Framework: The NIST Cybersecurity Framework (CSF)

ID.AM-07 requires maintaining inventories of designated data types—like PII, health information, or intellectual property—along with metadata such as provenance and ownership. This ongoing effort ensures organizations know where sensitive data resides and how it’s classified, critical for compliance and security. It supports tracking data across systems and locations.

This subcategory enhances data protection by enabling continuous discovery and tagging of sensitive information, reducing the risk of overlooked exposures. It provides a foundation for managing data risks, such as breaches or misuse, throughout its lifecycle. ID.AM-07 strengthens data governance within asset management.

ID.AM-05 involves prioritizing assets—data, hardware, software, and services—based on their classification, criticality, resource needs, and mission impact. This process defines criteria to rank assets, ensuring that those most vital to organizational objectives receive focused protection. Regular updates keep priorities aligned with changing conditions.

This subcategory enables efficient resource allocation by directing cybersecurity efforts toward high-value assets, reducing the risk of mission disruption. It supports strategic planning by linking asset importance to risk management decisions. ID.AM-05 ensures that protection efforts match organizational priorities.

ID.AM-04 requires organizations to keep inventories of supplier-provided services, such as IaaS, PaaS, SaaS, and APIs, used in their operations. This tracking ensures awareness of external dependencies that could introduce risks if not properly managed. It provides a basis for monitoring and securing third-party service usage.

This subcategory enhances oversight by updating inventories whenever new services are adopted, aligning them with cybersecurity risk management efforts. It helps identify critical external services that require heightened scrutiny or contractual safeguards. ID.AM-04 strengthens supply chain visibility within asset management.

ID.AM-03 involves maintaining up-to-date representations of authorized network communications and data flows, both within the organization and with external entities. This includes documenting baselines for wired, wireless, and cloud-based interactions, as well as expected protocols and ports. It ensures visibility into how data moves, critical for detecting anomalies or unauthorized access.

This subcategory supports risk management by providing a reference for normal network behavior, enabling quick identification of deviations that might signal a breach. It fosters secure configuration and monitoring of network infrastructure, including third-party connections. ID.AM-03 underpins a robust defense against network-based threats.

ID.AM-02 focuses on maintaining detailed inventories of software, services, and systems, covering everything from commercial applications to cloud-based offerings and custom solutions. This comprehensive tracking ensures organizations know what digital assets they manage, aiding in vulnerability identification and compliance efforts. It provides a clear picture of the software landscape supporting operations.

This subcategory enhances security by monitoring platforms like containers and virtual machines for changes, ensuring the inventory reflects real-time usage. It supports lifecycle management by identifying outdated or unsupported software that could pose risks. ID.AM-02 strengthens the organization’s ability to protect its digital environment.

ID.AM-01 requires organizations to maintain comprehensive inventories of all hardware assets under their control, including IT, IoT, OT, and mobile devices. This ongoing cataloging ensures visibility into the physical components that support operations, enabling better risk assessment and management. Accurate inventories are foundational to identifying vulnerabilities and protecting critical assets.

This subcategory supports proactive security by integrating real-time monitoring to detect and log new hardware, keeping the inventory current. It facilitates tracking of hardware locations and status, reducing the risk of unmanaged devices becoming entry points for threats. ID.AM-01 establishes a baseline for securing the organization’s physical infrastructure.

GV.SC-10 ensures that supply chain risk management plans address post-relationship activities, such as terminating supplier access or managing data disposal. This involves establishing processes for secure transitions, including end-of-life maintenance and asset recovery, to prevent residual risks. It safeguards the organization after partnerships end.

This subcategory mitigates risks like data leakage or system vulnerabilities by verifying that supplier obligations are fulfilled at termination. It promotes resilience by planning for both normal and adverse exits, ensuring continuity and security. GV.SC-10 closes the loop on supply chain risk management.

GV.SC-09 embeds supply chain security practices into cybersecurity and enterprise risk management, ensuring consistent oversight from acquisition to disposal of products and services. This integration includes requiring provenance records and monitoring performance metrics to verify authenticity and security. It aligns supply chain activities with organizational risk strategies.

This subcategory supports ongoing risk reporting and communication, ensuring that leaders and operations personnel address supply chain vulnerabilities, such as unauthorized hardware upgrades. It maintains security throughout the technology lifecycle, reducing risks from compromised components. GV.SC-09 reinforces a holistic approach to managing supply chain threats.

GV.SC-08 integrates key suppliers and third parties into the organization’s incident planning, response, and recovery efforts, ensuring coordinated action during cybersecurity events. This includes defining roles, communication protocols, and participation in exercises like simulations to prepare for incidents. Collaboration with suppliers enhances the organization’s ability to manage and recover from disruptions.

This subcategory fosters resilience by aligning supplier and organizational response strategies, reducing delays and miscommunication during crises. It ensures that third parties contribute to lessons learned, improving future preparedness. GV.SC-08 strengthens the collective response to supply chain-related incidents.

GV.SC-07 ensures ongoing understanding and management of risks from suppliers and third parties throughout their relationship with the organization. This involves documenting, prioritizing, and assessing risks—such as product vulnerabilities or service disruptions—and developing tailored responses. Continuous monitoring keeps these risks in check over time.

This subcategory promotes a dynamic risk management process, using methods like audits or inspections to verify supplier compliance and adapt to changing risk profiles. It ensures that critical suppliers are closely watched, maintaining security across the relationship lifecycle. GV.SC-07 sustains vigilance and responsiveness in supply chain security.