ID.RA: Risk Assessment
Previous Version:
- NIST Cybersecurity Framework v1.1:
- ID.RA: Risk Assessment
Description
The cybersecurity risk to the organization, assets, and individuals is understood by the organization
Framework Subcategories
ID.RA-01: Vulnerabilities in assets are identified, validated, and recorded
[csf.tools Note: Subcategories do not have detailed descriptions.]
ID.RA-02: Cyber threat intelligence is received from information sharing forums and sources
[csf.tools Note: Subcategories do not have detailed descriptions.]
ID.RA-03: Internal and external threats to the organization are identified and recorded
[csf.tools Note: Subcategories do not have detailed descriptions.]
ID.RA-04: Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded
[csf.tools Note: Subcategories do not have detailed descriptions.]
ID.RA-05: Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization
[csf.tools Note: Subcategories do not have detailed descriptions.]
ID.RA-06: Risk responses are chosen, prioritized, planned, tracked, and communicated
[csf.tools Note: Subcategories do not have detailed descriptions.]
ID.RA-07: Changes and exceptions are managed, assessed for risk impact, recorded, and tracked
[csf.tools Note: Subcategories do not have detailed descriptions.]
ID.RA-08: Processes for receiving, analyzing, and responding to vulnerability disclosures are established
[csf.tools Note: Subcategories do not have detailed descriptions.]
ID.RA-09: The authenticity and integrity of hardware and software are assessed prior to acquisition and use
[csf.tools Note: Subcategories do not have detailed descriptions.]
ID.RA-10: Critical suppliers are assessed prior to acquisition
[csf.tools Note: Subcategories do not have detailed descriptions.]