ID.IM Improvement

Statement

Improvements are identified from evaluations

Guidance

Perform self-assessments of critical services that take current threats and TTPs into consideration

Guidance

Invest in third-party assessments or independent audits of the effectiveness of the organization's cybersecurity program to identify areas that need improvement

Guidance

Constantly evaluate compliance with selected cybersecurity requirements through automated means

Statement

Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties

Guidance

Identify improvements for future incident response activities based on findings from incident response assessments (e.g., tabletop exercises and simulations, tests, internal reviews, independent audits)

Guidance

Identify improvements for future business continuity, disaster recovery, and incident response activities based on exercises performed in coordination with critical service providers and product suppliers

Guidance

Involve internal stakeholders (e.g., senior executives, legal department, HR) in security tests and exercises as appropriate

Guidance

Perform penetration testing to identify opportunities to improve the security posture of selected high-risk systems as approved by leadership

Guidance

Exercise contingency plans for responding to and recovering from the discovery that products or services did not originate with the contracted supplier or partner or were altered before receipt

Guidance

Collect and analyze performance metrics using security tools and services to inform improvements to the cybersecurity program

Statement

Improvements are identified from execution of operational processes, procedures, and activities

Guidance

Conduct collaborative lessons learned sessions with suppliers

Guidance

Annually review cybersecurity policies, processes, and procedures to take lessons learned into account

Guidance

Use metrics to assess operational cybersecurity performance over time

Statement

Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved

Guidance

Establish contingency plans (e.g., incident response, business continuity, disaster recovery) for responding to and recovering from adverse events that can interfere with operations, expose confidential information, or otherwise endanger the organization's mission and viability

Guidance

Include contact and communication information, processes for handling common scenarios, and criteria for prioritization, escalation, and elevation in all contingency plans

Guidance

Create a vulnerability management plan to identify and assess all types of vulnerabilities and to prioritize, test, and implement risk responses

Guidance

Communicate cybersecurity plans (including updates) to those responsible for carrying them out and to affected parties

Guidance

Review and update all cybersecurity plans annually or when a need for significant improvements is identified