ID: Identify

Assets (e.g., data, hardware, software, systems, facilities, services, people) that enable the organization to achieve business purposes are identified and managed consistent with their relative importance to organizational objectives and the organization's risk strategy

The cybersecurity risk to the organization, assets, and individuals is understood by the organization

Improvements to organizational cybersecurity risk management processes, procedures and activities are identified across all CSF Functions