[User] Explain RS.AN-06.326.

[Assistant] Require the incident lead to document the incident in detail and be responsible for preserving the integrity of the documentation and the sources of all information being reported


[User] What is RS.AN-07?

[Assistant] Incident data and metadata are collected, and their integrity and provenance are preserved


[User] Explain the requirement of RS.AN-07.

[Assistant] Incident data and metadata are collected, and their integrity and provenance are preserved


[User] What outcome is expected by RS.AN-07?

[Assistant] Incident data and metadata are collected, and their integrity and provenance are preserved


[User] What is first? (1st)

[Assistant] 1st Party Risk


[User] Explain first.

[Assistant] 1st Party Risk


[User] What is RS.AN-07.327? (Ex1)

[Assistant] Collect, preserve, and safeguard the integrity of all pertinent incident data and metadata (e.g., data source, date/time of collection) based on evidence preservation and chain-of-custody procedures


[User] Explain RS.AN-07.327.

[Assistant] Collect, preserve, and safeguard the integrity of all pertinent incident data and metadata (e.g., data source, date/time of collection) based on evidence preservation and chain-of-custody procedures


[User] What is RS.AN-08?

[Assistant] An incident's magnitude is estimated and validated


[User] Explain the requirement of RS.AN-08.

[Assistant] An incident's magnitude is estimated and validated


[User] What outcome is expected by RS.AN-08?

[Assistant] An incident's magnitude is estimated and validated


[User] What is first? (1st)

[Assistant] 1st Party Risk


[User] Explain first.

[Assistant] 1st Party Risk


[User] What is RS.AN-08.328? (Ex1)

[Assistant] Review other potential targets of the incident to search for indicators of compromise and evidence of persistence


[User] Explain RS.AN-08.328.

[Assistant] Review other potential targets of the incident to search for indicators of compromise and evidence of persistence


[User] What is RS.AN-08.329? (Ex2)

[Assistant] Automatically run tools on targets to look for indicators of compromise and evidence of persistence


[User] Explain RS.AN-08.329.

[Assistant] Automatically run tools on targets to look for indicators of compromise and evidence of persistence


[User] What is RS.CO? (Incident Response Reporting and Communication)

[Assistant] Response activities are coordinated with internal and external stakeholders as required by laws, regulations, or policies


[User] Summarize the scope of RS.CO.

[Assistant] Response activities are coordinated with internal and external stakeholders as required by laws, regulations, or policies


[User] What does RS.CO cover?

[Assistant] Response activities are coordinated with internal and external stakeholders as required by laws, regulations, or policies


[User] What is RS.CO-01?

[Assistant] Personnel know their roles and order of operations when a response is needed


[User] Explain the requirement of RS.CO-01.

[Assistant] Personnel know their roles and order of operations when a response is needed


[User] What outcome is expected by RS.CO-01?

[Assistant] Personnel know their roles and order of operations when a response is needed


[User] What is WR-RS.CO-01?

[Assistant] Incorporated into PR.AT-01


[User] Explain WR-RS.CO-01.

[Assistant] Incorporated into PR.AT-01


[User] What is RS.CO-02?

[Assistant] Internal and external stakeholders are notified of incidents


[User] Explain the requirement of RS.CO-02.

[Assistant] Internal and external stakeholders are notified of incidents


[User] What outcome is expected by RS.CO-02?

[Assistant] Internal and external stakeholders are notified of incidents


[User] What is first? (1st)

[Assistant] 1st Party Risk


[User] Explain first.

[Assistant] 1st Party Risk


[User] What is third? (3rd)

[Assistant] 3rd Party Risk


[User] Explain third.

[Assistant] 3rd Party Risk


[User] What is RS.CO-02.330? (Ex1)

[Assistant] Follow the organization's breach notification procedures after discovering a data breach incident, including notifying affected customers


[User] Explain RS.CO-02.330.

[Assistant] Follow the organization's breach notification procedures after discovering a data breach incident, including notifying affected customers


[User] What is RS.CO-02.331? (Ex2)

[Assistant] Notify business partners and customers of incidents in accordance with contractual requirements


[User] Explain RS.CO-02.331.

[Assistant] Notify business partners and customers of incidents in accordance with contractual requirements


[User] What is RS.CO-02.332? (Ex3)

[Assistant] Notify law enforcement agencies and regulatory bodies of incidents based on criteria in the incident response plan and management approval


[User] Explain RS.CO-02.332.

[Assistant] Notify law enforcement agencies and regulatory bodies of incidents based on criteria in the incident response plan and management approval


[User] What is RS.CO-03?

[Assistant] Information is shared with designated internal and external stakeholders


[User] Explain the requirement of RS.CO-03.

[Assistant] Information is shared with designated internal and external stakeholders


[User] What outcome is expected by RS.CO-03?

[Assistant] Information is shared with designated internal and external stakeholders


[User] What is first? (1st)

[Assistant] 1st Party Risk


[User] Explain first.

[Assistant] 1st Party Risk


[User] What is third? (3rd)

[Assistant] 3rd Party Risk


[User] Explain third.

[Assistant] 3rd Party Risk


[User] What is RS.CO-03.333? (Ex1)

[Assistant] Securely share information consistent with response plans and information sharing agreements


[User] Explain RS.CO-03.333.

[Assistant] Securely share information consistent with response plans and information sharing agreements


[User] What is RS.CO-03.334? (Ex2)

[Assistant] Voluntarily share information about an attacker's observed TTPs, with all sensitive data removed, with an Information Sharing and Analysis Center (ISAC)


[User] Explain RS.CO-03.334.

[Assistant] Voluntarily share information about an attacker's observed TTPs, with all sensitive data removed, with an Information Sharing and Analysis Center (ISAC)


[User] What is RS.CO-03.335? (Ex3)

[Assistant] Notify HR when malicious insider activity occurs


[User] Explain RS.CO-03.335.

[Assistant] Notify HR when malicious insider activity occurs


[User] What is RS.CO-03.336? (Ex4)

[Assistant] Regularly update senior leadership on the status of major incidents


[User] Explain RS.CO-03.336.

[Assistant] Regularly update senior leadership on the status of major incidents


[User] What is RS.CO-03.337? (Ex5)

[Assistant] Follow the rules and protocols defined in contracts for incident information sharing between the organization and its suppliers


[User] Explain RS.CO-03.337.

[Assistant] Follow the rules and protocols defined in contracts for incident information sharing between the organization and its suppliers


[User] What is RS.CO-03.338? (Ex6)

[Assistant] Coordinate crisis communication methods between the organization and its critical suppliers


[User] Explain RS.CO-03.338.

[Assistant] Coordinate crisis communication methods between the organization and its critical suppliers


[User] What is RS.CO-04?

[Assistant] Coordination with stakeholders occurs consistent with response plans


[User] Explain the requirement of RS.CO-04.

[Assistant] Coordination with stakeholders occurs consistent with response plans


[User] What outcome is expected by RS.CO-04?

[Assistant] Coordination with stakeholders occurs consistent with response plans


[User] What is WR-RS.CO-04?

[Assistant] Incorporated into RS.MA-01, RS.MA-04


[User] Explain WR-RS.CO-04.

[Assistant] Incorporated into RS.MA-01, RS.MA-04


[User] What is RS.CO-05?

[Assistant] Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness


[User] Explain the requirement of RS.CO-05.

[Assistant] Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness


[User] What outcome is expected by RS.CO-05?

[Assistant] Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness


[User] What is WR-RS.CO-05?

[Assistant] Incorporated into RS.CO-03


[User] Explain WR-RS.CO-05.

[Assistant] Incorporated into RS.CO-03


[User] What is RS.MI? (Incident Mitigation)

[Assistant] Activities are performed to prevent expansion of an event and mitigate its effects


[User] Summarize the scope of RS.MI.

[Assistant] Activities are performed to prevent expansion of an event and mitigate its effects


[User] What does RS.MI cover?

[Assistant] Activities are performed to prevent expansion of an event and mitigate its effects


[User] What is RS.MI-01?

[Assistant] Incidents are contained


[User] Explain the requirement of RS.MI-01.

[Assistant] Incidents are contained


[User] What outcome is expected by RS.MI-01?

[Assistant] Incidents are contained


[User] What is first? (1st)

[Assistant] 1st Party Risk


[User] Explain first.

[Assistant] 1st Party Risk


[User] What is third? (3rd)

[Assistant] 3rd Party Risk


[User] Explain third.

[Assistant] 3rd Party Risk


[User] What is RS.MI-01.339? (Ex1)

[Assistant] Cybersecurity technologies (e.g., antivirus software) and cybersecurity features of other technologies (e.g., operating systems, network infrastructure devices) automatically perform containment actions


[User] Explain RS.MI-01.339.

[Assistant] Cybersecurity technologies (e.g., antivirus software) and cybersecurity features of other technologies (e.g., operating systems, network infrastructure devices) automatically perform containment actions


[User] What is RS.MI-01.340? (Ex2)

[Assistant] Allow incident responders to manually select and perform containment actions


[User] Explain RS.MI-01.340.

[Assistant] Allow incident responders to manually select and perform containment actions


[User] What is RS.MI-01.341? (Ex3)

[Assistant] Allow a third party (e.g., internet service provider, managed security service provider) to perform containment actions on behalf of the organization


[User] Explain RS.MI-01.341.

[Assistant] Allow a third party (e.g., internet service provider, managed security service provider) to perform containment actions on behalf of the organization


[User] What is RS.MI-01.342? (Ex4)

[Assistant] Automatically transfer compromised endpoints to a remediation virtual local area network (VLAN)


[User] Explain RS.MI-01.342.

[Assistant] Automatically transfer compromised endpoints to a remediation virtual local area network (VLAN)


[User] What is RS.MI-02?

[Assistant] Incidents are eradicated


[User] Explain the requirement of RS.MI-02.

[Assistant] Incidents are eradicated


[User] What outcome is expected by RS.MI-02?

[Assistant] Incidents are eradicated


[User] What is first? (1st)

[Assistant] 1st Party Risk


[User] Explain first.

[Assistant] 1st Party Risk


[User] What is third? (3rd)

[Assistant] 3rd Party Risk


[User] Explain third.

[Assistant] 3rd Party Risk


[User] What is RS.MI-02.343? (Ex1)

[Assistant] Cybersecurity technologies and cybersecurity features of other technologies (e.g., operating systems, network infrastructure devices) automatically perform eradication actions


[User] Explain RS.MI-02.343.

[Assistant] Cybersecurity technologies and cybersecurity features of other technologies (e.g., operating systems, network infrastructure devices) automatically perform eradication actions


[User] What is RS.MI-02.344? (Ex2)

[Assistant] Allow incident responders to manually select and perform eradication actions


[User] Explain RS.MI-02.344.

[Assistant] Allow incident responders to manually select and perform eradication actions


[User] What is RS.MI-02.345? (Ex3)

[Assistant] Allow a third party (e.g., managed security service provider) to perform eradication actions on behalf of the organization


[User] Explain RS.MI-02.345.

[Assistant] Allow a third party (e.g., managed security service provider) to perform eradication actions on behalf of the organization


[User] What is RS.MI-03?

[Assistant] Newly identified vulnerabilities are mitigated or documented as accepted risks


[User] Explain the requirement of RS.MI-03.

[Assistant] Newly identified vulnerabilities are mitigated or documented as accepted risks


[User] What outcome is expected by RS.MI-03?

[Assistant] Newly identified vulnerabilities are mitigated or documented as accepted risks


[User] What is WR-RS.MI-03?

[Assistant] Incorporated into ID.RA-06


[User] Explain WR-RS.MI-03.

[Assistant] Incorporated into ID.RA-06


[User] What is RS.RP-01?

[Assistant] Response plan is executed during or after an incident


[User] Explain the requirement of RS.RP-01.

[Assistant] Response plan is executed during or after an incident


[User] What outcome is expected by RS.RP-01?

[Assistant] Response plan is executed during or after an incident


[User] What is WR-RS.RP-01?

[Assistant] Incorporated into RS.MA-01


[User] Explain WR-RS.RP-01.

[Assistant] Incorporated into RS.MA-01


[User] What is WR-RS.RP?

[Assistant] Incorporated into RS.MA


[User] Explain WR-RS.RP.

[Assistant] Incorporated into RS.MA


[User] What is RS.IM-01?

[Assistant] Response plans incorporate lessons learned


[User] Explain the requirement of RS.IM-01.

[Assistant] Response plans incorporate lessons learned


[User] What outcome is expected by RS.IM-01?

[Assistant] Response plans incorporate lessons learned


[User] What is WR-RS.IM-01?

[Assistant] Incorporated into ID.IM-03, ID.IM-04


[User] Explain WR-RS.IM-01.

[Assistant] Incorporated into ID.IM-03, ID.IM-04


[User] What is RS.IM-02?

[Assistant] Response strategies are updated


[User] Explain the requirement of RS.IM-02.

[Assistant] Response strategies are updated


[User] What outcome is expected by RS.IM-02?

[Assistant] Response strategies are updated


[User] What is WR-RS.IM-02?

[Assistant] Incorporated into ID.IM-03


[User] Explain WR-RS.IM-02.

[Assistant] Incorporated into ID.IM-03


[User] What is WR-RS.IM?

[Assistant] Incorporated into ID.IM


[User] Explain WR-RS.IM.

[Assistant] Incorporated into ID.IM


[User] What is RC? (RECOVER)

[Assistant] Assets and operations affected by a cybersecurity incident are restored


[User] Summarize the scope of RC.

[Assistant] Assets and operations affected by a cybersecurity incident are restored


[User] What does RC cover?

[Assistant] Assets and operations affected by a cybersecurity incident are restored


[User] What is RC.RP? (Incident Recovery Plan Execution)

[Assistant] Restoration activities are performed to ensure operational availability of systems and services affected by cybersecurity incidents


[User] Summarize the scope of RC.RP.

[Assistant] Restoration activities are performed to ensure operational availability of systems and services affected by cybersecurity incidents


[User] What does RC.RP cover?

[Assistant] Restoration activities are performed to ensure operational availability of systems and services affected by cybersecurity incidents


[User] What is RC.RP-01?

[Assistant] The recovery portion of the incident response plan is executed once initiated from the incident response process


[User] Explain the requirement of RC.RP-01.

[Assistant] The recovery portion of the incident response plan is executed once initiated from the incident response process


[User] What outcome is expected by RC.RP-01?

[Assistant] The recovery portion of the incident response plan is executed once initiated from the incident response process


[User] What is first? (1st)

[Assistant] 1st Party Risk


[User] Explain first.

[Assistant] 1st Party Risk


[User] What is RC.RP-01.346? (Ex1)

[Assistant] Begin recovery procedures during or after incident response processes


[User] Explain RC.RP-01.346.

[Assistant] Begin recovery procedures during or after incident response processes


[User] What is RC.RP-01.347? (Ex2)

[Assistant] Make all individuals with recovery responsibilities aware of the plans for recovery and the authorizations required to implement each aspect of the plans


[User] Explain RC.RP-01.347.

[Assistant] Make all individuals with recovery responsibilities aware of the plans for recovery and the authorizations required to implement each aspect of the plans


[User] What is RC.RP-02?

[Assistant] Recovery actions are selected, scoped, prioritized, and performed


[User] Explain the requirement of RC.RP-02.

[Assistant] Recovery actions are selected, scoped, prioritized, and performed


[User] What outcome is expected by RC.RP-02?

[Assistant] Recovery actions are selected, scoped, prioritized, and performed


[User] What is first? (1st)

[Assistant] 1st Party Risk


[User] Explain first.

[Assistant] 1st Party Risk


[User] What is RC.RP-02.348? (Ex1)

[Assistant] Select recovery actions based on the criteria defined in the incident response plan and available resources


[User] Explain RC.RP-02.348.

[Assistant] Select recovery actions based on the criteria defined in the incident response plan and available resources


[User] What is RC.RP-02.349? (Ex2)

[Assistant] Change planned recovery actions based on a reassessment of organizational needs and resources


[User] Explain RC.RP-02.349.

[Assistant] Change planned recovery actions based on a reassessment of organizational needs and resources


[User] What is RC.RP-03?

[Assistant] The integrity of backups and other restoration assets is verified before using them for restoration


[User] Explain the requirement of RC.RP-03.

[Assistant] The integrity of backups and other restoration assets is verified before using them for restoration


[User] What outcome is expected by RC.RP-03?

[Assistant] The integrity of backups and other restoration assets is verified before using them for restoration


[User] What is first? (1st)

[Assistant] 1st Party Risk


[User] Explain first.

[Assistant] 1st Party Risk


[User] What is RC.RP-03.350? (Ex1)

[Assistant] Check restoration assets for indicators of compromise, file corruption, and other integrity issues before use


[User] Explain RC.RP-03.350.

[Assistant] Check restoration assets for indicators of compromise, file corruption, and other integrity issues before use


[User] What is RC.RP-04?

[Assistant] Critical mission functions and cybersecurity risk management are considered to establish post-incident operational norms


[User] Explain the requirement of RC.RP-04.

[Assistant] Critical mission functions and cybersecurity risk management are considered to establish post-incident operational norms


[User] What outcome is expected by RC.RP-04?

[Assistant] Critical mission functions and cybersecurity risk management are considered to establish post-incident operational norms


[User] What is first? (1st)

[Assistant] 1st Party Risk


[User] Explain first.

[Assistant] 1st Party Risk


[User] What is RC.RP-04.351? (Ex1)

[Assistant] Use business impact and system categorization records (including service delivery objectives) to validate that essential services are restored in the appropriate order


[User] Explain RC.RP-04.351.

[Assistant] Use business impact and system categorization records (including service delivery objectives) to validate that essential services are restored in the appropriate order


[User] What is RC.RP-04.352? (Ex2)

[Assistant] Work with system owners to confirm the successful restoration of systems and the return to normal operations


[User] Explain RC.RP-04.352.

[Assistant] Work with system owners to confirm the successful restoration of systems and the return to normal operations


[User] What is RC.RP-04.353? (Ex3)

[Assistant] Monitor the performance of restored systems to verify the adequacy of the restoration


[User] Explain RC.RP-04.353.

[Assistant] Monitor the performance of restored systems to verify the adequacy of the restoration


[User] What is RC.RP-05?

[Assistant] The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed


[User] Explain the requirement of RC.RP-05.

[Assistant] The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed


[User] What outcome is expected by RC.RP-05?

[Assistant] The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed


[User] What is first? (1st)

[Assistant] 1st Party Risk


[User] Explain first.

[Assistant] 1st Party Risk


[User] What is RC.RP-05.354? (Ex1)

[Assistant] Check restored assets for indicators of compromise and remediation of root causes of the incident before production use


[User] Explain RC.RP-05.354.

[Assistant] Check restored assets for indicators of compromise and remediation of root causes of the incident before production use


[User] What is RC.RP-05.355? (Ex2)

[Assistant] Verify the correctness and adequacy of the restoration actions taken before putting a restored system online


[User] Explain RC.RP-05.355.

[Assistant] Verify the correctness and adequacy of the restoration actions taken before putting a restored system online


[User] What is RC.RP-06?

[Assistant] The end of incident recovery is declared based on criteria, and incident-related documentation is completed


[User] Explain the requirement of RC.RP-06.

[Assistant] The end of incident recovery is declared based on criteria, and incident-related documentation is completed


[User] What outcome is expected by RC.RP-06?

[Assistant] The end of incident recovery is declared based on criteria, and incident-related documentation is completed


[User] What is first? (1st)

[Assistant] 1st Party Risk


[User] Explain first.

[Assistant] 1st Party Risk


[User] What is RC.RP-06.356? (Ex1)

[Assistant] Prepare an after-action report that documents the incident itself, the response and recovery actions taken, and lessons learned


[User] Explain RC.RP-06.356.

[Assistant] Prepare an after-action report that documents the incident itself, the response and recovery actions taken, and lessons learned


[User] What is RC.RP-06.357? (Ex2)

[Assistant] Declare the end of incident recovery once the criteria are met


[User] Explain RC.RP-06.357.

[Assistant] Declare the end of incident recovery once the criteria are met


[User] What is RC.CO? (Incident Recovery Communication)

[Assistant] Restoration activities are coordinated with internal and external parties


[User] Summarize the scope of RC.CO.

[Assistant] Restoration activities are coordinated with internal and external parties


[User] What does RC.CO cover?

[Assistant] Restoration activities are coordinated with internal and external parties


[User] What is RC.CO-01?

[Assistant] Public relations are managed


[User] Explain the requirement of RC.CO-01.

[Assistant] Public relations are managed


[User] What outcome is expected by RC.CO-01?

[Assistant] Public relations are managed


[User] What is WR-RC.CO-01?

[Assistant] Incorporated into RC.CO-04


[User] Explain WR-RC.CO-01.

[Assistant] Incorporated into RC.CO-04


[User] What is RC.CO-02?

[Assistant] Reputation is repaired after an incident


[User] Explain the requirement of RC.CO-02.

[Assistant] Reputation is repaired after an incident


[User] What outcome is expected by RC.CO-02?

[Assistant] Reputation is repaired after an incident


[User] What is WR-RC.CO-02?

[Assistant] Incorporated into RC.CO-04


[User] Explain WR-RC.CO-02.

[Assistant] Incorporated into RC.CO-04


[User] What is RC.CO-03?

[Assistant] Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders


[User] Explain the requirement of RC.CO-03.

[Assistant] Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders


[User] What outcome is expected by RC.CO-03?

[Assistant] Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders


[User] What is first? (1st)

[Assistant] 1st Party Risk


[User] Explain first.

[Assistant] 1st Party Risk


[User] What is third? (3rd)

[Assistant] 3rd Party Risk


[User] Explain third.

[Assistant] 3rd Party Risk


[User] What is RC.CO-03.358? (Ex1)

[Assistant] Securely share recovery information, including restoration progress, consistent with response plans and information sharing agreements


[User] Explain RC.CO-03.358.

[Assistant] Securely share recovery information, including restoration progress, consistent with response plans and information sharing agreements


[User] What is RC.CO-03.359? (Ex2)

[Assistant] Regularly update senior leadership on recovery status and restoration progress for major incidents


[User] Explain RC.CO-03.359.

[Assistant] Regularly update senior leadership on recovery status and restoration progress for major incidents


[User] What is RC.CO-03.360? (Ex3)

[Assistant] Follow the rules and protocols defined in contracts for incident information sharing between the organization and its suppliers


[User] Explain RC.CO-03.360.

[Assistant] Follow the rules and protocols defined in contracts for incident information sharing between the organization and its suppliers


[User] What is RC.CO-03.361? (Ex4)

[Assistant] Coordinate crisis communication between the organization and its critical suppliers


[User] Explain RC.CO-03.361.

[Assistant] Coordinate crisis communication between the organization and its critical suppliers


[User] What is RC.CO-04?

[Assistant] Public updates on incident recovery are shared using approved methods and messaging


[User] Explain the requirement of RC.CO-04.

[Assistant] Public updates on incident recovery are shared using approved methods and messaging


[User] What outcome is expected by RC.CO-04?

[Assistant] Public updates on incident recovery are shared using approved methods and messaging


[User] What is first? (1st)

[Assistant] 1st Party Risk


[User] Explain first.

[Assistant] 1st Party Risk


[User] What is RC.CO-04.362? (Ex1)

[Assistant] Follow the organization's breach notification procedures for recovering from a data breach incident


[User] Explain RC.CO-04.362.

[Assistant] Follow the organization's breach notification procedures for recovering from a data breach incident


[User] What is RC.CO-04.363? (Ex2)

[Assistant] Explain the steps being taken to recover from the incident and to prevent a recurrence


[User] Explain RC.CO-04.363.

[Assistant] Explain the steps being taken to recover from the incident and to prevent a recurrence


[User] What is RC.IM-01?

[Assistant] Recovery plans incorporate lessons learned


[User] Explain the requirement of RC.IM-01.

[Assistant] Recovery plans incorporate lessons learned


[User] What outcome is expected by RC.IM-01?

[Assistant] Recovery plans incorporate lessons learned


[User] What is WR-RC.IM-01?

[Assistant] Incorporated into ID.IM-03, ID.IM-04


[User] Explain WR-RC.IM-01.

[Assistant] Incorporated into ID.IM-03, ID.IM-04


[User] What is RC.IM-02?

[Assistant] Recovery strategies are updated


[User] Explain the requirement of RC.IM-02.

[Assistant] Recovery strategies are updated


[User] What outcome is expected by RC.IM-02?

[Assistant] Recovery strategies are updated


[User] What is WR-RC.IM-02?

[Assistant] Incorporated into ID.IM-03


[User] Explain WR-RC.IM-02.

[Assistant] Incorporated into ID.IM-03


[User] What is WR-RC.IM?

[Assistant] Incorporated into ID.IM


[User] Explain WR-RC.IM.

[Assistant] Incorporated into ID.IM


[User] What is GV.OC? (Organizational Context)

[Assistant] The circumstances - mission, stakeholder expectations, dependencies, and legal, regulatory, and contractual requirements - surrounding the organization's cybersecurity risk management decisions are understood


[User] Summarize the scope of GV.OC.

[Assistant] The circumstances - mission, stakeholder expectations, dependencies, and legal, regulatory, and contractual requirements - surrounding the organization's cybersecurity risk management decisions are understood


[User] What does GV.OC cover?

[Assistant] The circumstances - mission, stakeholder expectations, dependencies, and legal, regulatory, and contractual requirements - surrounding the organization's cybersecurity risk management decisions are understood


[User] What is GV.RM? (Risk Management Strategy)

[Assistant] The organization's priorities, constraints, risk tolerance and appetite statements, and assumptions are established, communicated, and used to support operational risk decisions


[User] Summarize the scope of GV.RM.

[Assistant] The organization's priorities, constraints, risk tolerance and appetite statements, and assumptions are established, communicated, and used to support operational risk decisions


[User] What does GV.RM cover?

[Assistant] The organization's priorities, constraints, risk tolerance and appetite statements, and assumptions are established, communicated, and used to support operational risk decisions


[User] What is GV.RR? (Roles, Responsibilities, and Authorities)

[Assistant] Cybersecurity roles, responsibilities, and authorities to foster accountability, performance assessment, and continuous improvement are established and communicated


[User] Summarize the scope of GV.RR.

[Assistant] Cybersecurity roles, responsibilities, and authorities to foster accountability, performance assessment, and continuous improvement are established and communicated


[User] What does GV.RR cover?

[Assistant] Cybersecurity roles, responsibilities, and authorities to foster accountability, performance assessment, and continuous improvement are established and communicated


[User] What is GV.PO? (Policy)

[Assistant] Organizational cybersecurity policy is established, communicated, and enforced


[User] Summarize the scope of GV.PO.

[Assistant] Organizational cybersecurity policy is established, communicated, and enforced


[User] What does GV.PO cover?

[Assistant] Organizational cybersecurity policy is established, communicated, and enforced


[User] What is GV.OV? (Oversight)

[Assistant] Results of organization-wide cybersecurity risk management activities and performance are used to inform, improve, and adjust the risk management strategy


[User] Summarize the scope of GV.OV.

[Assistant] Results of organization-wide cybersecurity risk management activities and performance are used to inform, improve, and adjust the risk management strategy


[User] What does GV.OV cover?

[Assistant] Results of organization-wide cybersecurity risk management activities and performance are used to inform, improve, and adjust the risk management strategy


[User] What is GV.SC? (Cybersecurity Supply Chain Risk Management)

[Assistant] Cyber supply chain risk management processes are identified, established, managed, monitored, and improved by organizational stakeholders


[User] Summarize the scope of GV.SC.

[Assistant] Cyber supply chain risk management processes are identified, established, managed, monitored, and improved by organizational stakeholders


[User] What does GV.SC cover?

[Assistant] Cyber supply chain risk management processes are identified, established, managed, monitored, and improved by organizational stakeholders


[User] What is ID.AM? (Asset Management)

[Assistant] Assets (e.g., data, hardware, software, systems, facilities, services, people) that enable the organization to achieve business purposes are identified and managed consistent with their relative importance to organizational objectives and the organization's risk strategy


[User] Summarize the scope of ID.AM.

[Assistant] Assets (e.g., data, hardware, software, systems, facilities, services, people) that enable the organization to achieve business purposes are identified and managed consistent with their relative importance to organizational objectives and the organization's risk strategy


[User] What does ID.AM cover?

[Assistant] Assets (e.g., data, hardware, software, systems, facilities, services, people) that enable the organization to achieve business purposes are identified and managed consistent with their relative importance to organizational objectives and the organization's risk strategy


[User] What is ID.RA? (Risk Assessment)

[Assistant] The cybersecurity risk to the organization, assets, and individuals is understood by the organization


[User] Summarize the scope of ID.RA.

[Assistant] The cybersecurity risk to the organization, assets, and individuals is understood by the organization


[User] What does ID.RA cover?

[Assistant] The cybersecurity risk to the organization, assets, and individuals is understood by the organization


[User] What is ID.IM? (Improvement)

[Assistant] Improvements to organizational cybersecurity risk management processes, procedures and activities are identified across all CSF Functions


[User] Summarize the scope of ID.IM.

[Assistant] Improvements to organizational cybersecurity risk management processes, procedures and activities are identified across all CSF Functions


[User] What does ID.IM cover?

[Assistant] Improvements to organizational cybersecurity risk management processes, procedures and activities are identified across all CSF Functions


[User] What is PR.AA? (Identity Management, Authentication, and Access Control)

[Assistant] Access to physical and logical assets is limited to authorized users, services, and hardware and  managed commensurate with the assessed risk of unauthorized access


[User] Summarize the scope of PR.AA.

[Assistant] Access to physical and logical assets is limited to authorized users, services, and hardware and  managed commensurate with the assessed risk of unauthorized access


[User] What does PR.AA cover?

[Assistant] Access to physical and logical assets is limited to authorized users, services, and hardware and  managed commensurate with the assessed risk of unauthorized access


[User] What is PR.AT? (Awareness and Training)

[Assistant] The organization's personnel are provided with cybersecurity awareness and training so that they can perform their cybersecurity-related tasks


[User] Summarize the scope of PR.AT.

[Assistant] The organization's personnel are provided with cybersecurity awareness and training so that they can perform their cybersecurity-related tasks


[User] What does PR.AT cover?

[Assistant] The organization's personnel are provided with cybersecurity awareness and training so that they can perform their cybersecurity-related tasks


[User] What is PR.DS? (Data Security)

[Assistant] Data are managed consistent with the organization's risk strategy to protect the confidentiality, integrity, and availability of information


[User] Summarize the scope of PR.DS.

[Assistant] Data are managed consistent with the organization's risk strategy to protect the confidentiality, integrity, and availability of information


[User] What does PR.DS cover?

[Assistant] Data are managed consistent with the organization's risk strategy to protect the confidentiality, integrity, and availability of information


[User] What is PR.PS? (Platform Security)

[Assistant] The hardware, software (e.g., firmware, operating systems, applications), and services of physical and virtual platforms are managed consistent with the organization's risk strategy to protect their confidentiality, integrity, and availability


[User] Summarize the scope of PR.PS.

[Assistant] The hardware, software (e.g., firmware, operating systems, applications), and services of physical and virtual platforms are managed consistent with the organization's risk strategy to protect their confidentiality, integrity, and availability


[User] What does PR.PS cover?

[Assistant] The hardware, software (e.g., firmware, operating systems, applications), and services of physical and virtual platforms are managed consistent with the organization's risk strategy to protect their confidentiality, integrity, and availability


[User] What is PR.IR? (Technology Infrastructure Resilience)

[Assistant] Security architectures are managed with the organization's risk strategy to protect asset confidentiality, integrity, and availability, and organizational resilience


[User] Summarize the scope of PR.IR.

[Assistant] Security architectures are managed with the organization's risk strategy to protect asset confidentiality, integrity, and availability, and organizational resilience


[User] What does PR.IR cover?

[Assistant] Security architectures are managed with the organization's risk strategy to protect asset confidentiality, integrity, and availability, and organizational resilience


[User] What is DE.CM? (Continuous Monitoring)

[Assistant] Assets are monitored to find anomalies, indicators of compromise, and other potentially adverse events


[User] Summarize the scope of DE.CM.

[Assistant] Assets are monitored to find anomalies, indicators of compromise, and other potentially adverse events


[User] What does DE.CM cover?

[Assistant] Assets are monitored to find anomalies, indicators of compromise, and other potentially adverse events


[User] What is DE.AE? (Adverse Event Analysis)

[Assistant] Anomalies, indicators of compromise, and other potentially adverse events are analyzed to characterize the events and detect cybersecurity incidents


[User] Summarize the scope of DE.AE.

[Assistant] Anomalies, indicators of compromise, and other potentially adverse events are analyzed to characterize the events and detect cybersecurity incidents


[User] What does DE.AE cover?

[Assistant] Anomalies, indicators of compromise, and other potentially adverse events are analyzed to characterize the events and detect cybersecurity incidents


[User] What is RS.MA? (Incident Management)

[Assistant] Responses to detected cybersecurity incidents are managed


[User] Summarize the scope of RS.MA.

[Assistant] Responses to detected cybersecurity incidents are managed


[User] What does RS.MA cover?

[Assistant] Responses to detected cybersecurity incidents are managed


[User] What is RS.AN? (Incident Analysis)

[Assistant] Investigations are conducted to ensure effective response and support forensics and recovery activities


[User] Summarize the scope of RS.AN.

[Assistant] Investigations are conducted to ensure effective response and support forensics and recovery activities


[User] What does RS.AN cover?

[Assistant] Investigations are conducted to ensure effective response and support forensics and recovery activities


[User] What is RS.CO? (Incident Response Reporting and Communication)

[Assistant] Response activities are coordinated with internal and external stakeholders as required by laws, regulations, or policies


[User] Summarize the scope of RS.CO.

[Assistant] Response activities are coordinated with internal and external stakeholders as required by laws, regulations, or policies


[User] What does RS.CO cover?

[Assistant] Response activities are coordinated with internal and external stakeholders as required by laws, regulations, or policies


[User] What is RS.MI? (Incident Mitigation)

[Assistant] Activities are performed to prevent expansion of an event and mitigate its effects


[User] Summarize the scope of RS.MI.

[Assistant] Activities are performed to prevent expansion of an event and mitigate its effects


[User] What does RS.MI cover?

[Assistant] Activities are performed to prevent expansion of an event and mitigate its effects


[User] What is RC.RP? (Incident Recovery Plan Execution)

[Assistant] Restoration activities are performed to ensure operational availability of systems and services affected by cybersecurity incidents


[User] Summarize the scope of RC.RP.

[Assistant] Restoration activities are performed to ensure operational availability of systems and services affected by cybersecurity incidents


[User] What does RC.RP cover?

[Assistant] Restoration activities are performed to ensure operational availability of systems and services affected by cybersecurity incidents


[User] What is RC.CO? (Incident Recovery Communication)

[Assistant] Restoration activities are coordinated with internal and external parties


[User] Summarize the scope of RC.CO.

[Assistant] Restoration activities are coordinated with internal and external parties


[User] What does RC.CO cover?

[Assistant] Restoration activities are coordinated with internal and external parties


[User] What is GV? (GOVERN)

[Assistant] The organization's cybersecurity risk management strategy, expectations, and policy are established, communicated, and monitored


[User] Summarize the scope of GV.

[Assistant] The organization's cybersecurity risk management strategy, expectations, and policy are established, communicated, and monitored


[User] What does GV cover?

[Assistant] The organization's cybersecurity risk management strategy, expectations, and policy are established, communicated, and monitored


[User] What is ID? (IDENTIFY)

[Assistant] The organization's current cybersecurity risks are understood


[User] Summarize the scope of ID.

[Assistant] The organization's current cybersecurity risks are understood


[User] What does ID cover?

[Assistant] The organization's current cybersecurity risks are understood


[User] What is PR? (PROTECT)

[Assistant] Safeguards to manage the organization's cybersecurity risks are used


[User] Summarize the scope of PR.

[Assistant] Safeguards to manage the organization's cybersecurity risks are used


[User] What does PR cover?

[Assistant] Safeguards to manage the organization's cybersecurity risks are used


[User] What is DE? (DETECT)

[Assistant] Possible cybersecurity attacks and compromises are found and analyzed


[User] Summarize the scope of DE.

[Assistant] Possible cybersecurity attacks and compromises are found and analyzed


[User] What does DE cover?

[Assistant] Possible cybersecurity attacks and compromises are found and analyzed


[User] What is RS? (RESPOND)

[Assistant] Actions regarding a detected cybersecurity incident are taken


[User] Summarize the scope of RS.

[Assistant] Actions regarding a detected cybersecurity incident are taken


[User] What does RS cover?

[Assistant] Actions regarding a detected cybersecurity incident are taken


[User] What is RC? (RECOVER)

[Assistant] Assets and operations affected by a cybersecurity incident are restored


[User] Summarize the scope of RC.

[Assistant] Assets and operations affected by a cybersecurity incident are restored


[User] What does RC cover?

[Assistant] Assets and operations affected by a cybersecurity incident are restored


[User] What is GV.OC-01.001? (Ex1)

[Assistant] Share the organization's mission (e.g., through vision and mission statements, marketing, and service strategies) to provide a basis for identifying risks that may impede that mission


[User] Explain GV.OC-01.001.

[Assistant] Share the organization's mission (e.g., through vision and mission statements, marketing, and service strategies) to provide a basis for identifying risks that may impede that mission


[User] What is GV.OC-02.002? (Ex1)

[Assistant] Identify relevant internal stakeholders and their cybersecurity-related expectations (e.g., performance and risk expectations of officers, directors, and advisors; cultural expectations of employees)


[User] Explain GV.OC-02.002.

[Assistant] Identify relevant internal stakeholders and their cybersecurity-related expectations (e.g., performance and risk expectations of officers, directors, and advisors; cultural expectations of employees)


[User] What is GV.OC-02.003? (Ex2)

[Assistant] Identify relevant external stakeholders and their cybersecurity-related expectations (e.g., privacy expectations of customers, business expectations of partnerships, compliance expectations of regulators, ethics expectations of society)


[User] Explain GV.OC-02.003.

[Assistant] Identify relevant external stakeholders and their cybersecurity-related expectations (e.g., privacy expectations of customers, business expectations of partnerships, compliance expectations of regulators, ethics expectations of society)


[User] What is GV.OC-03.004? (Ex1)

[Assistant] Determine a process to track and manage legal and regulatory requirements regarding protection of individuals' information (e.g., Health Insurance Portability and Accountability Act, California Consumer Privacy Act, General Data Protection Regulation)


[User] Explain GV.OC-03.004.

[Assistant] Determine a process to track and manage legal and regulatory requirements regarding protection of individuals' information (e.g., Health Insurance Portability and Accountability Act, California Consumer Privacy Act, General Data Protection Regulation)


[User] What is GV.OC-03.005? (Ex2)

[Assistant] Determine a process to track and manage contractual requirements for cybersecurity management of supplier, customer, and partner information


[User] Explain GV.OC-03.005.

[Assistant] Determine a process to track and manage contractual requirements for cybersecurity management of supplier, customer, and partner information


[User] What is GV.OC-03.006? (Ex3)

[Assistant] Align the organization's cybersecurity strategy with legal, regulatory, and contractual requirements


[User] Explain GV.OC-03.006.

[Assistant] Align the organization's cybersecurity strategy with legal, regulatory, and contractual requirements


[User] What is GV.OC-04.007? (Ex1)

[Assistant] Establish criteria for determining the criticality of capabilities and services as viewed by internal and external stakeholders


[User] Explain GV.OC-04.007.

[Assistant] Establish criteria for determining the criticality of capabilities and services as viewed by internal and external stakeholders


[User] What is GV.OC-04.008? (Ex2)

[Assistant] Determine (e.g., from a business impact analysis) assets and business operations that are vital to achieving mission objectives and the potential impact of a loss (or partial loss) of such operations


[User] Explain GV.OC-04.008.

[Assistant] Determine (e.g., from a business impact analysis) assets and business operations that are vital to achieving mission objectives and the potential impact of a loss (or partial loss) of such operations


[User] What is GV.OC-04.009? (Ex3)

[Assistant] Establish and communicate resilience objectives (e.g., recovery time objectives) for delivering critical capabilities and services in various operating states (e.g., under attack, during recovery, normal operation)


[User] Explain GV.OC-04.009.

[Assistant] Establish and communicate resilience objectives (e.g., recovery time objectives) for delivering critical capabilities and services in various operating states (e.g., under attack, during recovery, normal operation)


[User] What is GV.OC-05.010? (Ex1)

[Assistant] Create an inventory of the organization's dependencies on external resources (e.g., facilities, cloud-based hosting providers) and their relationships to organizational assets and business functions


[User] Explain GV.OC-05.010.

[Assistant] Create an inventory of the organization's dependencies on external resources (e.g., facilities, cloud-based hosting providers) and their relationships to organizational assets and business functions


[User] What is GV.OC-05.011? (Ex2)

[Assistant] Identify and document external dependencies that are potential points of failure for the organization's critical capabilities and services, and share that information with appropriate personnel


[User] Explain GV.OC-05.011.

[Assistant] Identify and document external dependencies that are potential points of failure for the organization's critical capabilities and services, and share that information with appropriate personnel


[User] What is GV.RM-01.012? (Ex1)

[Assistant] Update near-term and long-term cybersecurity risk management objectives as part of annual strategic planning and when major changes occur


[User] Explain GV.RM-01.012.

[Assistant] Update near-term and long-term cybersecurity risk management objectives as part of annual strategic planning and when major changes occur


[User] What is GV.RM-01.013? (Ex2)

[Assistant] Establish measurable objectives for cybersecurity risk management (e.g., manage the quality of user training, ensure adequate risk protection for industrial control systems)


[User] Explain GV.RM-01.013.

[Assistant] Establish measurable objectives for cybersecurity risk management (e.g., manage the quality of user training, ensure adequate risk protection for industrial control systems)


[User] What is GV.RM-01.014? (Ex3)

[Assistant] Senior leaders agree about cybersecurity objectives and use them for measuring and managing risk and performance


[User] Explain GV.RM-01.014.

[Assistant] Senior leaders agree about cybersecurity objectives and use them for measuring and managing risk and performance


[User] What is GV.RM-02.015? (Ex1)

[Assistant] Determine and communicate risk appetite statements that convey expectations about the appropriate level of risk for the organization


[User] Explain GV.RM-02.015.

[Assistant] Determine and communicate risk appetite statements that convey expectations about the appropriate level of risk for the organization


[User] What is GV.RM-02.016? (Ex2)

[Assistant] Translate risk appetite statements into specific, measurable, and broadly understandable risk tolerance statements


[User] Explain GV.RM-02.016.

[Assistant] Translate risk appetite statements into specific, measurable, and broadly understandable risk tolerance statements


[User] What is GV.RM-02.017? (Ex3)

[Assistant] Refine organizational objectives and risk appetite periodically based on known risk exposure and residual risk


[User] Explain GV.RM-02.017.

[Assistant] Refine organizational objectives and risk appetite periodically based on known risk exposure and residual risk


[User] What is GV.RM-03.018? (Ex1)

[Assistant] Aggregate and manage cybersecurity risks alongside other enterprise risks (e.g., compliance, financial, operational, regulatory, reputational, safety)


[User] Explain GV.RM-03.018.

[Assistant] Aggregate and manage cybersecurity risks alongside other enterprise risks (e.g., compliance, financial, operational, regulatory, reputational, safety)


[User] What is GV.RM-03.019? (Ex2)

[Assistant] Include cybersecurity risk managers in enterprise risk management planning


[User] Explain GV.RM-03.019.

[Assistant] Include cybersecurity risk managers in enterprise risk management planning


[User] What is GV.RM-03.020? (Ex3)

[Assistant] Establish criteria for escalating cybersecurity risks within enterprise risk management


[User] Explain GV.RM-03.020.

[Assistant] Establish criteria for escalating cybersecurity risks within enterprise risk management


[User] What is GV.RM-04.021? (Ex1)

[Assistant] Specify criteria for accepting and avoiding cybersecurity risk for various classifications of data


[User] Explain GV.RM-04.021.

[Assistant] Specify criteria for accepting and avoiding cybersecurity risk for various classifications of data


[User] What is GV.RM-04.022? (Ex2)

[Assistant] Determine whether to purchase cybersecurity insurance


[User] Explain GV.RM-04.022.

[Assistant] Determine whether to purchase cybersecurity insurance


[User] What is GV.RM-04.023? (Ex3)

[Assistant] Document conditions under which shared responsibility models are acceptable (e.g., outsourcing certain cybersecurity functions, having a third party perform financial transactions on behalf of the organization, using public cloud-based services)


[User] Explain GV.RM-04.023.

[Assistant] Document conditions under which shared responsibility models are acceptable (e.g., outsourcing certain cybersecurity functions, having a third party perform financial transactions on behalf of the organization, using public cloud-based services)


[User] What is GV.RM-05.024? (Ex1)

[Assistant] Determine how to update senior executives, directors, and management on the organization's cybersecurity posture at agreed-upon intervals


[User] Explain GV.RM-05.024.

[Assistant] Determine how to update senior executives, directors, and management on the organization's cybersecurity posture at agreed-upon intervals


[User] What is GV.RM-05.025? (Ex2)

[Assistant] Identify how all departments across the organization - such as management, operations, internal auditors, legal, acquisition, physical security, and HR - will communicate with each other about cybersecurity risks


[User] Explain GV.RM-05.025.

[Assistant] Identify how all departments across the organization - such as management, operations, internal auditors, legal, acquisition, physical security, and HR - will communicate with each other about cybersecurity risks


[User] What is GV.RM-06.026? (Ex1)

[Assistant] Establish criteria for using a quantitative approach to cybersecurity risk analysis, and specify probability and exposure formulas


[User] Explain GV.RM-06.026.

[Assistant] Establish criteria for using a quantitative approach to cybersecurity risk analysis, and specify probability and exposure formulas


[User] What is GV.RM-06.027? (Ex2)

[Assistant] Create and use templates (e.g., a risk register) to document cybersecurity risk information (e.g., risk description, exposure, treatment, and ownership)


[User] Explain GV.RM-06.027.

[Assistant] Create and use templates (e.g., a risk register) to document cybersecurity risk information (e.g., risk description, exposure, treatment, and ownership)


[User] What is GV.RM-06.028? (Ex3)

[Assistant] Establish criteria for risk prioritization at the appropriate levels within the enterprise


[User] Explain GV.RM-06.028.

[Assistant] Establish criteria for risk prioritization at the appropriate levels within the enterprise


[User] What is GV.RM-06.029? (Ex4)

[Assistant] Use a consistent list of risk categories to support integrating, aggregating, and comparing cybersecurity risks


[User] Explain GV.RM-06.029.

[Assistant] Use a consistent list of risk categories to support integrating, aggregating, and comparing cybersecurity risks


[User] What is GV.RM-07.030? (Ex1)

[Assistant] Define and communicate guidance and methods for identifying opportunities and including them in risk discussions (e.g., strengths, weaknesses, opportunities, and threats [SWOT] analysis)


[User] Explain GV.RM-07.030.

[Assistant] Define and communicate guidance and methods for identifying opportunities and including them in risk discussions (e.g., strengths, weaknesses, opportunities, and threats [SWOT] analysis)


[User] What is GV.RM-07.031? (Ex2)

[Assistant] Identify stretch goals and document them


[User] Explain GV.RM-07.031.

[Assistant] Identify stretch goals and document them


[User] What is GV.RM-07.032? (Ex3)

[Assistant] Calculate, document, and prioritize positive risks alongside negative risks


[User] Explain GV.RM-07.032.

[Assistant] Calculate, document, and prioritize positive risks alongside negative risks


[User] What is GV.RR-01.033? (Ex1)

[Assistant] Leaders (e.g., directors) agree on their roles and responsibilities in developing, implementing, and assessing the organization's cybersecurity strategy


[User] Explain GV.RR-01.033.

[Assistant] Leaders (e.g., directors) agree on their roles and responsibilities in developing, implementing, and assessing the organization's cybersecurity strategy


[User] What is GV.RR-01.034? (Ex2)

[Assistant] Share leaders' expectations regarding a secure and ethical culture, especially when current events present the opportunity to highlight positive or negative examples of cybersecurity risk management


[User] Explain GV.RR-01.034.

[Assistant] Share leaders' expectations regarding a secure and ethical culture, especially when current events present the opportunity to highlight positive or negative examples of cybersecurity risk management


[User] What is GV.RR-01.035? (Ex3)

[Assistant] Leaders direct the CISO to maintain a comprehensive cybersecurity risk strategy and review and update it at least annually and after major events


[User] Explain GV.RR-01.035.

[Assistant] Leaders direct the CISO to maintain a comprehensive cybersecurity risk strategy and review and update it at least annually and after major events


[User] What is GV.RR-01.036? (Ex4)

[Assistant] Conduct reviews to ensure adequate authority and coordination among those responsible for managing cybersecurity risk


[User] Explain GV.RR-01.036.

[Assistant] Conduct reviews to ensure adequate authority and coordination among those responsible for managing cybersecurity risk


[User] What is GV.RR-02.037? (Ex1)

[Assistant] Document risk management roles and responsibilities in policy


[User] Explain GV.RR-02.037.

[Assistant] Document risk management roles and responsibilities in policy


[User] What is GV.RR-02.038? (Ex2)

[Assistant] Document who is responsible and accountable for cybersecurity risk management activities and how those teams and individuals are to be consulted and informed


[User] Explain GV.RR-02.038.

[Assistant] Document who is responsible and accountable for cybersecurity risk management activities and how those teams and individuals are to be consulted and informed


[User] What is GV.RR-02.039? (Ex3)

[Assistant] Include cybersecurity responsibilities and performance requirements in personnel descriptions


[User] Explain GV.RR-02.039.

[Assistant] Include cybersecurity responsibilities and performance requirements in personnel descriptions


[User] What is GV.RR-02.040? (Ex4)

[Assistant] Document performance goals for personnel with cybersecurity risk management responsibilities, and periodically measure performance to identify areas for improvement


[User] Explain GV.RR-02.040.

[Assistant] Document performance goals for personnel with cybersecurity risk management responsibilities, and periodically measure performance to identify areas for improvement


[User] What is GV.RR-02.041? (Ex5)

[Assistant] Clearly articulate cybersecurity responsibilities within operations, risk functions, and internal audit functions


[User] Explain GV.RR-02.041.

[Assistant] Clearly articulate cybersecurity responsibilities within operations, risk functions, and internal audit functions


[User] What is GV.RR-03.042? (Ex1)

[Assistant] Conduct periodic management reviews to ensure that those given cybersecurity risk management responsibilities have the necessary authority


[User] Explain GV.RR-03.042.

[Assistant] Conduct periodic management reviews to ensure that those given cybersecurity risk management responsibilities have the necessary authority


[User] What is GV.RR-03.043? (Ex2)

[Assistant] Identify resource allocation and investment in line with risk tolerance and response


[User] Explain GV.RR-03.043.

[Assistant] Identify resource allocation and investment in line with risk tolerance and response


[User] What is GV.RR-03.044? (Ex3)

[Assistant] Provide adequate and sufficient people, process, and technical resources to support the cybersecurity strategy


[User] Explain GV.RR-03.044.

[Assistant] Provide adequate and sufficient people, process, and technical resources to support the cybersecurity strategy


[User] What is GV.RR-04.045? (Ex1)

[Assistant] Integrate cybersecurity risk management considerations into human resources processes (e.g., personnel screening, onboarding, change notification, offboarding)


[User] Explain GV.RR-04.045.

[Assistant] Integrate cybersecurity risk management considerations into human resources processes (e.g., personnel screening, onboarding, change notification, offboarding)


[User] What is GV.RR-04.046? (Ex2)

[Assistant] Consider cybersecurity knowledge to be a positive factor in hiring, training, and retention decisions


[User] Explain GV.RR-04.046.

[Assistant] Consider cybersecurity knowledge to be a positive factor in hiring, training, and retention decisions


[User] What is GV.RR-04.047? (Ex3)

[Assistant] Conduct background checks prior to onboarding new personnel for sensitive roles, and periodically repeat background checks for personnel with such roles


[User] Explain GV.RR-04.047.

[Assistant] Conduct background checks prior to onboarding new personnel for sensitive roles, and periodically repeat background checks for personnel with such roles


[User] What is GV.RR-04.048? (Ex4)

[Assistant] Define and enforce obligations for personnel to be aware of, adhere to, and uphold security policies as they relate to their roles


[User] Explain GV.RR-04.048.

[Assistant] Define and enforce obligations for personnel to be aware of, adhere to, and uphold security policies as they relate to their roles


[User] What is GV.PO-01.049? (Ex1)

[Assistant] Create, disseminate, and maintain an understandable, usable risk management policy with statements of management intent, expectations, and direction


[User] Explain GV.PO-01.049.

[Assistant] Create, disseminate, and maintain an understandable, usable risk management policy with statements of management intent, expectations, and direction


[User] What is GV.PO-01.050? (Ex2)

[Assistant] Periodically review policy and supporting processes and procedures to ensure that they align with risk management strategy objectives and priorities, as well as the high-level direction of the cybersecurity policy


[User] Explain GV.PO-01.050.

[Assistant] Periodically review policy and supporting processes and procedures to ensure that they align with risk management strategy objectives and priorities, as well as the high-level direction of the cybersecurity policy


[User] What is GV.PO-01.051? (Ex3)

[Assistant] Require approval from senior management on policy


[User] Explain GV.PO-01.051.

[Assistant] Require approval from senior management on policy


[User] What is GV.PO-01.052? (Ex4)

[Assistant] Communicate cybersecurity risk management policy and supporting processes and procedures across the organization


[User] Explain GV.PO-01.052.

[Assistant] Communicate cybersecurity risk management policy and supporting processes and procedures across the organization


[User] What is GV.PO-01.053? (Ex5)

[Assistant] Require personnel to acknowledge receipt of policy when first hired, annually, and whenever policy is updated


[User] Explain GV.PO-01.053.

[Assistant] Require personnel to acknowledge receipt of policy when first hired, annually, and whenever policy is updated


[User] What is GV.PO-02.054? (Ex1)

[Assistant] Update policy based on periodic reviews of cybersecurity risk management results to ensure that policy and supporting processes and procedures adequately maintain risk at an acceptable level


[User] Explain GV.PO-02.054.

[Assistant] Update policy based on periodic reviews of cybersecurity risk management results to ensure that policy and supporting processes and procedures adequately maintain risk at an acceptable level


[User] What is GV.PO-02.055? (Ex2)

[Assistant] Provide a timeline for reviewing changes to the organization's risk environment (e.g., changes in risk or in the organization's mission objectives), and communicate recommended policy updates


[User] Explain GV.PO-02.055.

[Assistant] Provide a timeline for reviewing changes to the organization's risk environment (e.g., changes in risk or in the organization's mission objectives), and communicate recommended policy updates


[User] What is GV.PO-02.056? (Ex3)

[Assistant] Update policy to reflect changes in legal and regulatory requirements


[User] Explain GV.PO-02.056.

[Assistant] Update policy to reflect changes in legal and regulatory requirements


[User] What is GV.PO-02.057? (Ex4)

[Assistant] Update policy to reflect changes in technology (e.g., adoption of artificial intelligence) and changes to the business (e.g., acquisition of a new business, new contract requirements)


[User] Explain GV.PO-02.057.

[Assistant] Update policy to reflect changes in technology (e.g., adoption of artificial intelligence) and changes to the business (e.g., acquisition of a new business, new contract requirements)


[User] What is GV.OV-01.058? (Ex1)

[Assistant] Measure how well the risk management strategy and risk results have helped leaders make decisions and achieve organizational objectives


[User] Explain GV.OV-01.058.

[Assistant] Measure how well the risk management strategy and risk results have helped leaders make decisions and achieve organizational objectives


[User] What is GV.OV-01.059? (Ex2)

[Assistant] Examine whether cybersecurity risk strategies that impede operations or innovation should be adjusted


[User] Explain GV.OV-01.059.

[Assistant] Examine whether cybersecurity risk strategies that impede operations or innovation should be adjusted


[User] What is GV.OV-02.060? (Ex1)

[Assistant] Review audit findings to confirm whether the existing cybersecurity strategy has ensured compliance with internal and external requirements


[User] Explain GV.OV-02.060.

[Assistant] Review audit findings to confirm whether the existing cybersecurity strategy has ensured compliance with internal and external requirements


[User] What is GV.OV-02.061? (Ex2)

[Assistant] Review the performance oversight of those in cybersecurity-related roles to determine whether policy changes are necessary


[User] Explain GV.OV-02.061.

[Assistant] Review the performance oversight of those in cybersecurity-related roles to determine whether policy changes are necessary


[User] What is GV.OV-02.062? (Ex3)

[Assistant] Review strategy in light of cybersecurity incidents


[User] Explain GV.OV-02.062.

[Assistant] Review strategy in light of cybersecurity incidents


[User] What is GV.OV-03.063? (Ex1)

[Assistant] Review key performance indicators (KPIs) to ensure that organization-wide policies and procedures achieve objectives


[User] Explain GV.OV-03.063.

[Assistant] Review key performance indicators (KPIs) to ensure that organization-wide policies and procedures achieve objectives


[User] What is GV.OV-03.064? (Ex2)

[Assistant] Review key risk indicators (KRIs) to identify risks the organization faces, including likelihood and potential impact


[User] Explain GV.OV-03.064.

[Assistant] Review key risk indicators (KRIs) to identify risks the organization faces, including likelihood and potential impact


[User] What is GV.OV-03.065? (Ex3)

[Assistant] Collect and communicate metrics on cybersecurity risk management with senior leadership


[User] Explain GV.OV-03.065.

[Assistant] Collect and communicate metrics on cybersecurity risk management with senior leadership


[User] What is GV.SC-01.066? (Ex1)

[Assistant] Establish a strategy that expresses the objectives of the cybersecurity supply chain risk management program


[User] Explain GV.SC-01.066.

[Assistant] Establish a strategy that expresses the objectives of the cybersecurity supply chain risk management program


[User] What is GV.SC-01.067? (Ex2)

[Assistant] Develop the cybersecurity supply chain risk management program, including a plan (with milestones), policies, and procedures that guide implementation and improvement of the program, and share the policies and procedures with the organizational stakeholders


[User] Explain GV.SC-01.067.

[Assistant] Develop the cybersecurity supply chain risk management program, including a plan (with milestones), policies, and procedures that guide implementation and improvement of the program, and share the policies and procedures with the organizational stakeholders


[User] What is GV.SC-01.068? (Ex3)

[Assistant] Develop and implement program processes based on the strategy, objectives, policies, and procedures that are agreed upon and performed by the organizational stakeholders


[User] Explain GV.SC-01.068.

[Assistant] Develop and implement program processes based on the strategy, objectives, policies, and procedures that are agreed upon and performed by the organizational stakeholders


[User] What is GV.SC-01.069? (Ex4)

[Assistant] Establish a cross-organizational mechanism that ensures alignment between functions that contribute to cybersecurity supply chain risk management, such as cybersecurity, IT, operations, legal, human resources, and engineering


[User] Explain GV.SC-01.069.

[Assistant] Establish a cross-organizational mechanism that ensures alignment between functions that contribute to cybersecurity supply chain risk management, such as cybersecurity, IT, operations, legal, human resources, and engineering


[User] What is GV.SC-02.070? (Ex1)

[Assistant] Identify one or more specific roles or positions that will be responsible and accountable for planning, resourcing, and executing cybersecurity supply chain risk management activities


[User] Explain GV.SC-02.070.

[Assistant] Identify one or more specific roles or positions that will be responsible and accountable for planning, resourcing, and executing cybersecurity supply chain risk management activities


[User] What is GV.SC-02.071? (Ex2)

[Assistant] Document cybersecurity supply chain risk management roles and responsibilities in policy


[User] Explain GV.SC-02.071.

[Assistant] Document cybersecurity supply chain risk management roles and responsibilities in policy


[User] What is GV.SC-02.072? (Ex3)

[Assistant] Create responsibility matrixes to document who will be responsible and accountable for cybersecurity supply chain risk management activities and how those teams and individuals will be consulted and informed


[User] Explain GV.SC-02.072.

[Assistant] Create responsibility matrixes to document who will be responsible and accountable for cybersecurity supply chain risk management activities and how those teams and individuals will be consulted and informed


[User] What is GV.SC-02.073? (Ex4)

[Assistant] Include cybersecurity supply chain risk management responsibilities and performance requirements in personnel descriptions to ensure clarity and improve accountability


[User] Explain GV.SC-02.073.

[Assistant] Include cybersecurity supply chain risk management responsibilities and performance requirements in personnel descriptions to ensure clarity and improve accountability


[User] What is GV.SC-02.074? (Ex5)

[Assistant] Document performance goals for personnel with cybersecurity risk management-specific responsibilities, and periodically measure them to demonstrate and improve performance


[User] Explain GV.SC-02.074.

[Assistant] Document performance goals for personnel with cybersecurity risk management-specific responsibilities, and periodically measure them to demonstrate and improve performance


[User] What is GV.SC-02.075? (Ex6)

[Assistant] Develop roles and responsibilities for suppliers, customers, and business partners to address shared responsibilities for applicable cybersecurity risks, and integrate them into organizational policies and applicable third-party agreements


[User] Explain GV.SC-02.075.

[Assistant] Develop roles and responsibilities for suppliers, customers, and business partners to address shared responsibilities for applicable cybersecurity risks, and integrate them into organizational policies and applicable third-party agreements


[User] What is GV.SC-02.076? (Ex7)

[Assistant] Internally communicate cybersecurity supply chain risk management roles and responsibilities for third parties


[User] Explain GV.SC-02.076.

[Assistant] Internally communicate cybersecurity supply chain risk management roles and responsibilities for third parties


[User] What is GV.SC-02.077? (Ex8)

[Assistant] Establish rules and protocols for information sharing and reporting processes between the organization and its suppliers


[User] Explain GV.SC-02.077.

[Assistant] Establish rules and protocols for information sharing and reporting processes between the organization and its suppliers


[User] What is GV.SC-03.078? (Ex1)

[Assistant] Identify areas of alignment and overlap with cybersecurity and enterprise risk management


[User] Explain GV.SC-03.078.

[Assistant] Identify areas of alignment and overlap with cybersecurity and enterprise risk management


[User] What is GV.SC-03.079? (Ex2)

[Assistant] Establish integrated control sets for cybersecurity risk management and cybersecurity supply chain risk management


[User] Explain GV.SC-03.079.

[Assistant] Establish integrated control sets for cybersecurity risk management and cybersecurity supply chain risk management


[User] What is GV.SC-03.080? (Ex3)

[Assistant] Integrate cybersecurity supply chain risk management into improvement processes


[User] Explain GV.SC-03.080.

[Assistant] Integrate cybersecurity supply chain risk management into improvement processes


[User] What is GV.SC-03.081? (Ex4)

[Assistant] Escalate material cybersecurity risks in supply chains to senior management, and address them at the enterprise risk management level


[User] Explain GV.SC-03.081.

[Assistant] Escalate material cybersecurity risks in supply chains to senior management, and address them at the enterprise risk management level


[User] What is GV.SC-04.082? (Ex1)

[Assistant] Develop criteria for supplier criticality based on, for example, the sensitivity of data processed or possessed by suppliers, the degree of access to the organization's systems, and the importance of the products or services to the organization's mission


[User] Explain GV.SC-04.082.

[Assistant] Develop criteria for supplier criticality based on, for example, the sensitivity of data processed or possessed by suppliers, the degree of access to the organization's systems, and the importance of the products or services to the organization's mission


[User] What is GV.SC-04.083? (Ex2)

[Assistant] Keep a record of all suppliers, and prioritize suppliers based on the criticality criteria


[User] Explain GV.SC-04.083.

[Assistant] Keep a record of all suppliers, and prioritize suppliers based on the criticality criteria


[User] What is GV.SC-05.084? (Ex1)

[Assistant] Establish security requirements for suppliers, products, and services commensurate with their criticality level and potential impact if compromised


[User] Explain GV.SC-05.084.

[Assistant] Establish security requirements for suppliers, products, and services commensurate with their criticality level and potential impact if compromised


[User] What is GV.SC-05.085? (Ex2)

[Assistant] Include all cybersecurity and supply chain requirements that third parties must follow and how compliance with the requirements may be verified in default contractual language


[User] Explain GV.SC-05.085.

[Assistant] Include all cybersecurity and supply chain requirements that third parties must follow and how compliance with the requirements may be verified in default contractual language


[User] What is GV.SC-05.086? (Ex3)

[Assistant] Define the rules and protocols for information sharing between the organization and its suppliers and sub-tier suppliers in agreements


[User] Explain GV.SC-05.086.

[Assistant] Define the rules and protocols for information sharing between the organization and its suppliers and sub-tier suppliers in agreements


[User] What is GV.SC-05.087? (Ex4)

[Assistant] Manage risk by including security requirements in agreements based on their criticality and potential impact if compromised


[User] Explain GV.SC-05.087.

[Assistant] Manage risk by including security requirements in agreements based on their criticality and potential impact if compromised


[User] What is GV.SC-05.088? (Ex5)

[Assistant] Define security requirements in service-level agreements (SLAs) for monitoring suppliers for acceptable security performance throughout the supplier relationship lifecycle


[User] Explain GV.SC-05.088.

[Assistant] Define security requirements in service-level agreements (SLAs) for monitoring suppliers for acceptable security performance throughout the supplier relationship lifecycle


[User] What is GV.SC-05.089? (Ex6)

[Assistant] Contractually require suppliers to disclose cybersecurity features, functions, and vulnerabilities of their products and services for the life of the product or the term of service


[User] Explain GV.SC-05.089.

[Assistant] Contractually require suppliers to disclose cybersecurity features, functions, and vulnerabilities of their products and services for the life of the product or the term of service


[User] What is GV.SC-05.090? (Ex7)

[Assistant] Contractually require suppliers to provide and maintain a current component inventory (e.g., software or hardware bill of materials) for critical products


[User] Explain GV.SC-05.090.

[Assistant] Contractually require suppliers to provide and maintain a current component inventory (e.g., software or hardware bill of materials) for critical products


[User] What is GV.SC-05.091? (Ex8)

[Assistant] Contractually require suppliers to vet their employees and guard against insider threats


[User] Explain GV.SC-05.091.

[Assistant] Contractually require suppliers to vet their employees and guard against insider threats


[User] What is GV.SC-05.092? (Ex9)

[Assistant] Contractually require suppliers to provide evidence of performing acceptable security practices through, for example, self-attestation, conformance to known standards, certifications, or inspections


[User] Explain GV.SC-05.092.

[Assistant] Contractually require suppliers to provide evidence of performing acceptable security practices through, for example, self-attestation, conformance to known standards, certifications, or inspections


[User] What is GV.SC-05.093? (Ex10)

[Assistant] Specify in contracts and other agreements the rights and responsibilities of the organization, its suppliers, and their supply chains, with respect to potential cybersecurity risks


[User] Explain GV.SC-05.093.

[Assistant] Specify in contracts and other agreements the rights and responsibilities of the organization, its suppliers, and their supply chains, with respect to potential cybersecurity risks


[User] What is GV.SC-06.094? (Ex1)

[Assistant] Perform thorough due diligence on prospective suppliers that is consistent with procurement planning and commensurate with the level of risk, criticality, and complexity of each supplier relationship


[User] Explain GV.SC-06.094.

[Assistant] Perform thorough due diligence on prospective suppliers that is consistent with procurement planning and commensurate with the level of risk, criticality, and complexity of each supplier relationship


[User] What is GV.SC-06.095? (Ex2)

[Assistant] Assess the suitability of the technology and cybersecurity capabilities and the risk management practices of prospective suppliers


[User] Explain GV.SC-06.095.

[Assistant] Assess the suitability of the technology and cybersecurity capabilities and the risk management practices of prospective suppliers


[User] What is GV.SC-06.096? (Ex3)

[Assistant] Conduct supplier risk assessments against business and applicable cybersecurity requirements


[User] Explain GV.SC-06.096.

[Assistant] Conduct supplier risk assessments against business and applicable cybersecurity requirements


[User] What is GV.SC-06.097? (Ex4)

[Assistant] Assess the authenticity, integrity, and security of critical products prior to acquisition and use


[User] Explain GV.SC-06.097.

[Assistant] Assess the authenticity, integrity, and security of critical products prior to acquisition and use


[User] What is GV.SC-07.098? (Ex1)

[Assistant] Adjust assessment formats and frequencies based on the third party's reputation and the criticality of the products or services they provide


[User] Explain GV.SC-07.098.

[Assistant] Adjust assessment formats and frequencies based on the third party's reputation and the criticality of the products or services they provide