DE.AE-07: Cyber threat intelligence and other contextual information are integrated into the analysis

Info icon.

Subcategory is new to this version of the framework and incorporates the following item from the previous version: DE.AE-3: Event data are collected and correlated from multiple sources and sensors.

Description

[csf.tools Note: Subcategories do not have detailed descriptions. However NIST has provided the following implementation examples.]

Implementation Examples

Ex1: Securely provide cyber threat intelligence feeds to detection technologies, processes, and personnel

Ex2: Securely provide information from asset inventories to detection technologies, processes, and personnel

Ex3: Rapidly acquire and analyze vulnerability disclosures for the organization's technologies from suppliers, vendors, and third-party security advisories

1st: 1st Party Risk

Related Controls

NIST Special Publication 800-53 Revision 5.2.0

PM-16: Threat Awareness Program

Implement a threat awareness program that includes a cross-organization information-sharing capability for threat intelligence.

RA-3: Risk Assessment

Conduct a risk assessment, including: Identifying threats to and vulnerabilities in the system; Determining the likelihood and magnitude of harm from unauthorized access, use, disclosure, disruption, modification, or destruction of the system, the information it processes, stores, or transmits, and any related information; and Determining the likelihood and impact of adverse effects on individuals arising…

RA-10: Threat Hunting

Establish and maintain a cyber threat hunting capability to: Search for indicators of compromise in organizational systems; and Detect, track, and disrupt threats that evade existing controls; and Employ the threat hunting capability [Assignment: organization-defined frequency].

NIST SP 800-171 Revision 3.0

03.11.01: Risk Assessment

Assess the risk (including supply chain risk) of unauthorized disclosure resulting from the processing, storage, or transmission of CUI. Update risk assessments [Assignment: organization-defined frequency].

Cloud Controls Matrix v4.0

LOG-03: Security Monitoring and Alerting

Identify and monitor security-related events within applications and the underlying infrastructure. Define and implement a system to generate alerts to responsible stakeholders based on such events and corresponding metrics.

LOG-05: Audit Logs Monitoring and Response

Monitor security audit logs to detect activity outside of typical or expected patterns. Establish and follow a defined process to review and take appropriate and timely actions on detected anomalies.

SEF-06: Event Triage Processes

Define, implement and evaluate processes, procedures and technical measures supporting business processes to triage security-related events.