The text of the Cybersecurity Framework Organizational Profile Template
Approval #
| Role | Name | Signature |
|---|---|---|
| Chief Information Security Officer (CISO) |
Revision History #
| Date | Version | Description | Reviewer |
|---|---|---|---|
| 2026-10-31 | 1.0 | Initial issuance | [Reviewer name] |
Review cycle: Every year with the Target Profile, and after the National Institute of Standards and Technology (NIST) changes the Framework or the Inspector General’s metrics change.
Mandate. Executive Order 13800 requires each agency head to manage cybersecurity risk with the NIST Cybersecurity Framework or any successor document (EO 13800, §1(c)(ii)).
The successor to that Framework is Cybersecurity Framework (CSF) 2.0. The Inspector General (IG) rates how well the Organization builds and keeps cybersecurity profiles. The IG uses metric CG.01 in its yearly review under Federal Information Security Modernization Act (FISMA) (FY 2025 IG FISMA Reporting Metrics). The Office of Management and Budget (OMB) kept the FY 2025 metrics for FY 2026. The metric asks: “To what extent does the organization develop and maintain cybersecurity profiles that are used to understand, tailor, assess, prioritize and communicate its cybersecurity objectives?” This template is how the Organization answers it.
The template carries out NIST SP 800-53 Rev. 5 controls PM-11 and PM-09. Under PM-11, the Organization states the protection needs of its missions; under PM-9, it applies its risk management strategy. CG.01 names PM-1 and PM-11. The steps follow the five steps in NIST SP 1301.
1. Purpose and Scope #
An Organizational Profile describes the Organization’s current and target cybersecurity posture in terms of the CSF 2.0 outcomes. The Current Profile records the outcomes the Organization achieves today and how well. The Target Profile records the outcomes it wants to achieve, and their priority. The gap between them becomes a prioritized action plan.
The Organization may keep more than one profile, each with its own scope. The first profile covers the whole Organization. Each profile lists all 106 Subcategories in the 22 Categories of the CSF 2.0 Core. The Categories fall under six Functions: Govern (GV), Identify (ID), Protect (PR), Detect (DE), Respond (RS), and Recover (RC). The owner marks any Subcategory that is out of scope, with the reason.
| Profile setting | Entry |
|---|---|
| Profile name | [Name] |
| Scope | [Assignment: organization-defined profile scope (organization, division, process, or system) — to be defined] |
| Reason for the profile | [Why the Organization is building it] |
| Rating scale | [Assignment: organization-defined rating scale: CSF Tiers 1 to 4 or IG FISMA maturity levels 1 to 5 — to be defined] |
| Progress reporting | [Assignment: organization-defined frequency for reporting progress on the action plan — to be defined] |
| Profile owner | CISO |
| Target Profile approved by | Senior Accountable Official for Risk Management, [date] |
2. Roles and Responsibilities #
| Role | Responsibilities |
|---|---|
| CISO | Owns this template and leads the profile work. Scopes each profile, gathers the information, and writes the action plan. Reports progress to the Senior Accountable Official for Risk Management and the Chief Information Officer (CIO). |
| Senior Accountable Official for Risk Management | Approves each Target Profile, so that it matches the risk appetite in the Risk Management Strategy. Decides priorities when owners disagree. |
| CIO | Uses the Target Profile and the action plan when choosing IT investments and architecture changes. |
| Mission/Business Owners | Give the mission objectives, stakeholder needs, and priorities each Target Profile must reflect. |
| Enterprise Security Architect | Compares the security architecture with the Target Profile and proposes changes to close gaps. |
| System Owners and Information System Security Officers (ISSOs) | Record the current state and the evidence for the outcomes their systems support. Record each system-level gap as a plan of action and milestones (POA&M) item. |
| supply chain risk management (SCRM) Lead | Records the current and target state for the Cybersecurity Supply Chain Risk Management (GV.SC) outcomes. |
3. How to Complete the Profile #
The CISO runs these steps each year and after a major change. A major change includes a new mission, a major incident, or a new version of the CSF or the IG FISMA metrics.
| Actor | Action | Tool | Evidence | Controls |
|---|---|---|---|---|
| CISO | Scopes the profile. Records why it exists, what it covers, who fills it in, and the rating scale. The Senior Accountable Official for Risk Management agrees the scope. | The document management system | Scope record | PM-11 |
| CISO’s staff | Gathers the inputs: the Risk Management Strategy, policies, business impact analysis (BIA) results, assessment results, POA&M items, Inspector General findings, and inventories. | The governance, risk, and compliance (GRC) system, the document management system | Input list | PM-09 |
| System Owners and control owners | Fill in the Current Profile: the current state, the current tier or maturity, and the evidence for each Subcategory in scope. | This template | Completed Current Profile | PM-11, CA-07 |
| CISO with Mission/Business Owners | Fill in the Target Profile: the target state, the target tier or maturity, and the priority for each Subcategory. Mark Subcategories out of scope with the reason. | This template | Draft Target Profile | PM-09, PM-11 |
| Senior Accountable Official for Risk Management | Approves the Target Profile. | The document management system | Signed approval | PM-09 |
| CISO | Records the gap for each Subcategory and writes the action plan, with an owner, a deadline, and resources for each action. Sends system-level gaps to the ISSOs for POA&M items. | This template, the GRC system | Action plan; POA&M items | PM-04, CA-05 |
| CISO | Reports progress on the action plan at the set frequency, and updates both profiles every year and after a major change. | The document management system | Progress reports; updated profiles | PM-06, PM-11 |
Fill in the profile tables at the end of this template. The Related documents column is already filled in. It lists the Organization’s documents that carry the NIST SP 800-53 controls NIST maps to each Subcategory. NIST SP 1301 recommends that path, from each Subcategory to its controls, when the CISO writes the action plan. The CISO checks the list when a document is added or retired.
Evidence: the scope record, the completed profiles, the signed approval, the action plan, the POA&M items, and the progress reports.
4. Rating Scales #
Choose one scale for each profile and record it in the profile settings. The CSF Tiers rate how rigorous the governance and management practices are (CSF 2.0, Appendix B). The IG FISMA maturity levels match the scale the Inspector General uses.
| Rating | CSF Tier | What it means |
|---|---|---|
| 1 | Partial | The Organization manages the outcome case by case, without set priorities. |
| 2 | Risk Informed | Management approves the practice, but it is not yet Organization-wide policy. |
| 3 | Repeatable | Organization-wide policy sets the practice, and staff follow it and update it as risk changes. |
| 4 | Adaptive | The Organization improves the practice from lessons learned and threat information, and measures it. |
| Rating | IG FISMA maturity level | What it means |
|---|---|---|
| 1 | Ad hoc | No formal policy or procedure exists for the outcome. |
| 2 | Defined | Policy and procedure exist, but staff do not apply them everywhere. |
| 3 | Consistently implemented | Staff apply the policy and procedure everywhere, but measures are missing. |
| 4 | Managed and measurable | The Organization collects measures and uses them to make changes. |
| 5 | Optimized | The practice is part of how the Organization works, and it changes with the threat. |
Rate priority as high, medium, or low. A high priority means a gap that puts a mission, a High Value Asset, or a legal requirement at risk. Describe each gap in words, and write “None” when the current state meets the target.
5. Example Row #
This example shows one Subcategory filled in. The Organization’s own entries replace it.
| Column | Example entry |
|---|---|
| Subcategory | GV.SC-04: Suppliers are known and prioritized by criticality |
| Current state | The SCRM Team has assigned a tier to the suppliers of the Moderate and High systems. Suppliers of Low systems have no tier yet. |
| Current tier or maturity | 2 |
| Target state | Every supplier has a criticality tier, and the SCRM Lead reviews the critical supplier list at the set frequency. |
| Target tier and priority | 3, high |
| Gap | Suppliers of Low systems have no tier, and nobody reviews the list on a schedule. |
| Owner | SCRM Lead |
| Related documents | Supply Chain Risk Management Strategy and Implementation Plan; Supply Chain Risk Management Policy and Procedures |
| Evidence | The critical supplier list in the GRC system, and the SCRM Council minutes in the document management system |
| Action | Assign tiers to Low-system suppliers by the end of the next quarter, and add the review to the SCRM Council calendar. |
6. Answering IG FISMA Metric CG.01 #
The Inspector General rates CG.01 on five maturity levels. This table shows what each level asks for and the record this template produces for it.
| IG maturity level | What the Inspector General looks for | How the Organization meets it with this template |
|---|---|---|
| 2, Defined | Policies and procedures for current and target profiles that consider the mission, threats, resources, and constraints, and a defined profile scope | The steps and roles in this template, and the scope record |
| 3, Consistently implemented | Current and target profiles kept up to date, a target that considers expected changes, and a prioritized action plan for the gaps | The completed Current and Target Profiles and the action plan |
| 4, Managed and measurable | Progress reports against measurable objectives, profiles aligned with the risk strategy and used for architecture and investments, and profiles refined for residual risk | The progress reports, the Senior Accountable Official for Risk Management’s approval, and the CIO’s use of the profile in investment decisions |
| 5, Optimized | Near real-time monitoring, threat information used to adjust the Target Profile, and profiles used with external stakeholders | Measures fed from continuous monitoring, and updates after each threat review |
Evidence: the records named in the last column, kept in the document management system.
7. Action Plan #
The CISO lists each action that closes a gap. Each action has an owner, a deadline, and the resources it needs. System-level gaps also become POA&M items in the GRC system.
| Action | Subcategories | Owner | Resources | Due date and status |
|---|---|---|---|---|
| [What the Organization will do] | [IDs] | [Role] | [Staff, funding, tools, or contract support] | [Date; planned, in progress, or complete] |
8. Workbook #
When the generator runs, it also writes these tables as a workbook, MAT-CSF-Organizational-Profile.xlsx. The workbook holds every column in one row per Subcategory, for teams that prefer a spreadsheet. The Word template and the workbook hold the same rows.
9. Profile Tables #
Govern (GV) #
Govern (GV): The organization’s cybersecurity risk management strategy, expectations, and policy are established, communicated, and monitored.
Current Profile.
| Subcategory identifier and outcome | Related documents | Current state | Current tier | Evidence |
|---|---|---|---|---|
| GV.OC: Organizational Context | ||||
| GV.OC-01: The organizational mission is understood and informs cybersecurity risk management | Program Management Policy | [Current state] | [Tier] | [Records] |
| GV.OC-02: Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered | Supply Chain Risk Management Strategy and Implementation Plan; Privacy Program Plan; Risk Management Strategy; Software and Hardware Assurance Policy; Cybersecurity Risk Register Template; Supply Chain Risk Management Policy and Procedures; Program Management Policy | [Current state] | [Tier] | [Records] |
| GV.OC-03: Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed | Policy and Procedure Management Policy; Zero Trust and identity, credential, and access management (ICAM) Implementation Plan; Risk Management Strategy; Controlled Unclassified Information (CUI) Policy; Every family policy and procedure | [Current state] | [Tier] | [Records] |
| GV.OC-04: Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated | Supply Chain Risk Management Strategy and Implementation Plan; Program Management Policy; Contingency Planning Policy and Procedures; Risk Assessment Policy and Procedures | [Current state] | [Tier] | [Records] |
| GV.OC-05: Outcomes, capabilities, and services that the organization depends on are understood and communicated | Supply Chain Risk Management Strategy and Implementation Plan; Risk Management Strategy; Software and Hardware Assurance Policy; Interconnection and Information Exchange Agreement Templates; Cybersecurity Risk Register Template; Program Management Policy; Risk Assessment Policy and Procedures; System and Services Acquisition Policy and Procedures; Supply Chain Risk Management Policy and Procedures | [Current state] | [Tier] | [Records] |
| GV.RM: Risk Management Strategy | ||||
| GV.RM-01: Risk management objectives are established and agreed to by organizational stakeholders | Risk Management Strategy; Cybersecurity Risk Register Template; Supply Chain Risk Management Strategy and Implementation Plan; Program Management Policy; Risk Assessment Policy and Procedures; Supply Chain Risk Management Policy and Procedures | [Current state] | [Tier] | [Records] |
| GV.RM-02: Risk appetite and risk tolerance statements are established, communicated, and maintained | Risk Management Strategy; Cybersecurity Risk Register Template; Program Management Policy | [Current state] | [Tier] | [Records] |
| GV.RM-03: Cybersecurity risk management activities and outcomes are included in enterprise risk management processes | Risk Management Strategy; Supply Chain Risk Management Strategy and Implementation Plan; Cybersecurity Risk Register Template; IT Governance and Investment Management Policy; Program Management Policy; Risk Assessment Policy and Procedures; System and Services Acquisition Policy and Procedures; Supply Chain Risk Management Policy and Procedures | [Current state] | [Tier] | [Records] |
| GV.RM-04: Strategic direction that describes appropriate risk response options is established and communicated | Risk Management Strategy; Supply Chain Risk Management Strategy and Implementation Plan; Cybersecurity Risk Register Template; Program Management Policy; Supply Chain Risk Management Policy and Procedures | [Current state] | [Tier] | [Records] |
| GV.RM-05: Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties | Risk Management Strategy; Supply Chain Risk Management Strategy and Implementation Plan; Cybersecurity Risk Register Template; Program Management Policy | [Current state] | [Tier] | [Records] |
| GV.RM-06: A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated | Risk Management Strategy; Privacy Program Plan; Supply Chain Risk Management Strategy and Implementation Plan; Risk Assessment and Federal Information Processing Standards (FIPS) 199 Categorization — Template; Cybersecurity Risk Register Template; Program Management Policy; Risk Assessment Policy and Procedures | [Current state] | [Tier] | [Records] |
| GV.RM-07: Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions | Risk Management Strategy; Privacy Program Plan; Supply Chain Risk Management Strategy and Implementation Plan; Risk Assessment and FIPS 199 Categorization — Template; Cybersecurity Risk Register Template; Program Management Policy; Risk Assessment Policy and Procedures | [Current state] | [Tier] | [Records] |
| GV.RR: Roles, Responsibilities, and Authorities | ||||
| GV.RR-01: Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving | Program Management Policy | [Current state] | [Tier] | [Records] |
| GV.RR-02: Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced | Role-Based Training and Cybersecurity Workforce Plan; Program Management Policy | [Current state] | [Tier] | [Records] |
| GV.RR-03: Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies | IT Governance and Investment Management Policy; Program Management Policy | [Current state] | [Tier] | [Records] |
| GV.RR-04: Cybersecurity is included in human resources practices | Role-Based Training and Cybersecurity Workforce Plan; Policy and Procedure Management Policy; Personnel Security Policy and Procedures; Program Management Policy | [Current state] | [Tier] | [Records] |
| GV.PO: Policy | ||||
| GV.PO-01: Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced | Policy and Procedure Management Policy; Zero Trust and ICAM Implementation Plan; Controlled Unclassified Information (CUI) Policy; Every family policy and procedure | [Current state] | [Tier] | [Records] |
| GV.PO-02: Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission | Policy and Procedure Management Policy; Zero Trust and ICAM Implementation Plan; Controlled Unclassified Information (CUI) Policy; Every family policy and procedure | [Current state] | [Tier] | [Records] |
| GV.OV: Oversight | ||||
| GV.OV-01: Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction | Policy and Procedure Management Policy; Risk Management Strategy; Supply Chain Risk Management Strategy and Implementation Plan; Zero Trust and ICAM Implementation Plan; Cybersecurity Risk Register Template; Information Security Continuous Monitoring (ISCM) Strategy; Privacy Program Plan; Controlled Unclassified Information (CUI) Policy; Every family policy and procedure | [Current state] | [Tier] | [Records] |
| GV.OV-02: The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks | Risk Management Strategy; Supply Chain Risk Management Strategy and Implementation Plan; Cybersecurity Risk Register Template; Information Security Continuous Monitoring (ISCM) Strategy; Program Management Policy; Risk Assessment Policy and Procedures; Supply Chain Risk Management Policy and Procedures | [Current state] | [Tier] | [Records] |
| GV.OV-03: Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed | Risk Management Strategy; Supply Chain Risk Management Strategy and Implementation Plan; Cybersecurity Risk Register Template; Program Management Policy; Risk Assessment Policy and Procedures; Supply Chain Risk Management Policy and Procedures | [Current state] | [Tier] | [Records] |
| GV.SC: Cybersecurity Supply Chain Risk Management | ||||
| GV.SC-01: A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders | Supply Chain Risk Management Strategy and Implementation Plan; Supply Chain Risk Management Policy and Procedures; Program Management Policy | [Current state] | [Tier] | [Records] |
| GV.SC-02: Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally | Supply Chain Risk Management Strategy and Implementation Plan; Software and Hardware Assurance Policy; Supply Chain Risk Management Policy and Procedures | [Current state] | [Tier] | [Records] |
| GV.SC-03: Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes | Policy and Procedure Management Policy; Supply Chain Risk Management Strategy and Implementation Plan; Risk Management Strategy; Zero Trust and ICAM Implementation Plan; Cybersecurity Risk Register Template; Information Security Continuous Monitoring (ISCM) Strategy; Privacy Program Plan; Controlled Unclassified Information (CUI) Policy; Risk Assessment and FIPS 199 Categorization — Template; Every family policy and procedure | [Current state] | [Tier] | [Records] |
| GV.SC-04: Suppliers are known and prioritized by criticality | Supply Chain Risk Management Strategy and Implementation Plan; Interconnection and Information Exchange Agreement Templates; Risk Assessment Policy and Procedures; System and Services Acquisition Policy and Procedures; Supply Chain Risk Management Policy and Procedures | [Current state] | [Tier] | [Records] |
| GV.SC-05: Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties | Supply Chain Risk Management Strategy and Implementation Plan; Software and Hardware Assurance Policy; Interconnection and Information Exchange Agreement Templates; Supply Chain Risk Management Policy and Procedures; System and Services Acquisition Policy and Procedures | [Current state] | [Tier] | [Records] |
| GV.SC-06: Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships | Supply Chain Risk Management Strategy and Implementation Plan; Software and Hardware Assurance Policy; Interconnection and Information Exchange Agreement Templates; System and Services Acquisition Policy and Procedures; Supply Chain Risk Management Policy and Procedures | [Current state] | [Tier] | [Records] |
| GV.SC-07: The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship | Supply Chain Risk Management Strategy and Implementation Plan; Software and Hardware Assurance Policy; Interconnection and Information Exchange Agreement Templates; System and Services Acquisition Policy and Procedures; Supply Chain Risk Management Policy and Procedures; Risk Assessment Policy and Procedures | [Current state] | [Tier] | [Records] |
| GV.SC-08: Relevant suppliers and other third parties are included in incident planning, response, and recovery activities | Supply Chain Risk Management Strategy and Implementation Plan; Policy and Procedure Management Policy; Software and Hardware Assurance Policy; Interconnection and Information Exchange Agreement Templates; Supply Chain Risk Management Policy and Procedures; System and Services Acquisition Policy and Procedures; Contingency Planning Policy and Procedures; Incident Response Policy and Procedures | [Current state] | [Tier] | [Records] |
| GV.SC-09: Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle | Supply Chain Risk Management Strategy and Implementation Plan; Risk Management Strategy; Software and Hardware Assurance Policy; Cybersecurity Risk Register Template; Information Security Continuous Monitoring (ISCM) Strategy; Interconnection and Information Exchange Agreement Templates; Risk Assessment and FIPS 199 Categorization — Template; Program Management Policy; Supply Chain Risk Management Policy and Procedures; Risk Assessment Policy and Procedures; System and Services Acquisition Policy and Procedures | [Current state] | [Tier] | [Records] |
| GV.SC-10: Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement | Supply Chain Risk Management Strategy and Implementation Plan; Software and Hardware Assurance Policy; Information Security Continuous Monitoring (ISCM) Strategy; Risk Management Strategy; Vulnerability Management Policy; Interconnection and Information Exchange Agreement Templates; Risk Assessment and FIPS 199 Categorization — Template; Cybersecurity Risk Register Template; Supply Chain Risk Management Policy and Procedures; Risk Assessment Policy and Procedures; System and Services Acquisition Policy and Procedures; Program Management Policy | [Current state] | [Tier] | [Records] |
Target Profile.
| Subcategory identifier | Target state | Target tier and priority | Gap | Owner |
|---|---|---|---|---|
| GV.OC | ||||
| GV.OC-01 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| GV.OC-02 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| GV.OC-03 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| GV.OC-04 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| GV.OC-05 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| GV.RM | ||||
| GV.RM-01 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| GV.RM-02 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| GV.RM-03 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| GV.RM-04 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| GV.RM-05 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| GV.RM-06 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| GV.RM-07 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| GV.RR | ||||
| GV.RR-01 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| GV.RR-02 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| GV.RR-03 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| GV.RR-04 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| GV.PO | ||||
| GV.PO-01 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| GV.PO-02 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| GV.OV | ||||
| GV.OV-01 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| GV.OV-02 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| GV.OV-03 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| GV.SC | ||||
| GV.SC-01 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| GV.SC-02 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| GV.SC-03 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| GV.SC-04 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| GV.SC-05 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| GV.SC-06 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| GV.SC-07 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| GV.SC-08 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| GV.SC-09 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| GV.SC-10 | [Target state] | [Tier, priority] | [Gap] | [Role] |
Identify (ID) #
Identify (ID): The organization’s current cybersecurity risks are understood.
Current Profile.
| Subcategory identifier and outcome | Related documents | Current state | Current tier | Evidence |
|---|---|---|---|---|
| ID.AM: Asset Management | ||||
| ID.AM-01: Inventories of hardware managed by the organization are maintained | IT Asset Management Policy; Configuration Management Policy and Procedures; Program Management Policy | [Current state] | [Tier] | [Records] |
| ID.AM-02: Inventories of software, services, and systems managed by the organization are maintained | IT Asset Management Policy; Interconnection and Information Exchange Agreement Templates; System and Services Acquisition Policy and Procedures; Access Control Policy and Procedures; Configuration Management Policy and Procedures; Program Management Policy | [Current state] | [Tier] | [Records] |
| ID.AM-03: Representations of the organization’s authorized network communication and internal and external network data flows are maintained | Enterprise Architecture Policy; Interconnection and Information Exchange Agreement Templates; Assessment, Authorization, and Monitoring Policy and Procedures; Planning Policy and Procedures; Access Control Policy and Procedures; Program Management Policy | [Current state] | [Tier] | [Records] |
| ID.AM-04: Inventories of services provided by suppliers are maintained | Supply Chain Risk Management Strategy and Implementation Plan; Interconnection and Information Exchange Agreement Templates; Access Control Policy and Procedures; System and Services Acquisition Policy and Procedures; Supply Chain Risk Management Policy and Procedures | [Current state] | [Tier] | [Records] |
| ID.AM-05: Assets are prioritized based on classification, criticality, resources, and impact on the mission | Risk Assessment and FIPS 199 Categorization — Template; Risk Assessment Policy and Procedures | [Current state] | [Tier] | [Records] |
| ID.AM-07: Inventories of data and corresponding metadata for designated data types are maintained | Configuration Management Policy and Procedures; System and Information Integrity Policy and Procedures | [Current state] | [Tier] | [Records] |
| ID.AM-08: Systems, hardware, software, services, and data are managed throughout their life cycles | Software and Hardware Assurance Policy; End-of-Support Edge Device Inventory and Decommission Plan; Supply Chain Risk Management Strategy and Implementation Plan; System and Services Acquisition Policy and Procedures; Configuration Management Policy and Procedures; Maintenance Policy and Procedures; Program Management Policy; System and Information Integrity Policy and Procedures; Supply Chain Risk Management Policy and Procedures; Planning Policy and Procedures | [Current state] | [Tier] | [Records] |
| ID.RA: Risk Assessment | ||||
| ID.RA-01: Vulnerabilities in assets are identified, validated, and recorded | Information Security Continuous Monitoring (ISCM) Strategy; Vulnerability Management Policy; CUI Waivers and Self-Inspection Procedure; Risk Assessment and FIPS 199 Categorization — Template; Assessment, Authorization, and Monitoring Policy and Procedures; System and Services Acquisition Policy and Procedures; Risk Assessment Policy and Procedures; System and Information Integrity Policy and Procedures | [Current state] | [Tier] | [Records] |
| ID.RA-02: Cyber threat intelligence is received from information sharing forums and sources | Program Management Policy; System and Information Integrity Policy and Procedures | [Current state] | [Tier] | [Records] |
| ID.RA-03: Internal and external threats to the organization are identified and recorded | Risk Assessment and FIPS 199 Categorization — Template; Program Management Policy; Risk Assessment Policy and Procedures; System and Information Integrity Policy and Procedures | [Current state] | [Tier] | [Records] |
| ID.RA-04: Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded | Risk Assessment and FIPS 199 Categorization — Template; Risk Management Strategy; Cybersecurity Risk Register Template; Risk Assessment Policy and Procedures; Program Management Policy | [Current state] | [Tier] | [Records] |
| ID.RA-05: Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization | Risk Assessment and FIPS 199 Categorization — Template; Risk Management Strategy; Cybersecurity Risk Register Template; Risk Assessment Policy and Procedures; Program Management Policy | [Current state] | [Tier] | [Records] |
| ID.RA-06: Risk responses are chosen, prioritized, planned, tracked, and communicated | Risk Management Strategy; Cybersecurity Risk Register Template; Privacy Program Plan; Supply Chain Risk Management Strategy and Implementation Plan; Program Management Policy; Risk Assessment Policy and Procedures | [Current state] | [Tier] | [Records] |
| ID.RA-07: Changes and exceptions are managed, assessed for risk impact, recorded, and tracked | Information Security Continuous Monitoring (ISCM) Strategy; Configuration Management Policy and Procedures; Assessment, Authorization, and Monitoring Policy and Procedures | [Current state] | [Tier] | [Records] |
| ID.RA-08: Processes for receiving, analyzing, and responding to vulnerability disclosures are established | Vulnerability Management Policy; Risk Assessment Policy and Procedures | [Current state] | [Tier] | [Records] |
| ID.RA-09: The authenticity and integrity of hardware and software are assessed prior to acquisition and use | Software and Hardware Assurance Policy; Supply Chain Risk Management Strategy and Implementation Plan; System and Services Acquisition Policy and Procedures; Supply Chain Risk Management Policy and Procedures; System and Information Integrity Policy and Procedures | [Current state] | [Tier] | [Records] |
| ID.RA-10: Critical suppliers are assessed prior to acquisition | Supply Chain Risk Management Strategy and Implementation Plan; Supply Chain Risk Management Policy and Procedures | [Current state] | [Tier] | [Records] |
| ID.IM: Improvement | ||||
| ID.IM-01: Improvements are identified from evaluations | Policy and Procedure Management Policy; Incident Response Plan; Zero Trust and ICAM Implementation Plan; Software and Hardware Assurance Policy; Vulnerability Management Policy; Information Security Continuous Monitoring (ISCM) Strategy; Risk Management Strategy; Supply Chain Risk Management Strategy and Implementation Plan; Controlled Unclassified Information (CUI) Policy; CUI Waivers and Self-Inspection Procedure; Plan of Action and Milestones (POA&M) Management Procedure; Information System Contingency Plan (ISCP) — Template; Risk Assessment and FIPS 199 Categorization — Template; Cybersecurity Risk Register Template; Every family policy and procedure | [Current state] | [Tier] | [Records] |
| ID.IM-02: Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties | Policy and Procedure Management Policy; Incident Response Plan; Information Security Continuous Monitoring (ISCM) Strategy; Zero Trust and ICAM Implementation Plan; Software and Hardware Assurance Policy; Vulnerability Management Policy; Information System Contingency Plan (ISCP) — Template; Risk Management Strategy; Supply Chain Risk Management Strategy and Implementation Plan; Controlled Unclassified Information (CUI) Policy; CUI Waivers and Self-Inspection Procedure; Plan of Action and Milestones (POA&M) Management Procedure; Risk Assessment and FIPS 199 Categorization — Template; Cybersecurity Risk Register Template; Every family policy and procedure | [Current state] | [Tier] | [Records] |
| ID.IM-03: Improvements are identified from execution of operational processes, procedures, and activities | Policy and Procedure Management Policy; Software and Hardware Assurance Policy; Incident Response Plan; Information Security Continuous Monitoring (ISCM) Strategy; Zero Trust and ICAM Implementation Plan; Vulnerability Management Policy; Risk Management Strategy; Supply Chain Risk Management Strategy and Implementation Plan; Controlled Unclassified Information (CUI) Policy; CUI Waivers and Self-Inspection Procedure; Plan of Action and Milestones (POA&M) Management Procedure; Information System Contingency Plan (ISCP) — Template; Risk Assessment and FIPS 199 Categorization — Template; Cybersecurity Risk Register Template; Every family policy and procedure | [Current state] | [Tier] | [Records] |
| ID.IM-04: Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved | Incident Response Plan; Supply Chain Risk Management Strategy and Implementation Plan; Information System Contingency Plan (ISCP) — Template; Contingency Planning Policy and Procedures; Incident Response Policy and Procedures; Planning Policy and Procedures; Supply Chain Risk Management Policy and Procedures | [Current state] | [Tier] | [Records] |
Target Profile.
| Subcategory identifier | Target state | Target tier and priority | Gap | Owner |
|---|---|---|---|---|
| ID.AM | ||||
| ID.AM-01 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| ID.AM-02 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| ID.AM-03 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| ID.AM-04 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| ID.AM-05 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| ID.AM-07 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| ID.AM-08 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| ID.RA | ||||
| ID.RA-01 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| ID.RA-02 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| ID.RA-03 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| ID.RA-04 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| ID.RA-05 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| ID.RA-06 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| ID.RA-07 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| ID.RA-08 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| ID.RA-09 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| ID.RA-10 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| ID.IM | ||||
| ID.IM-01 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| ID.IM-02 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| ID.IM-03 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| ID.IM-04 | [Target state] | [Tier, priority] | [Gap] | [Role] |
Protect (PR) #
Protect (PR): Safeguards to manage the organization’s cybersecurity risks are used.
Current Profile.
| Subcategory identifier and outcome | Related documents | Current state | Current tier | Evidence |
|---|---|---|---|---|
| PR.AA: Identity Management, Authentication, and Access Control | ||||
| PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization | Zero Trust and ICAM Implementation Plan; Policy and Procedure Management Policy; Identification and Authentication Policy and Procedures; Access Control Policy and Procedures | [Current state] | [Tier] | [Records] |
| PR.AA-02: Identities are proofed and bound to credentials based on the context of interactions | Identification and Authentication Policy and Procedures | [Current state] | [Tier] | [Records] |
| PR.AA-03: Users, services, and hardware are authenticated | Identification and Authentication Policy and Procedures; Access Control Policy and Procedures | [Current state] | [Tier] | [Records] |
| PR.AA-04: Identity assertions are protected, conveyed, and verified | Identification and Authentication Policy and Procedures | [Current state] | [Tier] | [Records] |
| PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties | Zero Trust and ICAM Implementation Plan; Policy and Procedure Management Policy; Mobile Device Policy; Access Control Policy and Procedures; Identification and Authentication Policy and Procedures | [Current state] | [Tier] | [Records] |
| PR.AA-06: Physical access to assets is managed, monitored, and enforced commensurate with risk | Physical and Environmental Protection Policy and Procedures | [Current state] | [Tier] | [Records] |
| PR.AT: Awareness and Training | ||||
| PR.AT-01: Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind | Role-Based Training and Cybersecurity Workforce Plan; Awareness and Training Policy and Procedures | [Current state] | [Tier] | [Records] |
| PR.AT-02: Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind | Role-Based Training and Cybersecurity Workforce Plan; Awareness and Training Policy and Procedures | [Current state] | [Tier] | [Records] |
| PR.DS: Data Security | ||||
| PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected | Post-Quantum Cryptography Migration Plan; Zero Trust and ICAM Implementation Plan; Interconnection and Information Exchange Agreement Templates; Information System Contingency Plan (ISCP) — Template; System and Communications Protection Policy and Procedures; System and Information Integrity Policy and Procedures; Assessment, Authorization, and Monitoring Policy and Procedures; Contingency Planning Policy and Procedures; Media Protection Policy and Procedures | [Current state] | [Tier] | [Records] |
| PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected | Post-Quantum Cryptography Migration Plan; Zero Trust and ICAM Implementation Plan; Interconnection and Information Exchange Agreement Templates; System and Communications Protection Policy and Procedures; System and Information Integrity Policy and Procedures; Audit and Accountability Policy and Procedures; Assessment, Authorization, and Monitoring Policy and Procedures | [Current state] | [Tier] | [Records] |
| PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected | Post-Quantum Cryptography Migration Plan; Zero Trust and ICAM Implementation Plan; Interconnection and Information Exchange Agreement Templates; Information System Contingency Plan (ISCP) — Template; System and Communications Protection Policy and Procedures; System and Information Integrity Policy and Procedures; Access Control Policy and Procedures; Audit and Accountability Policy and Procedures; Assessment, Authorization, and Monitoring Policy and Procedures; Contingency Planning Policy and Procedures; System and Services Acquisition Policy and Procedures | [Current state] | [Tier] | [Records] |
| PR.DS-11: Backups of data are created, protected, maintained, and tested | Information System Contingency Plan (ISCP) — Template; Contingency Planning Policy and Procedures | [Current state] | [Tier] | [Records] |
| PR.PS: Platform Security | ||||
| PR.PS-01: Configuration management practices are established and applied | Secure Configuration Baseline Standard; IT Asset Management Policy; Policy and Procedure Management Policy; Internet Protocol Version 6 (IPv6) Policy; Configuration Management Policy and Procedures | [Current state] | [Tier] | [Records] |
| PR.PS-02: Software is maintained, replaced, and removed commensurate with risk | Vulnerability Management Policy; System and Information Integrity Policy and Procedures; Configuration Management Policy and Procedures; Maintenance Policy and Procedures; System and Services Acquisition Policy and Procedures | [Current state] | [Tier] | [Records] |
| PR.PS-03: Hardware is maintained, replaced, and removed commensurate with risk | System and Communications Protection Policy and Procedures; Configuration Management Policy and Procedures; System and Services Acquisition Policy and Procedures | [Current state] | [Tier] | [Records] |
| PR.PS-04: Log records are generated and made available for continuous monitoring | Agency Logging Plan; Audit and Accountability Policy and Procedures; System and Services Acquisition Policy and Procedures | [Current state] | [Tier] | [Records] |
| PR.PS-05: Installation and execution of unauthorized software are prevented | Configuration Management Policy and Procedures; System and Communications Protection Policy and Procedures | [Current state] | [Tier] | [Records] |
| PR.PS-06: Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle | Software and Hardware Assurance Policy; System and Services Acquisition Policy and Procedures | [Current state] | [Tier] | [Records] |
| PR.IR: Technology Infrastructure Resilience | ||||
| PR.IR-01: Networks and environments are protected from unauthorized logical access and usage | Zero Trust and ICAM Implementation Plan; System and Communications Protection Policy and Procedures; Access Control Policy and Procedures | [Current state] | [Tier] | [Records] |
| PR.IR-02: The organization’s technology assets are protected from environmental threats | Information System Contingency Plan (ISCP) — Template; Physical and Environmental Protection Policy and Procedures; Contingency Planning Policy and Procedures | [Current state] | [Tier] | [Records] |
| PR.IR-03: Mechanisms are implemented to achieve resilience requirements in normal and adverse situations | System and Communications Protection Policy and Procedures; System and Services Acquisition Policy and Procedures; Contingency Planning Policy and Procedures; Incident Response Policy and Procedures; System and Information Integrity Policy and Procedures | [Current state] | [Tier] | [Records] |
| PR.IR-04: Adequate resource capacity to ensure availability is maintained | Risk Management Strategy; IT Governance and Investment Management Policy; Cybersecurity Risk Register Template; Contingency Planning Policy and Procedures; Program Management Policy | [Current state] | [Tier] | [Records] |
Target Profile.
| Subcategory identifier | Target state | Target tier and priority | Gap | Owner |
|---|---|---|---|---|
| PR.AA | ||||
| PR.AA-01 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| PR.AA-02 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| PR.AA-03 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| PR.AA-04 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| PR.AA-05 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| PR.AA-06 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| PR.AT | ||||
| PR.AT-01 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| PR.AT-02 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| PR.DS | ||||
| PR.DS-01 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| PR.DS-02 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| PR.DS-10 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| PR.DS-11 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| PR.PS | ||||
| PR.PS-01 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| PR.PS-02 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| PR.PS-03 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| PR.PS-04 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| PR.PS-05 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| PR.PS-06 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| PR.IR | ||||
| PR.IR-01 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| PR.IR-02 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| PR.IR-03 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| PR.IR-04 | [Target state] | [Tier, priority] | [Gap] | [Role] |
Detect (DE) #
Detect (DE): Possible cybersecurity attacks and compromises are found and analyzed.
Current Profile.
| Subcategory identifier and outcome | Related documents | Current state | Current tier | Evidence |
|---|---|---|---|---|
| DE.CM: Continuous Monitoring | ||||
| DE.CM-01: Networks and network services are monitored to find potentially adverse events | Information Security Continuous Monitoring (ISCM) Strategy; Agency Logging Plan; Zero Trust and ICAM Implementation Plan; System and Communications Protection Policy and Procedures; Access Control Policy and Procedures; Audit and Accountability Policy and Procedures; Assessment, Authorization, and Monitoring Policy and Procedures; Configuration Management Policy and Procedures; System and Information Integrity Policy and Procedures | [Current state] | [Tier] | [Records] |
| DE.CM-02: The physical environment is monitored to find potentially adverse events | Information Security Continuous Monitoring (ISCM) Strategy; Physical and Environmental Protection Policy and Procedures; Assessment, Authorization, and Monitoring Policy and Procedures | [Current state] | [Tier] | [Records] |
| DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events | Information Security Continuous Monitoring (ISCM) Strategy; Agency Logging Plan; IT Asset Management Policy; Audit and Accountability Policy and Procedures; Configuration Management Policy and Procedures; Access Control Policy and Procedures; Assessment, Authorization, and Monitoring Policy and Procedures | [Current state] | [Tier] | [Records] |
| DE.CM-06: External service provider activities and services are monitored to find potentially adverse events | Information Security Continuous Monitoring (ISCM) Strategy; Software and Hardware Assurance Policy; Interconnection and Information Exchange Agreement Templates; System and Services Acquisition Policy and Procedures; Assessment, Authorization, and Monitoring Policy and Procedures; Personnel Security Policy and Procedures; System and Information Integrity Policy and Procedures | [Current state] | [Tier] | [Records] |
| DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events | Information Security Continuous Monitoring (ISCM) Strategy; Agency Logging Plan; IT Asset Management Policy; Secure Configuration Baseline Standard; Configuration Management Policy and Procedures; Access Control Policy and Procedures; System and Communications Protection Policy and Procedures; System and Information Integrity Policy and Procedures; Audit and Accountability Policy and Procedures; Assessment, Authorization, and Monitoring Policy and Procedures | [Current state] | [Tier] | [Records] |
| DE.AE: Adverse Event Analysis | ||||
| DE.AE-02: Potentially adverse events are analyzed to better understand associated activities | Incident Response Plan; Information Security Continuous Monitoring (ISCM) Strategy; Agency Logging Plan; Audit and Accountability Policy and Procedures; Assessment, Authorization, and Monitoring Policy and Procedures; Incident Response Policy and Procedures; System and Information Integrity Policy and Procedures | [Current state] | [Tier] | [Records] |
| DE.AE-03: Information is correlated from multiple sources | Incident Response Plan; Information Security Continuous Monitoring (ISCM) Strategy; Agency Logging Plan; Incident Response Policy and Procedures; Audit and Accountability Policy and Procedures; Assessment, Authorization, and Monitoring Policy and Procedures; Program Management Policy; System and Information Integrity Policy and Procedures | [Current state] | [Tier] | [Records] |
| DE.AE-04: The estimated impact and scope of adverse events are understood | Risk Management Strategy; Privacy Program Plan; Supply Chain Risk Management Strategy and Implementation Plan; Cybersecurity Risk Register Template; Program Management Policy | [Current state] | [Tier] | [Records] |
| DE.AE-06: Information on adverse events is provided to authorized staff and tools | Incident Response Plan; Program Management Policy; Risk Assessment Policy and Procedures; Incident Response Policy and Procedures | [Current state] | [Tier] | [Records] |
| DE.AE-07: Cyber threat intelligence and other contextual information are integrated into the analysis | Risk Assessment and FIPS 199 Categorization — Template; Risk Assessment Policy and Procedures; Program Management Policy | [Current state] | [Tier] | [Records] |
| DE.AE-08: Incidents are declared when adverse events meet the defined incident criteria | Incident Response Plan; Incident Response Policy and Procedures | [Current state] | [Tier] | [Records] |
Target Profile.
| Subcategory identifier | Target state | Target tier and priority | Gap | Owner |
|---|---|---|---|---|
| DE.CM | ||||
| DE.CM-01 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| DE.CM-02 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| DE.CM-03 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| DE.CM-06 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| DE.CM-09 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| DE.AE | ||||
| DE.AE-02 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| DE.AE-03 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| DE.AE-04 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| DE.AE-06 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| DE.AE-07 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| DE.AE-08 | [Target state] | [Tier, priority] | [Gap] | [Role] |
Respond (RS) #
Respond (RS): Actions regarding a detected cybersecurity incident are taken.
Current Profile.
| Subcategory identifier and outcome | Related documents | Current state | Current tier | Evidence |
|---|---|---|---|---|
| RS.MA: Incident Management | ||||
| RS.MA-01: The incident response plan is executed in coordination with relevant third parties once an incident is declared | Incident Response Plan; Supply Chain Risk Management Strategy and Implementation Plan; CUI Challenges and Misuse Reporting Procedure; Incident Response Policy and Procedures; Supply Chain Risk Management Policy and Procedures | [Current state] | [Tier] | [Records] |
| RS.MA-02: Incident reports are triaged and validated | Incident Response Plan; CUI Challenges and Misuse Reporting Procedure; Incident Response Policy and Procedures | [Current state] | [Tier] | [Records] |
| RS.MA-03: Incidents are categorized and prioritized | Incident Response Plan; CUI Challenges and Misuse Reporting Procedure; Incident Response Policy and Procedures | [Current state] | [Tier] | [Records] |
| RS.MA-04: Incidents are escalated or elevated as needed | Incident Response Plan; CUI Challenges and Misuse Reporting Procedure; Incident Response Policy and Procedures | [Current state] | [Tier] | [Records] |
| RS.MA-05: The criteria for initiating incident recovery are applied | Incident Response Plan; Incident Response Policy and Procedures | [Current state] | [Tier] | [Records] |
| RS.AN: Incident Analysis | ||||
| RS.AN-03: Analysis is performed to establish what has taken place during an incident and the root cause of the incident | Incident Response Plan; Audit and Accountability Policy and Procedures; Incident Response Policy and Procedures; System and Information Integrity Policy and Procedures | [Current state] | [Tier] | [Records] |
| RS.AN-06: Actions performed during an investigation are recorded, and the records’ integrity and provenance are preserved | Incident Response Plan; CUI Challenges and Misuse Reporting Procedure; Incident Response Policy and Procedures; Audit and Accountability Policy and Procedures | [Current state] | [Tier] | [Records] |
| RS.AN-07: Incident data and metadata are collected, and their integrity and provenance are preserved | Incident Response Plan; CUI Challenges and Misuse Reporting Procedure; Incident Response Policy and Procedures; Audit and Accountability Policy and Procedures | [Current state] | [Tier] | [Records] |
| RS.AN-08: An incident’s magnitude is estimated and validated | Incident Response Plan; Risk Management Strategy; Risk Assessment and FIPS 199 Categorization — Template; Cybersecurity Risk Register Template; Incident Response Policy and Procedures; Risk Assessment Policy and Procedures | [Current state] | [Tier] | [Records] |
| RS.CO: Incident Response Reporting and Communication | ||||
| RS.CO-02: Internal and external stakeholders are notified of incidents | Incident Response Plan; Supply Chain Risk Management Strategy and Implementation Plan; CUI Challenges and Misuse Reporting Procedure; Incident Response Policy and Procedures; Supply Chain Risk Management Policy and Procedures | [Current state] | [Tier] | [Records] |
| RS.CO-03: Information is shared with designated internal and external stakeholders | Incident Response Plan; Supply Chain Risk Management Strategy and Implementation Plan; CUI Challenges and Misuse Reporting Procedure; Incident Response Policy and Procedures; Supply Chain Risk Management Policy and Procedures | [Current state] | [Tier] | [Records] |
| RS.MI: Incident Mitigation | ||||
| RS.MI-01: Incidents are contained | Incident Response Plan; Incident Response Policy and Procedures | [Current state] | [Tier] | [Records] |
| RS.MI-02: Incidents are eradicated | Incident Response Plan; Incident Response Policy and Procedures | [Current state] | [Tier] | [Records] |
Target Profile.
| Subcategory identifier | Target state | Target tier and priority | Gap | Owner |
|---|---|---|---|---|
| RS.MA | ||||
| RS.MA-01 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| RS.MA-02 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| RS.MA-03 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| RS.MA-04 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| RS.MA-05 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| RS.AN | ||||
| RS.AN-03 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| RS.AN-06 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| RS.AN-07 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| RS.AN-08 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| RS.CO | ||||
| RS.CO-02 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| RS.CO-03 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| RS.MI | ||||
| RS.MI-01 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| RS.MI-02 | [Target state] | [Tier, priority] | [Gap] | [Role] |
Recover (RC) #
Recover (RC): Assets and operations affected by a cybersecurity incident are restored.
Current Profile.
| Subcategory identifier and outcome | Related documents | Current state | Current tier | Evidence |
|---|---|---|---|---|
| RC.RP: Incident Recovery Plan Execution | ||||
| RC.RP-01: The recovery portion of the incident response plan is executed once initiated from the incident response process | Incident Response Plan; Information System Contingency Plan (ISCP) — Template; Incident Response Policy and Procedures; Contingency Planning Policy and Procedures | [Current state] | [Tier] | [Records] |
| RC.RP-02: Recovery actions are selected, scoped, prioritized, and performed | Incident Response Plan; Information System Contingency Plan (ISCP) — Template; Incident Response Policy and Procedures; Contingency Planning Policy and Procedures | [Current state] | [Tier] | [Records] |
| RC.RP-03: The integrity of backups and other restoration assets is verified before using them for restoration | Information System Contingency Plan (ISCP) — Template; Contingency Planning Policy and Procedures | [Current state] | [Tier] | [Records] |
| RC.RP-04: Critical mission functions and cybersecurity risk management are considered to establish post-incident operational norms | Incident Response Plan; Risk Management Strategy; Policy and Procedure Management Policy; Cybersecurity Risk Register Template; Program Management Policy; Incident Response Policy and Procedures | [Current state] | [Tier] | [Records] |
| RC.RP-05: The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed | Information System Contingency Plan (ISCP) — Template; Contingency Planning Policy and Procedures | [Current state] | [Tier] | [Records] |
| RC.RP-06: The end of incident recovery is declared based on criteria, and incident-related documentation is completed | Incident Response Plan; Incident Response Policy and Procedures | [Current state] | [Tier] | [Records] |
| RC.CO: Incident Recovery Communication | ||||
| RC.CO-03: Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders | Incident Response Plan; Supply Chain Risk Management Strategy and Implementation Plan; CUI Challenges and Misuse Reporting Procedure; Incident Response Policy and Procedures; Supply Chain Risk Management Policy and Procedures | [Current state] | [Tier] | [Records] |
| RC.CO-04: Public updates on incident recovery are shared using approved methods and messaging | Incident Response Plan; Information System Contingency Plan (ISCP) — Template; Contingency Planning Policy and Procedures; Incident Response Policy and Procedures | [Current state] | [Tier] | [Records] |
Target Profile.
| Subcategory identifier | Target state | Target tier and priority | Gap | Owner |
|---|---|---|---|---|
| RC.RP | ||||
| RC.RP-01 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| RC.RP-02 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| RC.RP-03 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| RC.RP-04 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| RC.RP-05 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| RC.RP-06 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| RC.CO | ||||
| RC.CO-03 | [Target state] | [Tier, priority] | [Gap] | [Role] |
| RC.CO-04 | [Target state] | [Tier, priority] | [Gap] | [Role] |
10. Derived Governance Requirements #
- Build action plans by following the references from the Target Profile’s Subcategories to the related NIST SP 800-53 controls, and record an owner, a deadline, and resources for each action. (NIST SP 1301)
- Keep Organizational Profiles that describe the current and target cybersecurity posture in terms of the CSF Core outcomes, analyze the gaps between them, and act on a prioritized action plan. (NIST CSWP 29, §3.1)
- Develop and keep current and target cybersecurity profiles, and use them to understand, tailor, assess, prioritize, and communicate cybersecurity objectives (IG FISMA metric CG.01). (FY 2025 IG FISMA Metrics, CG.01)
11. References #
These are the sources this document cites, with a link to each official text.
- FIPS 199: Standards for Security Categorization, February 2004.
- FY 2025 IG FISMA Metrics and Evaluation Guide, January 1, 2025.
- NIST Cybersecurity Framework 2.0, February 26, 2024.
- NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations, September 2020.
- NIST SP 1301, Quick-Start Guide for Creating and Using CSF Organizational Profiles, February 26, 2024.