NIST-CSF-DE.AE-02 | Potentially adverse events are analyzed to better understand associated activities | 36 |
NIST-CSF-DE.AE-03 | Information is correlated from multiple sources | 24 |
NIST-CSF-DE.AE-04 | The estimated impact and scope of adverse events are understood | 25 |
NIST-CSF-DE.AE-06 | Information on adverse events is provided to authorized staff and tools | 30 |
NIST-CSF-DE.AE-07 | Cyber threat intelligence and other contextual information are integrated into the analysis | 32 |
NIST-CSF-DE.AE-08 | Incidents are declared when adverse events meet the defined incident criteria | 153 |
NIST-CSF-DE.CM-01 | Networks and network services are monitored to find potentially adverse events | 44 |
NIST-CSF-DE.CM-02 | The physical environment is monitored to find potentially adverse events | 23 |
NIST-CSF-DE.CM-03 | Personnel activity and technology usage are monitored to find potentially adverse events | 28 |
NIST-CSF-DE.CM-06 | External service provider activities and services are monitored to find potentially adverse events | 29 |
NIST-CSF-DE.CM-09 | Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events | 36 |
NIST-CSF-GV.OC-01 | The organizational mission is understood and informs cybersecurity risk management | 29 |
NIST-CSF-GV.OC-02 | Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered | 14 |
NIST-CSF-GV.OC-03 | Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed | 39 |
NIST-CSF-GV.OC-04 | Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated | 24 |
NIST-CSF-GV.OC-05 | Outcomes, capabilities, and services that the organization depends on are understood and communicated | 20 |
NIST-CSF-GV.OV-01 | Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction | 28 |
NIST-CSF-GV.OV-02 | The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks | 27 |
NIST-CSF-GV.OV-03 | Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed | 33 |
NIST-CSF-GV.PO-01 | Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced | 37 |
NIST-CSF-GV.PO-02 | Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission | 33 |
NIST-CSF-GV.RM-01 | Risk management objectives are established and agreed to by organizational stakeholders | 41 |
NIST-CSF-GV.RM-02 | Risk appetite and risk tolerance statements are established, communicated, and maintained | 26 |
NIST-CSF-GV.RM-03 | Cybersecurity risk management activities and outcomes are included in enterprise risk management processes | 88 |
NIST-CSF-GV.RM-04 | Strategic direction that describes appropriate risk response options is established and communicated | 87 |
NIST-CSF-GV.RM-05 | Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties | 17 |
NIST-CSF-GV.RM-06 | A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated | 26 |
NIST-CSF-GV.RM-07 | Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions | 119 |
NIST-CSF-GV.RR-01 | Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving | 38 |
NIST-CSF-GV.RR-02 | Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced | 41 |
NIST-CSF-GV.RR-03 | Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies | 22 |
NIST-CSF-GV.RR-04 | Cybersecurity is included in human resources practices | 36 |
NIST-CSF-GV.SC-01 | A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders | 129 |
NIST-CSF-GV.SC-02 | Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally | 29 |
NIST-CSF-GV.SC-03 | Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes | 23 |
NIST-CSF-GV.SC-04 | Suppliers are known and prioritized by criticality | 31 |
NIST-CSF-GV.SC-05 | Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other rele | 33 |
NIST-CSF-GV.SC-06 | Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships | 29 |
NIST-CSF-GV.SC-07 | The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of | 32 |
NIST-CSF-GV.SC-08 | Relevant suppliers and other third parties are included in incident planning, response, and recovery activities | 25 |
NIST-CSF-GV.SC-09 | Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and | 21 |
NIST-CSF-GV.SC-10 | Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement | 21 |
NIST-CSF-ID.AM-01 | Inventories of hardware managed by the organization are maintained | 39 |
NIST-CSF-ID.AM-02 | Inventories of software, services, and systems managed by the organization are maintained | 33 |
NIST-CSF-ID.AM-03 | Representations of the organization's authorized network communication and internal and external network data flows are maintained | 24 |
NIST-CSF-ID.AM-04 | Inventories of services provided by suppliers are maintained | 77 |
NIST-CSF-ID.AM-05 | Assets are prioritized based on classification, criticality, resources, and impact on the mission | 33 |
NIST-CSF-ID.AM-07 | Inventories of data and corresponding metadata for designated data types are maintained | 31 |
NIST-CSF-ID.AM-08 | Systems, hardware, software, services, and data are managed throughout their life cycles | 35 |
NIST-CSF-ID.IM-01 | Improvements are identified from evaluations | 38 |
NIST-CSF-ID.IM-02 | Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties | 40 |
NIST-CSF-ID.IM-03 | Improvements are identified from execution of operational processes, procedures, and activities | 36 |
NIST-CSF-ID.IM-04 | Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved | 121 |
NIST-CSF-ID.RA-01 | Vulnerabilities in assets are identified, validated, and recorded | 50 |
NIST-CSF-ID.RA-02 | Cyber threat intelligence is received from information sharing forums and sources | 36 |
NIST-CSF-ID.RA-03 | Internal and external threats to the organization are identified and recorded | 30 |
NIST-CSF-ID.RA-04 | Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded | 37 |
NIST-CSF-ID.RA-05 | Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization | 39 |
NIST-CSF-ID.RA-06 | Risk responses are chosen, prioritized, planned, tracked, and communicated | 38 |
NIST-CSF-ID.RA-07 | Changes and exceptions are managed, assessed for risk impact, recorded, and tracked | 30 |
NIST-CSF-ID.RA-08 | Processes for receiving, analyzing, and responding to vulnerability disclosures are established | 34 |
NIST-CSF-ID.RA-09 | The authenticity and integrity of hardware and software are assessed prior to acquisition and use | 109 |
NIST-CSF-ID.RA-10 | Critical suppliers are assessed prior to acquisition | 80 |
NIST-CSF-PR.AA-01 | Identities and credentials for authorized users, services, and hardware are managed by the organization | 106 |
NIST-CSF-PR.AA-02 | Identities are proofed and bound to credentials based on the context of interactions | 85 |
NIST-CSF-PR.AA-03 | Users, services, and hardware are authenticated | 35 |
NIST-CSF-PR.AA-04 | Identity assertions are protected, conveyed, and verified | 25 |
NIST-CSF-PR.AA-05 | Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of d | 176 |
NIST-CSF-PR.AA-06 | Physical access to assets is managed, monitored, and enforced commensurate with risk | 44 |
NIST-CSF-PR.AT-01 | Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind | 46 |
NIST-CSF-PR.AT-02 | Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind | 34 |
NIST-CSF-PR.DS-01 | The confidentiality, integrity, and availability of data-at-rest are protected | 48 |
NIST-CSF-PR.DS-02 | The confidentiality, integrity, and availability of data-in-transit are protected | 34 |
NIST-CSF-PR.DS-10 | The confidentiality, integrity, and availability of data-in-use are protected | 60 |
NIST-CSF-PR.DS-11 | Backups of data are created, protected, maintained, and tested | 31 |
NIST-CSF-PR.IR-01 | Networks and environments are protected from unauthorized logical access and usage | 42 |
NIST-CSF-PR.IR-02 | The organization's technology assets are protected from environmental threats | 21 |
NIST-CSF-PR.IR-03 | Mechanisms are implemented to achieve resilience requirements in normal and adverse situations | 64 |
NIST-CSF-PR.IR-04 | Adequate resource capacity to ensure availability is maintained | 58 |
NIST-CSF-PR.PS-01 | Configuration management practices are established and applied | 79 |
NIST-CSF-PR.PS-02 | Software is maintained, replaced, and removed commensurate with risk | 32 |
NIST-CSF-PR.PS-03 | Hardware is maintained, replaced, and removed commensurate with risk | 28 |
NIST-CSF-PR.PS-04 | Log records are generated and made available for continuous monitoring | 64 |
NIST-CSF-PR.PS-05 | Installation and execution of unauthorized software are prevented | 33 |
NIST-CSF-PR.PS-06 | Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle | 64 |
NIST-CSF-RC.CO-03 | Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders | 23 |
NIST-CSF-RC.CO-04 | Public updates on incident recovery are shared using approved methods and messaging | 20 |
NIST-CSF-RC.RP-01 | The recovery portion of the incident response plan is executed once initiated from the incident response process | 143 |
NIST-CSF-RC.RP-02 | Recovery actions are selected, scoped, prioritized, and performed | 22 |
NIST-CSF-RC.RP-03 | The integrity of backups and other restoration assets is verified before using them for restoration | 25 |
NIST-CSF-RC.RP-04 | Critical mission functions and cybersecurity risk management are considered to establish post-incident operational norms | 28 |
NIST-CSF-RC.RP-05 | The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed | 22 |
NIST-CSF-RC.RP-06 | The end of incident recovery is declared based on criteria, and incident-related documentation is completed | 71 |
NIST-CSF-RS.AN-03 | Analysis is performed to establish what has taken place during an incident and the root cause of the incident | 35 |
NIST-CSF-RS.AN-06 | Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved | 28 |
NIST-CSF-RS.AN-07 | Incident data and metadata are collected, and their integrity and provenance are preserved | 31 |
NIST-CSF-RS.AN-08 | An incident's magnitude is estimated and validated | 29 |
NIST-CSF-RS.CO-02 | Internal and external stakeholders are notified of incidents | 44 |
NIST-CSF-RS.CO-03 | Information is shared with designated internal and external stakeholders | 30 |
NIST-CSF-RS.MA-01 | The incident response plan is executed in coordination with relevant third parties once an incident is declared | 130 |
NIST-CSF-RS.MA-02 | Incident reports are triaged and validated | 34 |
NIST-CSF-RS.MA-03 | Incidents are categorized and prioritized | 31 |
NIST-CSF-RS.MA-04 | Incidents are escalated or elevated as needed | 28 |
NIST-CSF-RS.MA-05 | The criteria for initiating incident recovery are applied | 75 |
NIST-CSF-RS.MI-01 | Incidents are contained | 29 |
NIST-CSF-RS.MI-02 | Incidents are eradicated | 26 |