NIST Cybersecurity Framework 2.0

The organisational mission is understood and informs cybersecurity risk management.

Risk management objectives are established and agreed to by organisational stakeholders.

Lines of communication across the organisation are established for cybersecurity risks, including risks from suppliers and other third parties.

Roles, responsibilities and authorities related to cybersecurity risk management are established, communicated, understood and enforced.

Policy for managing cybersecurity risks is established based on organisational context, cybersecurity strategy and priorities, and is communicated and enforced.

Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment and improvement processes.

Relevant suppliers and other third parties are included in incident planning, response and recovery activities.

Inventories of hardware managed by the organisation are maintained.

Inventories of software, services and systems managed by the organisation are maintained.

Assets are prioritised based on classification, criticality, resources and impact on the mission.

Vulnerabilities in assets are identified, validated and recorded.

Threats, vulnerabilities, likelihoods and impacts are used to understand inherent risk and inform risk response prioritisation.

Improvements are identified from evaluations, including self-assessments, audits and reviews.

Identities and credentials for authorised users, services and hardware are managed by the organisation.

Users, services and hardware are authenticated, with the strength of authentication commensurate with risk.

Access permissions, entitlements and authorisations are defined in a policy, managed, enforced and reviewed, and incorporate the principles of least privilege and separation of duties.

Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind.

The confidentiality, integrity and availability of data at rest are protected.

The confidentiality, integrity and availability of data in transit are protected.

Backups of data are created, protected, maintained and tested.

Software is maintained, replaced and removed commensurate with risk, including timely application of patches.

Log records are generated and made available for continuous monitoring.

Secure software development practices are integrated and their performance is monitored throughout the software development life cycle.

Networks and environments are protected from unauthorised logical access and usage.

Networks and network services are monitored to find potentially adverse events.

Computing hardware and software, runtime environments and their data are monitored to find potentially adverse events.

Potentially adverse events are analysed to better understand associated activities.

Information on adverse events is provided to authorised staff and tools.

The incident response plan is executed in coordination with relevant third parties once an incident is declared.

Incident reports are triaged and validated.

Analysis is performed to establish what has taken place during an incident and the root cause of the incident.

Internal and external stakeholders are notified of incidents in accordance with the organisation's reporting criteria.

The recovery portion of the incident response plan is executed once initiated from the incident response process.

The integrity of backups and other restoration assets is verified before using them for restoration.

Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders.