ID.RA Risk Assessment

Statement

Vulnerabilities in assets are identified, validated, and recorded

Guidance

Use vulnerability management technologies to identify unpatched and misconfigured software

Guidance

Assess network and system architectures for design and implementation weaknesses that affect cybersecurity

Guidance

Review, analyze, or test organization-developed software to identify design, coding, and default configuration vulnerabilities

Guidance

Assess facilities that house critical computing assets for physical vulnerabilities and resilience issues

Guidance

Monitor sources of cyber threat intelligence for information on new vulnerabilities in products and services

Guidance

Review processes and procedures for weaknesses that could be exploited to affect cybersecurity

Statement

Cyber threat intelligence is received from information sharing forums and sources

Guidance

Configure cybersecurity tools and technologies with detection or response capabilities to securely ingest cyber threat intelligence feeds

Guidance

Receive and review advisories from reputable third parties on current threat actors and their tactics, techniques, and procedures (TTPs)

Guidance

Monitor sources of cyber threat intelligence for information on the types of vulnerabilities that emerging technologies may have

Statement

Internal and external threats to the organization are identified and recorded

Guidance

Use cyber threat intelligence to maintain awareness of the types of threat actors likely to target the organization and the TTPs they are likely to use

Guidance

Perform threat hunting to look for signs of threat actors within the environment

Guidance

Implement processes for identifying internal threat actors

Statement

Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded

Guidance

Business leaders and cybersecurity risk management practitioners work together to estimate the likelihood and impact of risk scenarios and record them in risk registers

Guidance

Enumerate the potential business impacts of unauthorized access to the organization's communications, systems, and data processed in or by those systems

Guidance

Account for the potential impacts of cascading failures for systems of systems

Statement

Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization

Guidance

Develop threat models to better understand risks to the data and identify appropriate risk responses

Guidance

Prioritize cybersecurity resource allocations and investments based on estimated likelihoods and impacts

Statement

Risk responses are chosen, prioritized, planned, tracked, and communicated

Guidance

Apply the vulnerability management plan's criteria for deciding whether to accept, transfer, mitigate, or avoid risk

Guidance

Apply the vulnerability management plan's criteria for selecting compensating controls to mitigate risk

Guidance

Track the progress of risk response implementation (e.g., plan of action and milestones (POA&M), risk register, risk detail report)

Guidance

Use risk assessment findings to inform risk response decisions and actions

Guidance

Communicate planned risk responses to affected stakeholders in priority order

Statement

Changes and exceptions are managed, assessed for risk impact, recorded, and tracked

Guidance

Implement and follow procedures for the formal documentation, review, testing, and approval of proposed changes and requested exceptions

Guidance

Document the possible risks of making or not making each proposed change, and provide guidance on rolling back changes

Guidance

Document the risks related to each requested exception and the plan for responding to those risks

Guidance

Periodically review risks that were accepted based upon planned future actions or milestones

Statement

Processes for receiving, analyzing, and responding to vulnerability disclosures are established

Guidance

Conduct vulnerability information sharing between the organization and its suppliers following the rules and protocols defined in contracts

Guidance

Assign responsibilities and verify the execution of procedures for processing, analyzing the impact of, and responding to cybersecurity threat, vulnerability, or incident disclosures by suppliers, customers, partners, and government cybersecurity organizations

Statement

The authenticity and integrity of hardware and software are assessed prior to acquisition and use

Guidance

Assess the authenticity and cybersecurity of critical technology products and services prior to acquisition and use

Statement

Critical suppliers are assessed prior to acquisition

Guidance

Conduct supplier risk assessments against business and applicable cybersecurity requirements, including the supply chain