NIST Cybersecurity Framework 2.0

Inventories of hardware managed by the organization are maintained.

Identities and credentials for authorized users, services, and hardware are managed by the organization.

The incident response plan is executed in coordination with relevant third parties once an incident is declared.

The organizational mission is understood and informs cybersecurity risk management.

The recovery portion of the incident response plan is executed once initiated from the incident response process.

Potentially adverse events are analyzed to better characterize them.

Internal stakeholders with cybersecurity risk management roles and responsibilities are identified.

Information is correlated from multiple sources.

Identities are proofed and bound to credentials based on the context of interactions.

Incidents are triaged to support analysis and prioritization of handling.

Recovery actions are selected, scoped, prioritized, and performed.

Inventories of software, services, and systems managed by the organization are maintained.

Representations of the organization's authorized network communication and internal and external network data flows are maintained.

Incidents are escalated or elevated as needed.

Legal, regulatory, and contractual requirements regarding cybersecurity are understood and managed.

Users, services, and hardware are authenticated.

The estimated impact and scope of adverse events are understood.

The integrity of backups and other restoration assets is verified before using them for restoration.

Critical objectives, capabilities, and services that stakeholders depend on or expect from the organization are understood and communicated.

Critical mission functions and cybersecurity services are re-established.

A plan is in place to communicate suspected cybersecurity incidents and vulnerabilities to designated internal and external stakeholders.

Incidents are categorized and classified.

Inventories of services provided by suppliers, partners, and third parties are maintained.

Identity assertions are protected, conveyed, and verified.

The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed.

Cyber threat intelligence and other contextual information are integrated into the analysis.

Assets are prioritized based on classification, criticality, resources, and impact on the mission.

Outcomes, capabilities, and services that the organization depends on are understood and communicated.

Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed.

The criteria for initiating and terminating incident response are established.

Inventories of data and corresponding metadata for designated data types are maintained.

Physical access to assets is managed, monitored, and enforced commensurate with risk.

Incidents are declared when adverse events meet the defined incident criteria.

Analysis is performed to establish what has taken place during an incident and the root cause of the incident.

Risk management objectives are established and agreed to by organizational stakeholders.

The end of incident recovery is declared based on criteria, and incident-related documentation is completed.

Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders.

Risk appetite and risk tolerance statements are established, communicated, and maintained.

Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind.

Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved.

Networks and network services are monitored to find potentially adverse events.

Vulnerabilities in assets are identified, validated, and recorded.

The magnitude of an incident and its impact on the organization and its stakeholders are understood.

Cybersecurity risk management activities and outcomes are included in enterprise risk management processes.

Public updates on incident recovery are shared using approved messaging and channels.

The confidentiality, integrity, and availability of data-at-rest are protected.

The physical environment is monitored to find potentially adverse events.

Cyber threat intelligence is received from information sharing forums and sources.

Policies, processes, procedures, and practices covering the organization's cybersecurity expectations are established and communicated.

Internal and external threats to the organization are identified and recorded.

Notifications are provided to relevant internal and external stakeholders as required by laws, regulations, or policies.

Personnel activity and technology usage are monitored to find potentially adverse events.

The confidentiality, integrity, and availability of data-in-transit are protected.

Internal stakeholders are notified of incidents.

Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions.

The confidentiality, integrity, and availability of data-in-use are protected.

Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform prioritization.

External service provider activities and services are monitored to find potentially adverse events.

Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events.

Information is shared with designated external stakeholders in accordance with response plans.

Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving.

Risk responses are chosen, prioritized, planned, tracked, and communicated.

Networks and environments are protected from unauthorized logical access and usage.

Incidents are contained.

Improvements are identified from evaluations.

The organization's technology development and change management processes include cybersecurity practices.

Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, and enforced.

Incidents are eradicated.

Hardware and software are managed consistently and comprehensively to understand, assess, and manage their integrity.

Adequate resource capacity to ensure availability is maintained.