Framework: The NIST Cybersecurity Framework (CSF)

DE.CM-03 monitors personnel activity and technology usage to identify potentially adverse events, such as insider threats or policy violations, using tools like behavior analytics and access logs. This includes tracking unusual access patterns or interactions with deception technologies, like honeypot accounts, to detect malicious intent. It focuses on the human element of security risks.

This subcategory enhances insider threat detection by providing visibility into user actions, ensuring deviations from norms trigger investigation. It aligns monitoring with risk strategies, prioritizing high-privilege users or critical systems. DE.CM-03 strengthens defenses against both intentional and unintentional personnel-related risks.

DE.CM-02 involves monitoring the physical environment housing technology assets to detect adverse events, such as unauthorized access or tampering with controls like locks and alarms. This includes reviewing logs from badge readers and visitor records for unusual patterns, supplemented by tools like cameras and security guards. It protects the physical layer of cybersecurity.

This subcategory ensures that physical breaches, which could enable logical attacks, are identified quickly, aligning monitoring with risk levels for critical areas. It supports a holistic security approach by integrating physical oversight with digital defenses. DE.CM-02 safeguards assets from tangible threats that could compromise operations.

DE.CM-01 focuses on continuously monitoring networks and network services, such as DNS and BGP, to detect potentially adverse events like unauthorized connections or traffic anomalies. This involves comparing real-time network flows against established baselines to identify deviations that could signal a security threat. It ensures visibility into network activity to catch issues early.

This subcategory strengthens proactive defense by monitoring both wired and wireless networks, including facilities for rogue access points, aligning efforts with risk priorities. It supports rapid detection of compromises by maintaining a comprehensive view of network behavior. DE.CM-01 is a cornerstone of network security vigilance.

PR.IR-04 maintains sufficient resource capacity—storage, compute, power, and bandwidth—to ensure system availability, monitoring usage and forecasting needs. This proactive scaling prevents performance bottlenecks or failures that could disrupt operations. It aligns capacity planning with risk and resilience objectives.

This subcategory supports uninterrupted access to critical systems by anticipating growth and stress scenarios, ensuring resources meet demand. It reduces availability risks through data-driven adjustments, keeping services operational. PR.IR-04 sustains the infrastructure’s ability to deliver under pressure.

PR.IR-03 implements mechanisms like redundant storage, load balancing, and high-availability components to meet resilience requirements under both normal and adverse conditions. This avoids single points of failure, ensuring systems remain operational during disruptions. It supports continuous service delivery aligned with risk goals.

This subcategory enhances infrastructure reliability by distributing resources and capacity to handle stress or attacks, reducing outage risks. It ensures that resilience measures match organizational priorities, maintaining functionality. PR.IR-03 builds a robust backbone for operational stability.

PR.IR-02 safeguards technology assets from environmental threats like flooding, fire, or excessive heat, using physical protections and resilient infrastructure. This includes requiring service providers to mitigate such risks in their operations, ensuring consistent protection across owned and outsourced systems. It maintains asset availability under adverse conditions.

This subcategory aligns environmental safeguards with risk strategies, prioritizing critical assets to minimize downtime or damage. It ensures operational continuity by addressing natural and facility-based threats proactively. PR.IR-02 complements cybersecurity with physical resilience.

PR.IR-01 protects networks and environments from unauthorized logical access by segmenting them based on trust boundaries (e.g., IT, IoT, OT) and restricting communications to essentials. This includes zero trust architectures and endpoint health checks to limit access to verified devices only. It prevents intruders from moving freely within systems.

This subcategory enhances resilience by isolating critical segments and blocking unnecessary external connections, aligning protections with risk levels. It ensures that only authorized, healthy endpoints interact with resources, reducing exposure. PR.IR-01 fortifies the logical perimeter of the organization’s infrastructure.

PR.PS-06 integrates secure development practices into the software lifecycle, protecting code from tampering and ensuring releases have minimal vulnerabilities. This includes monitoring performance to maintain security in production and securely disposing of software when obsolete. It ensures organization-developed software meets high security standards.

This subcategory enhances software integrity by embedding cybersecurity from design to deployment, reducing exploitable flaws. It aligns development with risk management goals, supporting ongoing improvement through performance tracking. PR.PS-06 fosters secure, reliable software outputs.

PR.PS-05 prevents the installation and execution of unauthorized software by restricting platforms to approved applications and verifying software integrity before use. This includes using approved DNS services to block malicious domains and limiting execution to permitted products where risk warrants. It reduces the risk of malware or unvetted software compromising systems.

This subcategory strengthens control by enforcing a secure software environment, aligning restrictions with organizational risk tolerance. It ensures only trusted, necessary software operates, minimizing vulnerabilities. PR.PS-05 locks down platforms against unauthorized changes.

PR.PS-04 requires configuring systems, applications, and services to generate log records that support continuous monitoring, ensuring visibility into activities and events. This includes securely sharing logs with centralized infrastructure for analysis, tailored to needs like zero trust architectures. It provides the data needed to detect and respond to threats.

This subcategory enhances security by enabling real-time oversight of platform behavior, critical for identifying anomalies or breaches. It aligns logging with risk priorities, ensuring comprehensive coverage across IT and cloud environments. PR.PS-04 underpins proactive threat detection and response.