-
Notifications
You must be signed in to change notification settings - Fork 287
/
Copy pathnist-csf-2.0.yaml
2813 lines (2428 loc) · 120 KB
/
nist-csf-2.0.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
urn: urn:intuitem:risk:library:nist-csf-2.0
locale: en
ref_id: NIST-CSF-2.0
name: NIST CSF version 2.0
description: National Institute of Standards and Technology - Cybersecurity Framework
copyright: With the exception of material marked as copyrighted, information presented
on NIST sites are considered public information and may be distributed or copied.
version: 2
publication_date: 2024-03-02
provider: NIST
packager: intuitem
objects:
framework:
urn: urn:intuitem:risk:framework:nist-csf-2.0
ref_id: NIST-CSF-2.0
name: NIST CSF v2.0
description: NIST Cybersecurity Framework
min_score: 1
max_score: 4
scores_definition:
- score: 1
name: Partial
description: 'Application of the organizational cybersecurity risk strategy
is managed in an ad hoc manner.
There is limited awareness of cybersecurity risks at the organizational level.'
- score: 2
name: Risk informed
description: 'Risk management practices are approved by management but may not
be established as organization-wide policy.
There is an awareness of cybersecurity risks at the organizational level,
but an organization-wide approach to managing cybersecurity risks has not
been established.'
- score: 3
name: Repeatable
description: "The organization\u2019s risk management practices are formally\
\ approved and expressed as policy.\nOrganizational cybersecurity practices\
\ are regularly updated based on the application of risk management processes\
\ to changes in business/mission requirements, threats, and technological\
\ landscape."
- score: 4
name: Adaptive
description: 'There is an organization-wide approach to managing cybersecurity
risks that uses risk-informed policies, processes, and procedures to address
potential cybersecurity events.
The organization adapts its cybersecurity practices based on previous and
current cybersecurity activities, including lessons learned and predictive
indicators.'
requirement_nodes:
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv
assessable: false
depth: 1
ref_id: GV
name: GOVERN
description: The organization's cybersecurity risk management strategy, expectations,
and policy are established, communicated, and monitored
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.oc
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv
ref_id: GV.OC
name: Organizational Context
description: The circumstances - mission, stakeholder expectations, dependencies,
and legal, regulatory, and contractual requirements - surrounding the organization's
cybersecurity risk management decisions are understood
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.oc-01
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.oc
ref_id: GV.OC-01
description: The organizational mission is understood and informs cybersecurity
risk management
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:node5
assessable: false
depth: 4
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.oc-01
name: Examples
description: '1st: 1st Party Risk
Ex1: Share the organization''s mission (e.g., through vision and mission statements,
marketing, and service strategies) to provide a basis for identifying risks
that may impede that mission'
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.oc-02
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.oc
ref_id: GV.OC-02
description: Internal and external stakeholders are understood, and their needs
and expectations regarding cybersecurity risk management are understood and
considered
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:node7
assessable: false
depth: 4
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.oc-02
name: Examples
description: '1st: 1st Party Risk
3rd: 3rd Party Risk
Ex1: Identify relevant internal stakeholders and their cybersecurity-related
expectations (e.g., performance and risk expectations of officers, directors,
and advisors; cultural expectations of employees)
Ex2: Identify relevant external stakeholders and their cybersecurity-related
expectations (e.g., privacy expectations of customers, business expectations
of partnerships, compliance expectations of regulators, ethics expectations
of society)'
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.oc-03
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.oc
ref_id: GV.OC-03
description: Legal, regulatory, and contractual requirements regarding cybersecurity
- including privacy and civil liberties obligations - are understood and managed
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:node9
assessable: false
depth: 4
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.oc-03
name: Examples
description: '1st: 1st Party Risk
3rd: 3rd Party Risk
Ex1: Determine a process to track and manage legal and regulatory requirements
regarding protection of individuals'' information (e.g., Health Insurance
Portability and Accountability Act, California Consumer Privacy Act, General
Data Protection Regulation)
Ex2: Determine a process to track and manage contractual requirements for
cybersecurity management of supplier, customer, and partner information
Ex3: Align the organization''s cybersecurity strategy with legal, regulatory,
and contractual requirements'
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.oc-04
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.oc
ref_id: GV.OC-04
description: Critical objectives, capabilities, and services that stakeholders
depend on or expect from the organization are understood and communicated
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:node11
assessable: false
depth: 4
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.oc-04
name: Examples
description: '1st: 1st Party Risk
3rd: 3rd Party Risk
Ex1: Establish criteria for determining the criticality of capabilities and
services as viewed by internal and external stakeholders
Ex2: Determine (e.g., from a business impact analysis) assets and business
operations that are vital to achieving mission objectives and the potential
impact of a loss (or partial loss) of such operations
Ex3: Establish and communicate resilience objectives (e.g., recovery time
objectives) for delivering critical capabilities and services in various operating
states (e.g., under attack, during recovery, normal operation)'
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.oc-05
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.oc
ref_id: GV.OC-05
description: Outcomes, capabilities, and services that the organization depends
on are understood and communicated
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:node13
assessable: false
depth: 4
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.oc-05
name: Examples
description: 'Ex1: Create an inventory of the organization''s dependencies on
external resources (e.g., facilities, cloud-based hosting providers) and their
relationships to organizational assets and business functions
Ex2: Identify and document external dependencies that are potential points
of failure for the organization''s critical capabilities and services, and
share that information with appropriate personnel
3rd: 3rd Party Risk'
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.rm
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv
ref_id: GV.RM
name: Risk Management Strategy
description: The organization's priorities, constraints, risk tolerance and
appetite statements, and assumptions are established, communicated, and used
to support operational risk decisions
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.rm-01
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.rm
ref_id: GV.RM-01
description: Risk management objectives are established and agreed to by organizational
stakeholders
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:node16
assessable: false
depth: 4
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.rm-01
name: Examples
description: '1st: 1st Party Risk
Ex1: Update near-term and long-term cybersecurity risk management objectives
as part of annual strategic planning and when major changes occur
Ex2: Establish measurable objectives for cybersecurity risk management (e.g.,
manage the quality of user training, ensure adequate risk protection for industrial
control systems)
Ex3: Senior leaders agree about cybersecurity objectives and use them for
measuring and managing risk and performance'
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.rm-02
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.rm
ref_id: GV.RM-02
description: Risk appetite and risk tolerance statements are established, communicated,
and maintained
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:node18
assessable: false
depth: 4
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.rm-02
name: Examples
description: '1st: 1st Party Risk
3rd: 3rd Party Risk
Ex1: Determine and communicate risk appetite statements that convey expectations
about the appropriate level of risk for the organization
Ex2: Translate risk appetite statements into specific, measurable, and broadly
understandable risk tolerance statements
Ex3: Refine organizational objectives and risk appetite periodically based
on known risk exposure and residual risk'
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.rm-03
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.rm
ref_id: GV.RM-03
description: Cybersecurity risk management activities and outcomes are included
in enterprise risk management processes
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:node20
assessable: false
depth: 4
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.rm-03
name: Examples
description: '1st: 1st Party Risk
Ex1: Aggregate and manage cybersecurity risks alongside other enterprise risks
(e.g., compliance, financial, operational, regulatory, reputational, safety)
Ex2: Include cybersecurity risk managers in enterprise risk management planning
Ex3: Establish criteria for escalating cybersecurity risks within enterprise
risk management'
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.rm-04
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.rm
ref_id: GV.RM-04
description: Strategic direction that describes appropriate risk response options
is established and communicated
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:node22
assessable: false
depth: 4
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.rm-04
name: Examples
description: '1st: 1st Party Risk
Ex1: Specify criteria for accepting and avoiding cybersecurity risk for various
classifications of data
Ex2: Determine whether to purchase cybersecurity insurance
Ex3: Document conditions under which shared responsibility models are acceptable
(e.g., outsourcing certain cybersecurity functions, having a third party perform
financial transactions on behalf of the organization, using public cloud-based
services)'
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.rm-05
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.rm
ref_id: GV.RM-05
description: Lines of communication across the organization are established
for cybersecurity risks, including risks from suppliers and other third parties
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:node24
assessable: false
depth: 4
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.rm-05
name: Examples
description: '1st: 1st Party Risk
3rd: 3rd Party Risk
Ex1: Determine how to update senior executives, directors, and management
on the organization''s cybersecurity posture at agreed-upon intervals
Ex2: Identify how all departments across the organization - such as management,
operations, internal auditors, legal, acquisition, physical security, and
HR - will communicate with each other about cybersecurity risks'
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.rm-06
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.rm
ref_id: GV.RM-06
description: A standardized method for calculating, documenting, categorizing,
and prioritizing cybersecurity risks is established and communicated
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:node26
assessable: false
depth: 4
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.rm-06
name: Examples
description: '1st: 1st Party Risk
Ex1: Establish criteria for using a quantitative approach to cybersecurity
risk analysis, and specify probability and exposure formulas
Ex2: Create and use templates (e.g., a risk register) to document cybersecurity
risk information (e.g., risk description, exposure, treatment, and ownership)
Ex3: Establish criteria for risk prioritization at the appropriate levels
within the enterprise
Ex4: Use a consistent list of risk categories to support integrating, aggregating,
and comparing cybersecurity risks'
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.rm-07
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.rm
ref_id: GV.RM-07
description: Strategic opportunities (i.e., positive risks) are characterized
and are included in organizational cybersecurity risk discussions
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:node28
assessable: false
depth: 4
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.rm-07
name: Examples
description: '1st: 1st Party Risk
Ex1: Define and communicate guidance and methods for identifying opportunities
and including them in risk discussions (e.g., strengths, weaknesses, opportunities,
and threats [SWOT] analysis)
Ex2: Identify stretch goals and document them
Ex3: Calculate, document, and prioritize positive risks alongside negative
risks'
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.rr
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv
ref_id: GV.RR
name: Roles, Responsibilities, and Authorities
description: Cybersecurity roles, responsibilities, and authorities to foster
accountability, performance assessment, and continuous improvement are established
and communicated
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.rr-01
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.rr
ref_id: GV.RR-01
description: Organizational leadership is responsible and accountable for cybersecurity
risk and fosters a culture that is risk-aware, ethical, and continually improving
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:node31
assessable: false
depth: 4
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.rr-01
name: Examples
description: '1st: 1st Party Risk
Ex1: Leaders (e.g., directors) agree on their roles and responsibilities in
developing, implementing, and assessing the organization''s cybersecurity
strategy
Ex2: Share leaders'' expectations regarding a secure and ethical culture,
especially when current events present the opportunity to highlight positive
or negative examples of cybersecurity risk management
Ex3: Leaders direct the CISO to maintain a comprehensive cybersecurity risk
strategy and review and update it at least annually and after major events
Ex4: Conduct reviews to ensure adequate authority and coordination among those
responsible for managing cybersecurity risk'
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.rr-02
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.rr
ref_id: GV.RR-02
description: Roles, responsibilities, and authorities related to cybersecurity
risk management are established, communicated, understood, and enforced
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:node33
assessable: false
depth: 4
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.rr-02
name: Examples
description: '1st: 1st Party Risk
Ex1: Document risk management roles and responsibilities in policy
Ex2: Document who is responsible and accountable for cybersecurity risk management
activities and how those teams and individuals are to be consulted and informed
Ex3: Include cybersecurity responsibilities and performance requirements in
personnel descriptions
Ex4: Document performance goals for personnel with cybersecurity risk management
responsibilities, and periodically measure performance to identify areas for
improvement
Ex5: Clearly articulate cybersecurity responsibilities within operations,
risk functions, and internal audit functions'
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.rr-03
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.rr
ref_id: GV.RR-03
description: Adequate resources are allocated commensurate with the cybersecurity
risk strategy, roles, responsibilities, and policies
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:node35
assessable: false
depth: 4
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.rr-03
name: Examples
description: '1st: 1st Party Risk
3rd: 3rd Party Risk
Ex1: Conduct periodic management reviews to ensure that those given cybersecurity
risk management responsibilities have the necessary authority
Ex2: Identify resource allocation and investment in line with risk tolerance
and response
Ex3: Provide adequate and sufficient people, process, and technical resources
to support the cybersecurity strategy'
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.rr-04
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.rr
ref_id: GV.RR-04
description: Cybersecurity is included in human resources practices
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:node37
assessable: false
depth: 4
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.rr-04
name: Examples
description: '1st: 1st Party Risk
Ex1: Integrate cybersecurity risk management considerations into human resources
processes (e.g., personnel screening, onboarding, change notification, offboarding)
Ex2: Consider cybersecurity knowledge to be a positive factor in hiring, training,
and retention decisions
Ex3: Conduct background checks prior to onboarding new personnel for sensitive
roles, and periodically repeat background checks for personnel with such roles
Ex4: Define and enforce obligations for personnel to be aware of, adhere to,
and uphold security policies as they relate to their roles'
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.po
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv
ref_id: GV.PO
name: Policy
description: Organizational cybersecurity policy is established, communicated,
and enforced
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.po-01
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.po
ref_id: GV.PO-01
description: Policy for managing cybersecurity risks is established based on
organizational context, cybersecurity strategy, and priorities and is communicated
and enforced
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:node40
assessable: false
depth: 4
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.po-01
name: Examples
description: '1st: 1st Party Risk
Ex1: Create, disseminate, and maintain an understandable, usable risk management
policy with statements of management intent, expectations, and direction
Ex2: Periodically review policy and supporting processes and procedures to
ensure that they align with risk management strategy objectives and priorities,
as well as the high-level direction of the cybersecurity policy
Ex3: Require approval from senior management on policy
Ex4: Communicate cybersecurity risk management policy and supporting processes
and procedures across the organization
Ex5: Require personnel to acknowledge receipt of policy when first hired,
annually, and whenever policy is updated'
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.po-02
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.po
ref_id: GV.PO-02
description: Policy for managing cybersecurity risks is reviewed, updated, communicated,
and enforced to reflect changes in requirements, threats, technology, and
organizational mission
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:node42
assessable: false
depth: 4
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.po-02
name: Examples
description: '1st: 1st Party Risk
Ex1: Update policy based on periodic reviews of cybersecurity risk management
results to ensure that policy and supporting processes and procedures adequately
maintain risk at an acceptable level
Ex2: Provide a timeline for reviewing changes to the organization''s risk
environment (e.g., changes in risk or in the organization''s mission objectives),
and communicate recommended policy updates
Ex3: Update policy to reflect changes in legal and regulatory requirements
Ex4: Update policy to reflect changes in technology (e.g., adoption of artificial
intelligence) and changes to the business (e.g., acquisition of a new business,
new contract requirements)'
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.ov
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv
ref_id: GV.OV
name: Oversight
description: Results of organization-wide cybersecurity risk management activities
and performance are used to inform, improve, and adjust the risk management
strategy
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.ov-01
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.ov
ref_id: GV.OV-01
description: Cybersecurity risk management strategy outcomes are reviewed to
inform and adjust strategy and direction
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:node45
assessable: false
depth: 4
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.ov-01
name: Examples
description: '1st: 1st Party Risk
Ex1: Measure how well the risk management strategy and risk results have helped
leaders make decisions and achieve organizational objectives
Ex2: Examine whether cybersecurity risk strategies that impede operations
or innovation should be adjusted'
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.ov-02
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.ov
ref_id: GV.OV-02
description: The cybersecurity risk management strategy is reviewed and adjusted
to ensure coverage of organizational requirements and risks
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:node47
assessable: false
depth: 4
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.ov-02
name: Examples
description: '1st: 1st Party Risk
Ex1: Review audit findings to confirm whether the existing cybersecurity strategy
has ensured compliance with internal and external requirements
Ex2: Review the performance oversight of those in cybersecurity-related roles
to determine whether policy changes are necessary
Ex3: Review strategy in light of cybersecurity incidents'
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.ov-03
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.ov
ref_id: GV.OV-03
description: Organizational cybersecurity risk management performance is evaluated
and reviewed for adjustments needed
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:node49
assessable: false
depth: 4
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.ov-03
name: Examples
description: '1st: 1st Party Risk
Ex1: Review key performance indicators (KPIs) to ensure that organization-wide
policies and procedures achieve objectives
Ex2: Review key risk indicators (KRIs) to identify risks the organization
faces, including likelihood and potential impact
Ex3: Collect and communicate metrics on cybersecurity risk management with
senior leadership'
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.sc
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv
ref_id: GV.SC
name: Cybersecurity Supply Chain Risk Management
description: Cyber supply chain risk management processes are identified, established,
managed, monitored, and improved by organizational stakeholders
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.sc-01
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.sc
ref_id: GV.SC-01
description: A cybersecurity supply chain risk management program, strategy,
objectives, policies, and processes are established and agreed to by organizational
stakeholders
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:node52
assessable: false
depth: 4
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.sc-01
name: Examples
description: 'Ex1: Establish a strategy that expresses the objectives of the
cybersecurity supply chain risk management program
Ex2: Develop the cybersecurity supply chain risk management program, including
a plan (with milestones), policies, and procedures that guide implementation
and improvement of the program, and share the policies and procedures with
the organizational stakeholders
Ex3: Develop and implement program processes based on the strategy, objectives,
policies, and procedures that are agreed upon and performed by the organizational
stakeholders
Ex4: Establish a cross-organizational mechanism that ensures alignment between
functions that contribute to cybersecurity supply chain risk management, such
as cybersecurity, IT, operations, legal, human resources, and engineering
3rd: 3rd Party Risk'
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.sc-02
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.sc
ref_id: GV.SC-02
description: Cybersecurity roles and responsibilities for suppliers, customers,
and partners are established, communicated, and coordinated internally and
externally
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:node54
assessable: false
depth: 4
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.sc-02
name: Examples
description: 'Ex1: Identify one or more specific roles or positions that will
be responsible and accountable for planning, resourcing, and executing cybersecurity
supply chain risk management activities
Ex2: Document cybersecurity supply chain risk management roles and responsibilities
in policy
Ex3: Create responsibility matrixes to document who will be responsible and
accountable for cybersecurity supply chain risk management activities and
how those teams and individuals will be consulted and informed
Ex4: Include cybersecurity supply chain risk management responsibilities and
performance requirements in personnel descriptions to ensure clarity and improve
accountability
Ex5: Document performance goals for personnel with cybersecurity risk management-specific
responsibilities, and periodically measure them to demonstrate and improve
performance
Ex6: Develop roles and responsibilities for suppliers, customers, and business
partners to address shared responsibilities for applicable cybersecurity risks,
and integrate them into organizational policies and applicable third-party
agreements
Ex7: Internally communicate cybersecurity supply chain risk management roles
and responsibilities for third parties
Ex8: Establish rules and protocols for information sharing and reporting processes
between the organization and its suppliers
3rd: 3rd Party Risk'
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.sc-03
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.sc
ref_id: GV.SC-03
description: Cybersecurity supply chain risk management is integrated into cybersecurity
and enterprise risk management, risk assessment, and improvement processes
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:node56
assessable: false
depth: 4
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.sc-03
name: Examples
description: 'Ex1: Identify areas of alignment and overlap with cybersecurity
and enterprise risk management
Ex2: Establish integrated control sets for cybersecurity risk management and
cybersecurity supply chain risk management
Ex3: Integrate cybersecurity supply chain risk management into improvement
processes
Ex4: Escalate material cybersecurity risks in supply chains to senior management,
and address them at the enterprise risk management level
3rd: 3rd Party Risk'
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.sc-04
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.sc
ref_id: GV.SC-04
description: Suppliers are known and prioritized by criticality
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:node58
assessable: false
depth: 4
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.sc-04
name: Examples
description: 'Ex1: Develop criteria for supplier criticality based on, for example,
the sensitivity of data processed or possessed by suppliers, the degree of
access to the organization''s systems, and the importance of the products
or services to the organization''s mission
Ex2: Keep a record of all suppliers, and prioritize suppliers based on the
criticality criteria
3rd: 3rd Party Risk'
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.sc-05
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.sc
ref_id: GV.SC-05
description: Requirements to address cybersecurity risks in supply chains are
established, prioritized, and integrated into contracts and other types of
agreements with suppliers and other relevant third parties
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:node60
assessable: false
depth: 4
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.sc-05
name: Examples
description: 'Ex1: Establish security requirements for suppliers, products,
and services commensurate with their criticality level and potential impact
if compromised
Ex2: Include all cybersecurity and supply chain requirements that third parties
must follow and how compliance with the requirements may be verified in default
contractual language
Ex3: Define the rules and protocols for information sharing between the organization
and its suppliers and sub-tier suppliers in agreements
Ex4: Manage risk by including security requirements in agreements based on
their criticality and potential impact if compromised
Ex5: Define security requirements in service-level agreements (SLAs) for monitoring
suppliers for acceptable security performance throughout the supplier relationship
lifecycle
Ex6: Contractually require suppliers to disclose cybersecurity features, functions,
and vulnerabilities of their products and services for the life of the product
or the term of service
Ex7: Contractually require suppliers to provide and maintain a current component
inventory (e.g., software or hardware bill of materials) for critical products
Ex8: Contractually require suppliers to vet their employees and guard against
insider threats
Ex9: Contractually require suppliers to provide evidence of performing acceptable
security practices through, for example, self-attestation, conformance to
known standards, certifications, or inspections
Ex10: Specify in contracts and other agreements the rights and responsibilities
of the organization, its suppliers, and their supply chains, with respect
to potential cybersecurity risks
3rd: 3rd Party Risk'
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.sc-06
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.sc
ref_id: GV.SC-06
description: Planning and due diligence are performed to reduce risks before
entering into formal supplier or other third-party relationships
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:node62
assessable: false
depth: 4
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.sc-06
name: Examples
description: 'Ex1: Perform thorough due diligence on prospective suppliers that
is consistent with procurement planning and commensurate with the level of
risk, criticality, and complexity of each supplier relationship
Ex2: Assess the suitability of the technology and cybersecurity capabilities
and the risk management practices of prospective suppliers
Ex3: Conduct supplier risk assessments against business and applicable cybersecurity
requirements
Ex4: Assess the authenticity, integrity, and security of critical products
prior to acquisition and use
3rd: 3rd Party Risk'
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.sc-07
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.sc
ref_id: GV.SC-07
description: The risks posed by a supplier, their products and services, and
other third parties are understood, recorded, prioritized, assessed, responded
to, and monitored over the course of the relationship
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:node64
assessable: false
depth: 4
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.sc-07
name: Examples
description: 'Ex1: Adjust assessment formats and frequencies based on the third
party''s reputation and the criticality of the products or services they provide
Ex2: Evaluate third parties'' evidence of compliance with contractual cybersecurity
requirements, such as self-attestations, warranties, certifications, and other
artifacts
Ex3: Monitor critical suppliers to ensure that they are fulfilling their security
obligations throughout the supplier relationship lifecycle using a variety
of methods and techniques, such as inspections, audits, tests, or other forms
of evaluation
Ex4: Monitor critical suppliers, services, and products for changes to their
risk profiles, and reevaluate supplier criticality and risk impact accordingly
Ex5: Plan for unexpected supplier and supply chain-related interruptions to
ensure business continuity
3rd: 3rd Party Risk'
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.sc-08
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.sc
ref_id: GV.SC-08
description: Relevant suppliers and other third parties are included in incident
planning, response, and recovery activities
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:node66
assessable: false
depth: 4
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.sc-08
name: Examples
description: 'Ex1: Define and use rules and protocols for reporting incident
response and recovery activities and the status between the organization and
its suppliers
Ex2: Identify and document the roles and responsibilities of the organization
and its suppliers for incident response
Ex3: Include critical suppliers in incident response exercises and simulations
Ex4: Define and coordinate crisis communication methods and protocols between
the organization and its critical suppliers
Ex5: Conduct collaborative lessons learned sessions with critical suppliers
3rd: 3rd Party Risk'
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.sc-09
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.sc
ref_id: GV.SC-09
description: Supply chain security practices are integrated into cybersecurity
and enterprise risk management programs, and their performance is monitored
throughout the technology product and service life cycle
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:node68
assessable: false
depth: 4
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.sc-09
name: Examples
description: 'Ex1: Policies and procedures require provenance records for all
acquired technology products and services
Ex2: Periodically provide risk reporting to leaders about how acquired components
are proven to be untampered and authentic
Ex3: Communicate regularly among cybersecurity risk managers and operations
personnel about the need to acquire software patches, updates, and upgrades
only from authenticated and trustworthy software providers
Ex4: Review policies to ensure that they require approved supplier personnel
to perform maintenance on supplier products
Ex5: Policies and procedure require checking upgrades to critical hardware
for unauthorized changes
3rd: 3rd Party Risk'
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.sc-10
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.sc
ref_id: GV.SC-10
description: Cybersecurity supply chain risk management plans include provisions
for activities that occur after the conclusion of a partnership or service
agreement
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:node70
assessable: false
depth: 4
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:gv.sc-10
name: Examples
description: 'Ex1: Establish processes for terminating critical relationships
under both normal and adverse circumstances
Ex2: Define and implement plans for component end-of-life maintenance support
and obsolescence
Ex3: Verify that supplier access to organization resources is deactivated
promptly when it is no longer needed
Ex4: Verify that assets containing the organization''s data are returned or
properly disposed of in a timely, controlled, and safe manner
Ex5: Develop and execute a plan for terminating or transitioning supplier
relationships that takes supply chain security risk and resiliency into account
Ex6: Mitigate risks to data and systems created by supplier termination
Ex7: Manage data leakage risks associated with supplier termination
3rd: 3rd Party Risk'
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:id
assessable: false
depth: 1
ref_id: ID
name: IDENTIFY
description: The organization's current cybersecurity risks are understood
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:id.am
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:id
ref_id: ID.AM
name: Asset Management
description: Assets (e.g., data, hardware, software, systems, facilities, services,
people) that enable the organization to achieve business purposes are identified
and managed consistent with their relative importance to organizational objectives
and the organization's risk strategy
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:id.am-01
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:id.am
ref_id: ID.AM-01
description: Inventories of hardware managed by the organization are maintained
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:node74
assessable: false
depth: 4
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:id.am-01
name: Examples
description: '1st: 1st Party Risk
Ex1: Maintain inventories for all types of hardware, including IT, IoT, OT,
and mobile devices
Ex2: Constantly monitor networks to detect new hardware and automatically
update inventories'
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:id.am-02
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:id.am
ref_id: ID.AM-02
description: Inventories of software, services, and systems managed by the organization
are maintained
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:node76
assessable: false
depth: 4
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:id.am-02
name: Examples
description: '1st: 1st Party Risk
Ex1: Maintain inventories for all types of software and services, including
commercial-off-the-shelf, open-source, custom applications, API services,
and cloud-based applications and services
Ex2: Constantly monitor all platforms, including containers and virtual machines,
for software and service inventory changes
Ex3: Maintain an inventory of the organization''s systems'
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:id.am-03
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:id.am
ref_id: ID.AM-03
description: Representations of the organization's authorized network communication
and internal and external network data flows are maintained
- urn: urn:intuitem:risk:req_node:nist-csf-2.0:node78
assessable: false
depth: 4
parent_urn: urn:intuitem:risk:req_node:nist-csf-2.0:id.am-03
name: Examples
description: '1st: 1st Party Risk
3rd: 3rd Party Risk
Ex1: Maintain baselines of communication and data flows within the organization''s
wired and wireless networks
Ex2: Maintain baselines of communication and data flows between the organization