Framework: The NIST Cybersecurity Framework (CSF)

ID.RA-09 requires assessing the authenticity and integrity of hardware and software before purchase or deployment, ensuring they are free from tampering or vulnerabilities. This due diligence verifies that critical technology meets security standards, reducing the risk of compromised assets entering the environment. It’s a preventive measure against supply chain threats.

This subcategory supports secure acquisition by integrating cybersecurity checks into procurement, protecting organizational operations from the outset. It ensures that only trusted components are used, aligning with risk management goals. ID.RA-09 safeguards the foundation of the technology stack.

ID.RA-08 establishes processes for handling vulnerability disclosures from suppliers, customers, or government sources, ensuring timely analysis and response. This includes assigning responsibilities to assess impacts and coordinate with stakeholders under defined protocols, often outlined in contracts. It keeps the organization responsive to external vulnerability reports.

This subcategory enhances collaboration by structuring information sharing, reducing delays in addressing disclosed weaknesses. It ensures that vulnerabilities are systematically processed, validated, and mitigated, strengthening overall security. ID.RA-08 connects external insights to internal risk management.

ID.RA-07 focuses on managing changes to systems or processes and exceptions to policies, assessing their risk impacts, and documenting them for oversight. This includes formal procedures for reviewing proposed changes, evaluating risks, and planning rollbacks if needed. Tracking ensures that accepted risks or exceptions are revisited over time.

This subcategory prevents unintended vulnerabilities by ensuring changes and exceptions are deliberate and risk-informed, reducing disruption. It maintains a record of decisions, supporting audits and accountability. ID.RA-07 integrates risk management into operational flexibility.

ID.RA-06 involves selecting, prioritizing, and planning risk responses—such as mitigation, acceptance, or transfer—based on assessed risks, then tracking and sharing progress. This structured process uses vulnerability management criteria to decide actions and monitor implementation through tools like risk registers. Communication ensures stakeholders are informed of planned responses.

This subcategory ensures that risk responses align with organizational priorities, balancing cost and effectiveness while maintaining visibility into execution. It supports accountability by tracking progress and adjusting plans as needed. ID.RA-06 operationalizes risk assessment into actionable, transparent steps.

ID.RA-05 uses data on threats, vulnerabilities, likelihoods, and impacts to assess inherent risk—the risk before controls are applied—and prioritize responses. This involves developing threat models to understand risks to critical assets and guide mitigation strategies. It ensures that risk management focuses on the most pressing dangers.

This subcategory supports strategic decision-making by linking risk analysis to resource investments, emphasizing high-probability, high-impact scenarios. It provides a structured approach to weighing risks against organizational tolerances. ID.RA-05 drives a risk-based prioritization of cybersecurity efforts.

ID.RA-04 requires assessing and documenting the likelihood and potential impacts of threats exploiting identified vulnerabilities, such as data breaches or system failures. This collaborative effort between business and cybersecurity teams estimates risk scenarios and their consequences, recorded in tools like risk registers. It provides a clear picture of risk severity and scope.

This subcategory informs prioritization by quantifying how threats could disrupt operations or cascade across systems, guiding resource allocation. It ensures that risk assessments reflect real-world implications, such as financial or reputational loss. ID.RA-04 bridges vulnerability identification with actionable risk insights.

ID.RA-03 involves identifying and documenting threats—both internal, like insider risks, and external, like cyberattacks—that could impact the organization. This process uses threat intelligence and hunting techniques to pinpoint actors and tactics likely to target operations or assets. Recording these threats ensures a comprehensive threat profile for risk planning.

This subcategory enhances situational awareness by focusing on threats specific to the organization’s context, enabling tailored defenses. It supports proactive measures, such as monitoring for signs of compromise within the environment. ID.RA-03 builds a foundation for understanding the full spectrum of potential dangers.

ID.RA-02 focuses on gathering cyber threat intelligence from forums, advisories, and reputable sources to stay informed about current and emerging threats. This intelligence includes details on threat actors, tactics, and vulnerabilities relevant to the organization’s assets. It ensures that cybersecurity tools and teams have up-to-date information to enhance detection and response.

This subcategory strengthens proactive defense by integrating intelligence feeds into security systems, improving accuracy in identifying risks. It supports awareness of threats tied to new technologies or industry trends, broadening the risk perspective. ID.RA-02 keeps the organization connected to the broader threat landscape.

ID.RA-01 involves identifying, validating, and documenting vulnerabilities in organizational assets, including software, hardware, and facilities. This process uses tools and assessments to pinpoint weaknesses—like unpatched software or physical security gaps—that could be exploited. Recording these vulnerabilities ensures a clear record for tracking and remediation.

This subcategory supports risk management by providing a comprehensive view of potential entry points for threats, enabling prioritized responses. It includes monitoring external intelligence for new vulnerabilities, keeping the organization ahead of emerging risks. ID.RA-01 is a critical first step in understanding and mitigating asset-specific threats.

ID.AM-08 focuses on managing all assets—systems, hardware, software, services, and data—across their entire life cycles, from deployment to disposal. This includes integrating cybersecurity considerations into acquisition, use, and retirement phases, ensuring consistent protection. It addresses risks like shadow IT or redundant systems that expand the attack surface.

This subcategory promotes secure configuration, timely updates, and proper disposal, such as data sanitization, to prevent vulnerabilities at any stage. It ensures inventories reflect asset movements or changes, maintaining accuracy over time. ID.AM-08 sustains a lifecycle approach to asset security and resilience.