NIST Cybersecurity Framework

Analyze anomalies and potentially adverse events by establishing behavioral baselines, correlating information from multiple sources, estimating impact, integrating threat intelligence, and declaring incidents based on defined criteria

DE.AE - Adverse Event Analysis · Read the full page →

Continuously monitor networks, physical environments, personnel activity, external providers, computing assets, and security logs to detect anomalies, indicators of compromise, and potentially adverse events

DE.CM - Continuous Monitoring · Read the full page →

Monitor the physical environment of computing infrastructure for potentially adverse conditions including environmental threats and physical access anomalies

DE.CM-02 - Physical Environment Monitoring · Read the full page →

Establish and maintain understanding of organizational context — mission, stakeholder expectations, dependencies, and legal/regulatory requirements — to inform cybersecurity risk management decisions

GV.OC - Organizational Context · Read the full page →

Review and adjust the cybersecurity risk management strategy and performance through ongoing oversight to ensure coverage of organizational requirements and continuous improvement

GV.OV - Oversight · Read the full page →

Establish, communicate, enforce, and regularly update organizational cybersecurity policy based on organizational context, strategy, priorities, and evolving threats

GV.PO - Policy · Read the full page →

Establish, communicate, and maintain a cybersecurity risk management strategy including risk appetite, risk tolerance, and integration with enterprise risk management

GV.RM - Risk Management Strategy · Read the full page →

Establish and communicate cybersecurity roles, responsibilities, and authorities across the organization including leadership accountability, resource allocation, and integration with human resources practices

GV.RR - Roles, Responsibilities, and Authorities · Read the full page →

Establish, manage, and monitor a comprehensive cybersecurity supply chain risk management program covering supplier assessment, contractual requirements, incident coordination, and post-agreement provisions

GV.SC - Supply Chain Risk Management · Read the full page →

Maintain comprehensive inventories of all organizational assets including hardware, software, services, data flows, and supplier-provided services, with prioritization based on criticality and risk

ID.AM - Asset Management · Read the full page →

Identify and implement improvements to cybersecurity risk management through security testing, exercises, operational evaluations, and incident response plan refinement

ID.IM - Improvement · Read the full page →

Identify, assess, prioritize, and record cybersecurity risks through vulnerability identification, threat intelligence, impact analysis, and structured risk response planning

ID.RA - Risk Assessment · Read the full page →

Assess the selected CSF 2.0 vulnerability-disclosure handling outcome for the documented project and organizational scope

ID.RA-08 - Vulnerability disclosure handling (legacy record alias) · Read the full page →

Manage identities, implement strong authentication, enforce least-privilege access control, and secure physical access to assets commensurate with risk

PR.AA - Identity Management, Authentication, and Access Control · Read the full page →

Provide cybersecurity awareness and training to all personnel for general tasks and specialized roles to ensure they can perform their duties with cybersecurity risks in mind

PR.AT - Awareness and Training · Read the full page →

Protect the confidentiality, integrity, and availability of data throughout its lifecycle using encryption, integrity checking, secure disposal, logging, and redundancy

PR.DS - Data Security · Read the full page →

Assess the selected CSF 2.0 data-at-rest protection outcome for the documented project and data scope

PR.DS-01 - Protection of data at rest (legacy record alias) · Read the full page →

Manage security architectures and technology infrastructure to protect against unauthorized access, environmental threats, and capacity issues while maintaining organizational resilience in normal and adverse conditions

PR.IR - Technology Infrastructure Resilience · Read the full page →

Manage platform security through configuration management, software and hardware lifecycle management, logging, unauthorized software prevention, and secure software development practices

PR.PS - Platform Security · Read the full page →

Communicate incident recovery status, progress, and completion to designated internal and external stakeholders through approved channels, including public updates when appropriate

RC.CO - Incident Recovery Communication · Read the full page →

Execute incident recovery plans including recovery action selection and prioritization, backup integrity verification, restoration of systems and services, post-incident operational norm establishment, and formal recovery closure with documentation

RC.RP - Incident Recovery Plan Execution · Read the full page →

Investigate cybersecurity incidents through systematic analysis including notification investigation, root cause determination, magnitude estimation, containment, evidence preservation, and forensic analysis

RS.AN - Incident Analysis · Read the full page →

Coordinate incident response communication with internal and external stakeholders including notifications, information sharing with designated parties, and reporting to authorities and ISACs as required by law

RS.CO - Incident Response Reporting and Communication · Read the full page →

Execute and manage incident response processes including plan execution with third parties, triage and validation, categorization and prioritization, escalation, and application of recovery initiation criteria

RS.MA - Incident Management · Read the full page →

Contain cybersecurity incidents to prevent expansion and eradicate threats to mitigate their effects on the organization

RS.MI - Incident Mitigation · Read the full page →