NIST CSF 2.

0 Implementation Examples

NIST CSF 2.0 Implementation Examples

February 26, 2024

Category Subcategory Implementation Examples

Organizational Context (GV.OC):
The circumstances — mission,
stakeholder expectations,
dependencies, and legal,
regulatory, and contractual
requirements — surrounding the
organization’s cybersecurity risk
management decisions are
understood
GV.OC-01: The organizational Ex1: Share the organization’s mission (e.g., through vision and mission
mission is understood and informs statements, marketing, and service strategies) to provide a basis for identifying
cybersecurity risk management risks that may impede that mission
GV.OC-02: Internal and external Ex1: Identify relevant internal stakeholders and their cybersecurity-related
stakeholders are understood, and expectations (e.g., performance and risk expectations of officers, directors, and
their needs and expectations advisors; cultural expectations of employees)
regarding cybersecurity risk Ex2: Identify relevant external stakeholders and their cybersecurity-related
management are understood and expectations (e.g., privacy expectations of customers, business expectations of
considered partnerships, compliance expectations of regulators, ethics expectations of
society)
GV.OC-03: Legal, regulatory, and Ex1: Determine a process to track and manage legal and regulatory requirements
contractual requirements regarding regarding protection of individuals’ information (e.g., Health Insurance Portability
cybersecurity — including privacy and Accountability Act, California Consumer Privacy Act, General Data Protection
and civil liberties obligations — are Regulation)
understood and managed Ex2: Determine a process to track and manage contractual requirements for
cybersecurity management of supplier, customer, and partner information
Ex3: Align the organization’s cybersecurity strategy with legal, regulatory, and
contractual requirements
GV.OC-04: Critical objectives, Ex1: Establish criteria for determining the criticality of the organization's
capabilities, and services that capabilities and services as viewed by internal and external stakeholders

1
 NIST CSF 2.0 Implementation Examples

Category Subcategory Implementation Examples

stakeholders depend on or expect Ex2: Determine (e.g., from a business impact analysis) assets and business
from the organization are operations that are vital to achieving mission objectives and the potential impact
understood and communicated of a loss (or partial loss) of such operations
Ex3: Establish and communicate resilience objectives (e.g., recovery time
objectives) for delivering critical capabilities and services in various operating
states (e.g., under attack, during recovery, normal operation)
GV.OC-05: Outcomes, capabilities, Ex1: Create an inventory of the organization’s dependencies on external
and services that the organization resources (e.g., facilities, cloud-based hosting providers) and their relationships to
depends on are understood and organizational assets and business functions
communicated Ex2: Identify and document external dependencies that are potential points of
failure for the organization’s critical capabilities and services, and share that
information with appropriate personnel
Risk Management Strategy
(GV.RM): The organization’s
priorities, constraints, risk
tolerance and appetite
statements, and assumptions are
established, communicated, and
used to support operational risk
decisions
GV.RM-01: Risk management Ex1: Update near-term and long-term cybersecurity risk management objectives
objectives are established and as part of annual strategic planning and when major changes occur
agreed to by organizational Ex2: Establish measurable objectives for cybersecurity risk management (e.g.,
stakeholders manage the quality of user training, ensure adequate risk protection for industrial
control systems)
Ex3: Senior leaders agree about cybersecurity objectives and use them for
measuring and managing risk and performance
GV.RM-02: Risk appetite and risk Ex1: Determine and communicate risk appetite statements that convey
tolerance statements are expectations about the appropriate level of risk for the organization
established, communicated, and Ex2: Translate risk appetite statements into specific, measurable, and broadly
maintained understandable risk tolerance statements

2
 NIST CSF 2.0 Implementation Examples

Category Subcategory Implementation Examples

Ex3: Refine organizational objectives and risk appetite periodically based on
known risk exposure and residual risk
GV.RM-03: Cybersecurity risk Ex1: Aggregate and manage cybersecurity risks alongside other enterprise risks
management activities and (e.g., compliance, financial, operational, regulatory, reputational, safety)
outcomes are included in Ex2: Include cybersecurity risk managers in enterprise risk management planning
enterprise risk management
Ex3: Establish criteria for escalating cybersecurity risks within enterprise risk
processes
management
GV.RM-04: Strategic direction that Ex1: Specify criteria for accepting and avoiding cybersecurity risk for various
describes appropriate risk response classifications of data
options is established and Ex2: Determine whether to purchase cybersecurity insurance
communicated
Ex3: Document conditions under which shared responsibility models are
acceptable (e.g., outsourcing certain cybersecurity functions, having a third party
perform financial transactions on behalf of the organization, using public cloud-
based services)
GV.RM-05: Lines of communication Ex1: Determine how to update senior executives, directors, and management on
across the organization are the organization’s cybersecurity posture at agreed-upon intervals
established for cybersecurity risks, Ex2: Identify how all departments across the organization — such as
including risks from suppliers and management, operations, internal auditors, legal, acquisition, physical security,
other third parties and HR — will communicate with each other about cybersecurity risks
GV.RM-06: A standardized method Ex1: Establish criteria for using a quantitative approach to cybersecurity risk
for calculating, documenting, analysis, and specify probability and exposure formulas
categorizing, and prioritizing Ex2: Create and use templates (e.g., a risk register) to document cybersecurity
cybersecurity risks is established risk information (e.g., risk description, exposure, treatment, and ownership)
and communicated
Ex3: Establish criteria for risk prioritization at the appropriate levels within the
enterprise
Ex4: Use a consistent list of risk categories to support integrating, aggregating,
and comparing cybersecurity risks
GV.RM-07: Strategic opportunities Ex1: Define and communicate guidance and methods for identifying
(i.e., positive risks) are opportunities and including them in risk discussions (e.g., strengths, weaknesses,
characterized and are included in opportunities, and threats [SWOT] analysis)
Ex2: Identify stretch goals and document them

3
 NIST CSF 2.0 Implementation Examples

Category Subcategory Implementation Examples

organizational cybersecurity risk Ex3: Calculate, document, and prioritize positive risks alongside negative risks
discussions
Cybersecurity Supply Chain Risk
Management (GV.SC): Cyber
supply chain risk management
processes are identified,
established, managed,
monitored, and improved by
organizational stakeholders
GV.SC-01: A cybersecurity supply Ex1: Establish a strategy that expresses the objectives of the cybersecurity supply
chain risk management program, chain risk management program
strategy, objectives, policies, and Ex2: Develop the cybersecurity supply chain risk management program, including
processes are established and a plan (with milestones), policies, and procedures that guide implementation and
agreed to by organizational improvement of the program, and share the policies and procedures with the
stakeholders organizational stakeholders
Ex3: Develop and implement program processes based on the strategy,
objectives, policies, and procedures that are agreed upon and performed by the
organizational stakeholders
Ex4: Establish a cross-organizational mechanism that ensures alignment between
functions that contribute to cybersecurity supply chain risk management, such as
cybersecurity, IT, operations, legal, human resources, and engineering
GV.SC-02: Cybersecurity roles and Ex1: Identify one or more specific roles or positions that will be responsible and
responsibilities for suppliers, accountable for planning, resourcing, and executing cybersecurity supply chain
customers, and partners are risk management activities
established, communicated, and Ex2: Document cybersecurity supply chain risk management roles and
coordinated internally and responsibilities in policy
externally
Ex3: Create responsibility matrixes to document who will be responsible and
accountable for cybersecurity supply chain risk management activities and how
those teams and individuals will be consulted and informed
Ex4: Include cybersecurity supply chain risk management responsibilities and
performance requirements in personnel descriptions to ensure clarity and
improve accountability

4
 NIST CSF 2.0 Implementation Examples

Category Subcategory Implementation Examples

Ex5: Document performance goals for personnel with cybersecurity risk
management-specific responsibilities, and periodically measure them to
demonstrate and improve performance
Ex6: Develop roles and responsibilities for suppliers, customers, and business
partners to address shared responsibilities for applicable cybersecurity risks, and
integrate them into organizational policies and applicable third-party agreements
Ex7: Internally communicate cybersecurity supply chain risk management roles
and responsibilities for third parties
Ex8: Establish rules and protocols for information sharing and reporting
processes between the organization and its suppliers
GV.SC-03: Cybersecurity supply Ex1: Identify areas of alignment and overlap with cybersecurity and enterprise
chain risk management is risk management
integrated into cybersecurity and Ex2: Establish integrated control sets for cybersecurity risk management and
enterprise risk management, risk cybersecurity supply chain risk management
assessment, and improvement
Ex3: Integrate cybersecurity supply chain risk management into improvement
processes
processes
Ex4: Escalate material cybersecurity risks in supply chains to senior management,
and address them at the enterprise risk management level
GV.SC-04: Suppliers are known and Ex1: Develop criteria for supplier criticality based on, for example, the sensitivity
prioritized by criticality of data processed or possessed by suppliers, the degree of access to the
organization’s systems, and the importance of the products or services to the
organization’s mission
Ex2: Keep a record of all suppliers, and prioritize suppliers based on the criticality
criteria
GV.SC-05: Requirements to address Ex1: Establish security requirements for suppliers, products, and services
cybersecurity risks in supply chains commensurate with their criticality level and potential impact if compromised
are established, prioritized, and Ex2: Include all cybersecurity and supply chain requirements that third parties
integrated into contracts and other must follow and how compliance with the requirements may be verified in default
types of agreements with suppliers contractual language
and other relevant third parties
Ex3: Define the rules and protocols for information sharing between the
organization and its suppliers and sub-tier suppliers in agreements

5
 NIST CSF 2.0 Implementation Examples

Category Subcategory Implementation Examples

Ex4: Manage risk by including security requirements in agreements based on
their criticality and potential impact if compromised
Ex5: Define security requirements in service-level agreements (SLAs) for
monitoring suppliers for acceptable security performance throughout the supplier
relationship lifecycle
Ex6: Contractually require suppliers to disclose cybersecurity features, functions,
and vulnerabilities of their products and services for the life of the product or the
term of service
Ex7: Contractually require suppliers to provide and maintain a current
component inventory (e.g., software or hardware bill of materials) for critical
products
Ex8: Contractually require suppliers to vet their employees and guard against
insider threats
Ex9: Contractually require suppliers to provide evidence of performing
acceptable security practices through, for example, self-attestation, conformance
to known standards, certifications, or inspections
Ex10: Specify in contracts and other agreements the rights and responsibilities of
the organization, its suppliers, and their supply chains, with respect to potential
cybersecurity risks
GV.SC-06: Planning and due Ex1: Perform thorough due diligence on prospective suppliers that is consistent
diligence are performed to reduce with procurement planning and commensurate with the level of risk, criticality,
risks before entering into formal and complexity of each supplier relationship
supplier or other third-party Ex2: Assess the suitability of the technology and cybersecurity capabilities and
relationships the risk management practices of prospective suppliers
Ex3: Conduct supplier risk assessments against business and applicable
cybersecurity requirements
Ex4: Assess the authenticity, integrity, and security of critical products prior to
acquisition and use
GV.SC-07: The risks posed by a Ex1: Adjust assessment formats and frequencies based on the third party’s
supplier, their products and reputation and the criticality of the products or services they provide
services, and other third parties are
understood, recorded, prioritized,
assessed, responded to, and

6
 NIST CSF 2.0 Implementation Examples

Category Subcategory Implementation Examples

monitored over the course of the Ex2: Evaluate third parties’ evidence of compliance with contractual
relationship cybersecurity requirements, such as self-attestations, warranties, certifications,
and other artifacts
Ex3: Monitor critical suppliers to ensure that they are fulfilling their security
obligations throughout the supplier relationship lifecycle using a variety of
methods and techniques, such as inspections, audits, tests, or other forms of
evaluation
Ex4: Monitor critical suppliers, services, and products for changes to their risk
profiles, and reevaluate supplier criticality and risk impact accordingly
Ex5: Plan for unexpected supplier and supply chain-related interruptions to
ensure business continuity
GV.SC-08: Relevant suppliers and Ex1: Define and use rules and protocols for reporting incident response and
other third parties are included in recovery activities and the status between the organization and its suppliers
incident planning, response, and Ex2: Identify and document the roles and responsibilities of the organization and
recovery activities its suppliers for incident response
Ex3: Include critical suppliers in incident response exercises and simulations
Ex4: Define and coordinate crisis communication methods and protocols
between the organization and its critical suppliers
Ex5: Conduct collaborative lessons learned sessions with critical suppliers
GV.SC-09: Supply chain security Ex1: Policies and procedures require provenance records for all acquired
practices are integrated into technology products and services
cybersecurity and enterprise risk Ex2: Periodically provide risk reporting to leaders about how acquired
management programs, and their components are proven to be untampered and authentic.
performance is monitored
Ex3: Communicate regularly among cybersecurity risk managers and operations
throughout the technology product
personnel about the need to acquire software patches, updates, and upgrades
and service life cycle
only from authenticated and trustworthy software providers
Ex4: Review policies to ensure that they require approved supplier personnel to
perform maintenance on supplier products
Ex5: Policies and procedure require checking upgrades to critical hardware for
unauthorized changes
GV.SC-10: Cybersecurity supply Ex1: Establish processes for terminating critical relationships under both normal
chain risk management plans and adverse circumstances

7
 NIST CSF 2.0 Implementation Examples

Category Subcategory Implementation Examples

include provisions for activities that Ex2: Define and implement plans for component end-of-life maintenance support
occur after the conclusion of a and obsolescence
partnership or service agreement Ex3: Verify that supplier access to organization resources is deactivated promptly
when it is no longer needed
Ex4: Verify that assets containing the organization’s data are returned or properly
disposed of in a timely, controlled, and safe manner
Ex5: Develop and execute a plan for terminating or transitioning supplier
relationships that takes supply chain security risk and resiliency into account
Ex6: Mitigate risks to data and systems created by supplier termination
Ex7: Manage data leakage risks associated with supplier termination
Roles, Responsibilities, and
Authorities (GV.RR):
Cybersecurity roles,
responsibilities, and authorities
to foster accountability,
performance assessment, and
continuous improvement are
established and communicated
GV.RR-01: Organizational Ex1: Leaders (e.g., directors) agree on their roles and responsibilities in
leadership is responsible and developing, implementing, and assessing the organization’s cybersecurity strategy
accountable for cybersecurity risk Ex2: Share leaders’ expectations regarding a secure and ethical culture, especially
and fosters a culture that is risk- when current events present the opportunity to highlight positive or negative
aware, ethical, and continually examples of cybersecurity risk management
improving
Ex3: Leaders direct the CISO to maintain a comprehensive cybersecurity risk
strategy and review and update it at least annually and after major events
Ex4: Conduct reviews to ensure adequate authority and coordination among
those responsible for managing cybersecurity risk
GV.RR-02: Roles, responsibilities, Ex1: Document risk management roles and responsibilities in policy
and authorities related to Ex2: Document who is responsible and accountable for cybersecurity risk
cybersecurity risk management are management activities and how those teams and individuals are to be consulted
established, communicated, and informed
understood, and enforced

8
 NIST CSF 2.0 Implementation Examples

Category Subcategory Implementation Examples

Ex3: Include cybersecurity responsibilities and performance requirements in
personnel descriptions
Ex4: Document performance goals for personnel with cybersecurity risk
management responsibilities, and periodically measure performance to identify
areas for improvement
Ex5: Clearly articulate cybersecurity responsibilities within operations, risk
functions, and internal audit functions
GV.RR-03: Adequate resources are Ex1: Conduct periodic management reviews to ensure that those given
allocated commensurate with the cybersecurity risk management responsibilities have the necessary authority
cybersecurity risk strategy, roles, Ex2: Identify resource allocation and investment in line with risk tolerance and
responsibilities, and policies response
Ex3: Provide adequate and sufficient people, process, and technical resources to
support the cybersecurity strategy
GV.RR-04: Cybersecurity is included Ex1: Integrate cybersecurity risk management considerations into human
in human resources practices resources processes (e.g., personnel screening, onboarding, change notification,
offboarding)
Ex2: Consider cybersecurity knowledge to be a positive factor in hiring, training,
and retention decisions
Ex3: Conduct background checks prior to onboarding new personnel for sensitive
roles, and periodically repeat background checks for personnel with such roles
Ex4: Define and enforce obligations for personnel to be aware of, adhere to, and
uphold security policies as they relate to their roles
Policy (GV.PO): Organizational
cybersecurity policy is
established, communicated, and
enforced
GV.PO-01: Policy for managing Ex1: Create, disseminate, and maintain an understandable, usable risk
cybersecurity risks is established management policy with statements of management intent, expectations, and
based on organizational context, direction
cybersecurity strategy, and Ex2: Periodically review policy and supporting processes and procedures to
priorities and is communicated and ensure that they align with risk management strategy objectives and priorities, as
enforced well as the high-level direction of the cybersecurity policy

9
 NIST CSF 2.0 Implementation Examples

Category Subcategory Implementation Examples

Ex3: Require approval from senior management on policy
Ex4: Communicate cybersecurity risk management policy and supporting
processes and procedures across the organization
Ex5: Require personnel to acknowledge receipt of policy when first hired,
annually, and whenever policy is updated
GV.PO-02: Policy for managing Ex1: Update policy based on periodic reviews of cybersecurity risk management
cybersecurity risks is reviewed, results to ensure that policy and supporting processes and procedures adequately
updated, communicated, and maintain risk at an acceptable level
enforced to reflect changes in Ex2: Provide a timeline for reviewing changes to the organization’s risk
requirements, threats, technology, environment (e.g., changes in risk or in the organization’s mission objectives), and
and organizational mission communicate recommended policy updates
Ex3: Update policy to reflect changes in legal and regulatory requirements
Ex4: Update policy to reflect changes in technology (e.g., adoption of artificial
intelligence) and changes to the business (e.g., acquisition of a new business, new
contract requirements)
Oversight (GV.OV): Results of
organization-wide cybersecurity
risk management activities and
performance are used to inform,
improve, and adjust the risk
management strategy
GV.OV-01: Cybersecurity risk Ex1: Measure how well the risk management strategy and risk results have
management strategy outcomes helped leaders make decisions and achieve organizational objectives
are reviewed to inform and adjust Ex2: Examine whether cybersecurity risk strategies that impede operations or
strategy and direction innovation should be adjusted
GV.OV-02: The cybersecurity risk Ex1: Review audit findings to confirm whether the existing cybersecurity strategy
management strategy is reviewed has ensured compliance with internal and external requirements
and adjusted to ensure coverage of Ex2: Review the performance oversight of those in cybersecurity-related roles to
organizational requirements and determine whether policy changes are necessary
risks
Ex3: Review strategy in light of cybersecurity incidents

10
 NIST CSF 2.0 Implementation Examples

Category Subcategory Implementation Examples

GV.OV-03: Organizational Ex1: Review key performance indicators (KPIs) to ensure that organization-wide
cybersecurity risk management policies and procedures achieve objectives
performance is measured and Ex2: Review key risk indicators (KRIs) to identify risks the organization faces,
reviewed for adjustments needed including likelihood and potential impact
Ex3: Collect and communicate metrics on cybersecurity risk management with
senior leadership
Asset Management (ID.AM):
Assets (e.g., data, hardware
software, systems, facilities,
services, people) that enable the
organization to achieve business
purposes are identified and
managed consistent with their
relative importance to
organizational objectives and the
organization’s risk strategy
ID.AM-01: Inventories of hardware Ex1: Maintain inventories for all types of hardware, including IT, IoT, OT, and
managed by the organization are mobile devices
maintained Ex2: Constantly monitor networks to detect new hardware and automatically
update inventories
ID.AM-02: Inventories of software, Ex1: Maintain inventories for all types of software and services, including
services, and systems managed by commercial-off-the-shelf, open-source, custom applications, API services, and
the organization are maintained cloud-based applications and services
Ex2: Constantly monitor all platforms, including containers and virtual machines,
for software and service inventory changes
Ex3: Maintain an inventory of the organization’s systems
ID.AM-03: Representations of the Ex1: Maintain baselines of communication and data flows within the
organization’s authorized network organization’s wired and wireless networks
communication and internal and Ex2: Maintain baselines of communication and data flows between the
external network data flows are organization and third parties
maintained
Ex3: Maintain baselines of communication and data flows for the organization’s
infrastructure-as-a-service (IaaS) usage

11
 NIST CSF 2.0 Implementation Examples

Category Subcategory Implementation Examples

Ex4: Maintain documentation of expected network ports, protocols, and services
that are typically used among authorized systems
ID.AM-04: Inventories of services Ex1: Inventory all external services used by the organization, including third-party
provided by suppliers are IaaS, platform-as-a-service (PaaS), and software-as-a-service (SaaS) offerings; APIs;
maintained and other externally hosted application services
Ex2: Update the inventory when a new external service is going to be utilized to
ensure adequate cybersecurity risk management monitoring of the organization’s
use of that service
ID.AM-05: Assets are prioritized Ex1: Define criteria for prioritizing each class of assets
based on classification, criticality, Ex2: Apply the prioritization criteria to assets
resources, and impact on the
Ex3: Track the asset priorities and update them periodically or when significant
mission
changes to the organization occur
ID.AM-07: Inventories of data and Ex1: Maintain a list of the designated data types of interest (e.g., personally
corresponding metadata for identifiable information, protected health information, financial account numbers,
designated data types are organization intellectual property, operational technology data)
maintained Ex2: Continuously discover and analyze ad hoc data to identify new instances of
designated data types
Ex3: Assign data classifications to designated data types through tags or labels
Ex4: Track the provenance, data owner, and geolocation of each instance of
designated data types
ID.AM-08: Systems, hardware, Ex1: Integrate cybersecurity considerations throughout the life cycles of systems,
software, services, and data are hardware, software, and services
managed throughout their life Ex2: Integrate cybersecurity considerations into product life cycles
cycles
Ex3: Identify unofficial uses of technology to meet mission objectives (i.e.,
“shadow IT”)
Ex4: Periodically identify redundant systems, hardware, software, and services
that unnecessarily increase the organization’s attack surface
Ex5: Properly configure and secure systems, hardware, software, and services
prior to their deployment in production
Ex6: Update inventories when systems, hardware, software, and services are
moved or transferred within the organization

12
 NIST CSF 2.0 Implementation Examples

Category Subcategory Implementation Examples

Ex7: Securely destroy stored data based on the organization’s data retention
policy using the prescribed destruction method, and keep and manage a record of
the destructions
Ex8: Securely sanitize data storage when hardware is being retired,
decommissioned, reassigned, or sent for repairs or replacement
Ex9: Offer methods for destroying paper, storage media, and other physical
forms of data storage
Risk Assessment (ID.RA): The
cybersecurity risk to the
organization, assets, and
individuals is understood by the
organization
ID.RA-01: Vulnerabilities in assets Ex1: Use vulnerability management technologies to identify unpatched and
are identified, validated, and misconfigured software
recorded Ex2: Assess network and system architectures for design and implementation
weaknesses that affect cybersecurity
Ex3: Review, analyze, or test organization-developed software to identify design,
coding, and default configuration vulnerabilities
Ex4: Assess facilities that house critical computing assets for physical
vulnerabilities and resilience issues
Ex5: Monitor sources of cyber threat intelligence for information on new
vulnerabilities in products and services
Ex6: Review processes and procedures for weaknesses that could be exploited to
affect cybersecurity
ID.RA-02: Cyber threat intelligence Ex1: Configure cybersecurity tools and technologies with detection or response
is received from information capabilities to securely ingest cyber threat intelligence feeds
sharing forums and sources Ex2: Receive and review advisories from reputable third parties on current threat
actors and their tactics, techniques, and procedures (TTPs)
Ex3: Monitor sources of cyber threat intelligence for information on the types of
vulnerabilities that emerging technologies may have

13
 NIST CSF 2.0 Implementation Examples

Category Subcategory Implementation Examples

ID.RA-03: Internal and external Ex1: Use cyber threat intelligence to maintain awareness of the types of threat
threats to the organization are actors likely to target the organization and the TTPs they are likely to use
identified and recorded Ex2: Perform threat hunting to look for signs of threat actors within the
environment
Ex3: Implement processes for identifying internal threat actors
ID.RA-04: Potential impacts and Ex1: Business leaders and cybersecurity risk management practitioners work
likelihoods of threats exploiting together to estimate the likelihood and impact of risk scenarios and record them
vulnerabilities are identified and in risk registers
recorded Ex2: Enumerate the potential business impacts of unauthorized access to the
organization’s communications, systems, and data processed in or by those
systems
Ex3: Account for the potential impacts of cascading failures for systems of
systems
ID.RA-05: Threats, vulnerabilities, Ex1: Develop threat models to better understand risks to the data and identify
likelihoods, and impacts are used to appropriate risk responses
understand inherent risk and Ex2: Prioritize cybersecurity resource allocations and investments based on
inform risk response prioritization estimated likelihoods and impacts
ID.RA-06: Risk responses are Ex1: Apply the vulnerability management plan’s criteria for deciding whether to
chosen, prioritized, planned, accept, transfer, mitigate, or avoid risk
tracked, and communicated Ex2: Apply the vulnerability management plan’s criteria for selecting
compensating controls to mitigate risk
Ex3: Track the progress of risk response implementation (e.g., plan of action and
milestones [POA&M], risk register, risk detail report)
Ex4: Use risk assessment findings to inform risk response decisions and actions
Ex5: Communicate planned risk responses to affected stakeholders in priority
order
ID.RA-07: Changes and exceptions Ex1: Implement and follow procedures for the formal documentation, review,
are managed, assessed for risk testing, and approval of proposed changes and requested exceptions
impact, recorded, and tracked Ex2: Document the possible risks of making or not making each proposed change,
and provide guidance on rolling back changes

14
 NIST CSF 2.0 Implementation Examples

Category Subcategory Implementation Examples

Ex3: Document the risks related to each requested exception and the plan for
responding to those risks
Ex4: Periodically review risks that were accepted based upon planned future
actions or milestones
ID.RA-08: Processes for receiving, Ex1: Conduct vulnerability information sharing between the organization and its
analyzing, and responding to suppliers following the rules and protocols defined in contracts
vulnerability disclosures are Ex2: Assign responsibilities and verify the execution of procedures for processing,
established analyzing the impact of, and responding to cybersecurity threat, vulnerability, or
incident disclosures by suppliers, customers, partners, and government
cybersecurity organizations
ID.RA-09: The authenticity and Ex1: Assess the authenticity and cybersecurity of critical technology products and
integrity of hardware and software services prior to acquisition and use
are assessed prior to acquisition
and use
ID.RA-10: Critical suppliers are Ex1: Conduct supplier risk assessments against business and applicable
assessed prior to acquisition cybersecurity requirements, including the supply chain
Improvement (ID.IM):
Improvements to organizational
cybersecurity risk management
processes, procedures and
activities are identified across all
CSF Functions
ID.IM-01: Improvements are Ex1: Perform self-assessments of critical services that take current threats and
identified from evaluations TTPs into consideration
Ex2: Invest in third-party assessments or independent audits of the effectiveness
of the organization’s cybersecurity program to identify areas that need
improvement
Ex3: Constantly evaluate compliance with selected cybersecurity requirements
through automated means
ID.IM-02: Improvements are Ex1: Identify improvements for future incident response activities based on
identified from security tests and findings from incident response assessments (e.g., tabletop exercises and
exercises, including those done in simulations, tests, internal reviews, independent audits)

15
 NIST CSF 2.0 Implementation Examples

Category Subcategory Implementation Examples

coordination with suppliers and Ex2: Identify improvements for future business continuity, disaster recovery, and
relevant third parties incident response activities based on exercises performed in coordination with
critical service providers and product suppliers
Ex3: Involve internal stakeholders (e.g., senior executives, legal department, HR)
in security tests and exercises as appropriate
Ex4: Perform penetration testing to identify opportunities to improve the
security posture of selected high-risk systems as approved by leadership
Ex5: Exercise contingency plans for responding to and recovering from the
discovery that products or services did not originate with the contracted supplier
or partner or were altered before receipt
Ex6: Collect and analyze performance metrics using security tools and services to
inform improvements to the cybersecurity program
ID.IM-03: Improvements are Ex1: Conduct collaborative lessons learned sessions with suppliers
identified from execution of Ex2: Annually review cybersecurity policies, processes, and procedures to take
operational processes, procedures, lessons learned into account
and activities
Ex3: Use metrics to assess operational cybersecurity performance over time
ID.IM-04: Incident response plans Ex1: Establish contingency plans (e.g., incident response, business continuity,
and other cybersecurity plans that disaster recovery) for responding to and recovering from adverse events that can
affect operations are established, interfere with operations, expose confidential information, or otherwise endanger
communicated, maintained, and the organization’s mission and viability
improved Ex2: Include contact and communication information, processes for handling
common scenarios, and criteria for prioritization, escalation, and elevation in all
contingency plans
Ex3: Create a vulnerability management plan to identify and assess all types of
vulnerabilities and to prioritize, test, and implement risk responses
Ex4: Communicate cybersecurity plans (including updates) to those responsible
for carrying them out and to affected parties
Ex5: Review and update all cybersecurity plans annually or when a need for
significant improvements is identified
Identity Management,
Authentication, and Access
Control (PR.AA): Access to

16
 NIST CSF 2.0 Implementation Examples

Category Subcategory Implementation Examples

physical and logical assets is
limited to authorized users,
services, and hardware, and is
managed commensurate with
the assessed risk of unauthorized
access
PR.AA-01: Identities and Ex1: Initiate requests for new access or additional access for employees,
credentials for authorized users, contractors, and others, and track, review, and fulfill the requests, with permission
services, and hardware are from system or data owners when needed
managed by the organization Ex2: Issue, manage, and revoke cryptographic certificates and identity tokens,
cryptographic keys (i.e., key management), and other credentials
Ex3: Select a unique identifier for each device from immutable hardware
characteristics or an identifier securely provisioned to the device
Ex4: Physically label authorized hardware with an identifier for inventory and
servicing purposes
PR.AA-02: Identities are proofed Ex1: Verify a person’s claimed identity at enrollment time using government-
and bound to credentials based on issued identity credentials (e.g., passport, visa, driver’s license)
the context of interactions Ex2: Issue a different credential for each person (i.e., no credential sharing)
PR.AA-03: Users, services, and Ex1: Require multifactor authentication
hardware are authenticated Ex2: Enforce policies for the minimum strength of passwords, PINs, and similar
authenticators
Ex3: Periodically reauthenticate users, services, and hardware based on risk (e.g.,
in zero trust architectures)
Ex4: Ensure that authorized personnel can access accounts essential for
protecting safety under emergency conditions
PR.AA-04: Identity assertions are Ex1: Protect identity assertions that are used to convey authentication and user
protected, conveyed, and verified information through single sign-on systems
Ex2: Protect identity assertions that are used to convey authentication and user
information between federated systems
Ex3: Implement standards-based approaches for identity assertions in all
contexts, and follow all guidance for the generation (e.g., data models, metadata),

17
 NIST CSF 2.0 Implementation Examples

Category Subcategory Implementation Examples

protection (e.g., digital signing, encryption), and verification (e.g., signature
validation) of identity assertions
PR.AA-05: Access permissions, Ex1: Review logical and physical access privileges periodically and whenever
entitlements, and authorizations someone changes roles or leaves the organization, and promptly rescind privileges
are defined in a policy, managed, that are no longer needed
enforced, and reviewed, and Ex2: Take attributes of the requester and the requested resource into account for
incorporate the principles of least authorization decisions (e.g., geolocation, day/time, requester endpoint’s cyber
privilege and separation of duties health)
Ex3: Restrict access and privileges to the minimum necessary (e.g., zero trust
architecture)
Ex4: Periodically review the privileges associated with critical business functions
to confirm proper separation of duties
PR.AA-06: Physical access to assets Ex1: Use security guards, security cameras, locked entrances, alarm systems, and
is managed, monitored, and other physical controls to monitor facilities and restrict access
enforced commensurate with risk Ex2: Employ additional physical security controls for areas that contain high-risk
assets
Ex3: Escort guests, vendors, and other third parties within areas that contain
business-critical assets
Awareness and Training (PR.AT):
The organization’s personnel are
provided with cybersecurity
awareness and training so that
they can perform their
cybersecurity-related tasks
PR.AT-01: Personnel are provided Ex1: Provide basic cybersecurity awareness and training to employees,
with awareness and training so that contractors, partners, suppliers, and all other users of the organization’s non-
they possess the knowledge and public resources
skills to perform general tasks with Ex2: Train users to recognize social engineering attempts and other common
security risks in mind attacks, report attacks and suspicious activity, comply with acceptable use policies,
and perform basic cyber hygiene tasks (e.g., patching software, choosing
passwords, protecting credentials)

18
 NIST CSF 2.0 Implementation Examples

Category Subcategory Implementation Examples

Ex3: Explain the consequences of cybersecurity policy violations, both to
individual users and the organization as a whole
Ex4: Periodically assess or test users on their understanding of basic cybersecurity
practices
Ex5: Require annual refreshers to reinforce existing practices and introduce new
practices
PR.AT-02: Individuals in specialized Ex1: Identify the specialized roles within the organization that require additional
roles are provided with awareness cybersecurity training, such as physical and cybersecurity personnel, finance
and training so that they possess personnel, senior leadership, and anyone with access to business-critical data
the knowledge and skills to perform Ex2: Provide role-based cybersecurity awareness and training to all those in
relevant tasks with security risks in specialized roles, including contractors, partners, suppliers, and other third parties
mind
Ex3: Periodically assess or test users on their understanding of cybersecurity
practices for their specialized roles
Ex4: Require annual refreshers to reinforce existing practices and introduce new
practices
Data Security (PR.DS): Data are
managed consistent with the
organization’s risk strategy to
protect the confidentiality,
integrity, and availability of
information
PR.DS-01: The confidentiality, Ex1: Use encryption, digital signatures, and cryptographic hashes to protect the
integrity, and availability of data-at- confidentiality and integrity of stored data in files, databases, virtual machine disk
rest are protected images, container images, and other resources
Ex2: Use full disk encryption to protect data stored on user endpoints
Ex3: Confirm the integrity of software by validating signatures
Ex4: Restrict the use of removable media to prevent data exfiltration
Ex5: Physically secure removable media containing unencrypted sensitive
information, such as within locked offices or file cabinets

19
 NIST CSF 2.0 Implementation Examples

Category Subcategory Implementation Examples

PR.DS-02: The confidentiality, Ex1: Use encryption, digital signatures, and cryptographic hashes to protect the
integrity, and availability of data-in- confidentiality and integrity of network communications
transit are protected Ex2: Automatically encrypt or block outbound emails and other communications
that contain sensitive data, depending on the data classification
Ex3: Block access to personal email, file sharing, file storage services, and other
personal communications applications and services from organizational systems
and networks
Ex4: Prevent reuse of sensitive data from production environments (e.g.,
customer records) in development, testing, and other non-production
environments
PR.DS-10: The confidentiality, Ex1: Remove data that must remain confidential (e.g., from processors and
integrity, and availability of data-in- memory) as soon as it is no longer needed
use are protected Ex2: Protect data in use from access by other users and processes of the same
platform
PR.DS-11: Backups of data are Ex1: Continuously back up critical data in near-real-time, and back up other data
created, protected, maintained, frequently at agreed-upon schedules
and tested Ex2: Test backups and restores for all types of data sources at least annually
Ex3: Securely store some backups offline and offsite so that an incident or
disaster will not damage them
Ex4: Enforce geographic separation and geolocation restrictions for data backup
storage
Platform Security (PR.PS): The
hardware, software (e.g.,
firmware, operating systems,
applications), and services of
physical and virtual platforms are
managed consistent with the
organization’s risk strategy to
protect their confidentiality,
integrity, and availability

20
 NIST CSF 2.0 Implementation Examples

Category Subcategory Implementation Examples

PR.PS-01: Configuration Ex1: Establish, test, deploy, and maintain hardened baselines that enforce the
management practices are organization’s cybersecurity policies and provide only essential capabilities (i.e.,
established and applied principle of least functionality)
Ex2: Review all default configuration settings that may potentially impact
cybersecurity when installing or upgrading software
Ex3: Monitor implemented software for deviations from approved baselines
PR.PS-02: Software is maintained, Ex1: Perform routine and emergency patching within the timeframes specified in
replaced, and removed the vulnerability management plan
commensurate with risk Ex2: Update container images, and deploy new container instances to replace
rather than update existing instances
Ex3: Replace end-of-life software and service versions with supported,
maintained versions
Ex4: Uninstall and remove unauthorized software and services that pose undue
risks
Ex5: Uninstall and remove any unnecessary software components (e.g., operating
system utilities) that attackers might misuse
Ex6: Define and implement plans for software and service end-of-life
maintenance support and obsolescence
PR.PS-03: Hardware is maintained, Ex1: Replace hardware when it lacks needed security capabilities or when it
replaced, and removed cannot support software with needed security capabilities
commensurate with risk Ex2: Define and implement plans for hardware end-of-life maintenance support
and obsolescence
Ex3: Perform hardware disposal in a secure, responsible, and auditable manner
PR.PS-04: Log records are Ex1: Configure all operating systems, applications, and services (including cloud-
generated and made available for based services) to generate log records
continuous monitoring Ex2: Configure log generators to securely share their logs with the organization’s
logging infrastructure systems and services
Ex3: Configure log generators to record the data needed by zero-trust
architectures

21
 NIST CSF 2.0 Implementation Examples

Category Subcategory Implementation Examples

PR.PS-05: Installation and Ex1: When risk warrants it, restrict software execution to permitted products only
execution of unauthorized software or deny the execution of prohibited and unauthorized software
are prevented Ex2: Verify the source of new software and the software’s integrity before
installing it
Ex3: Configure platforms to use only approved DNS services that block access to
known malicious domains
Ex4: Configure platforms to allow the installation of organization-approved
software only
PR.PS-06: Secure software Ex1: Protect all components of organization-developed software from tampering
development practices are and unauthorized access
integrated and their performance is Ex2: Secure all software produced by the organization, with minimal
monitored throughout the software vulnerabilities in their releases
development life cycle
Ex3: Maintain the software used in production environments, and securely
dispose of software once it is no longer needed
Technology Infrastructure
Resilience (PR.IR): Security
architectures are managed with
the organization’s risk strategy to
protect asset confidentiality,
integrity, and availability, and
organizational resilience
PR.IR-01: Networks and Ex1: Logically segment organization networks and cloud-based platforms
environments are protected from according to trust boundaries and platform types (e.g., IT, IoT, OT, mobile, guests),
unauthorized logical access and and permit required communications only between segments
usage Ex2: Logically segment organization networks from external networks, and permit
only necessary communications to enter the organization’s networks from the
external networks
Ex3: Implement zero trust architectures to restrict network access to each
resource to the minimum necessary
Ex4: Check the cyber health of endpoints before allowing them to access and use
production resources

22
 NIST CSF 2.0 Implementation Examples

Category Subcategory Implementation Examples

PR.IR-02: The organization’s Ex1: Protect organizational equipment from known environmental threats, such
technology assets are protected as flooding, fire, wind, and excessive heat and humidity
from environmental threats Ex2: Include protection from environmental threats and provisions for adequate
operating infrastructure in requirements for service providers that operate
systems on the organization's behalf
PR.IR-03: Mechanisms are Ex1: Avoid single points of failure in systems and infrastructure
implemented to achieve resilience Ex2: Use load balancing to increase capacity and improve reliability
requirements in normal and
Ex3: Use high-availability components like redundant storage and power supplies
adverse situations
to improve system reliability
PR.IR-04: Adequate resource Ex1: Monitor usage of storage, power, compute, network bandwidth, and other
capacity to ensure availability is resources
maintained Ex2: Forecast future needs, and scale resources accordingly
Continuous Monitoring (DE.CM):
Assets are monitored to find
anomalies, indicators of
compromise, and other
potentially adverse events
DE.CM-01: Networks and network Ex1: Monitor DNS, BGP, and other network services and protocols for adverse
services are monitored to find events
potentially adverse events Ex2: Monitor wired and wireless networks for connections from unauthorized
endpoints
Ex3: Monitor facilities for unauthorized or rogue wireless networks
Ex4: Compare actual network flows against baselines to detect deviations
Ex5: Monitor network communications to identify changes in security postures
for zero trust purposes
DE.CM-02: The physical Ex1: Monitor logs from physical access control systems (e.g., badge readers) to
environment is monitored to find find unusual access patterns (e.g., deviations from the norm) and failed access
potentially adverse events attempts
Ex2: Review and monitor physical access records (e.g., from visitor registration,
sign-in sheets)

23
 NIST CSF 2.0 Implementation Examples

Category Subcategory Implementation Examples

Ex3: Monitor physical access controls (e.g., locks, latches, hinge pins, alarms) for
signs of tampering
Ex4: Monitor the physical environment using alarm systems, cameras, and
security guards
DE.CM-03: Personnel activity and Ex1: Use behavior analytics software to detect anomalous user activity to
technology usage are monitored to mitigate insider threats
find potentially adverse events Ex2: Monitor logs from logical access control systems to find unusual access
patterns and failed access attempts
Ex3: Continuously monitor deception technology, including user accounts, for any
usage
DE.CM-06: External service Ex1: Monitor remote and onsite administration and maintenance activities that
provider activities and services are external providers perform on organizational systems
monitored to find potentially Ex2: Monitor activity from cloud-based services, internet service providers, and
adverse events other service providers for deviations from expected behavior
DE.CM-09: Computing hardware Ex1: Monitor email, web, file sharing, collaboration services, and other common
and software, runtime attack vectors to detect malware, phishing, data leaks and exfiltration, and other
environments, and their data are adverse events
monitored to find potentially Ex2: Monitor authentication attempts to identify attacks against credentials and
adverse events unauthorized credential reuse
Ex3: Monitor software configurations for deviations from security baselines
Ex4: Monitor hardware and software for signs of tampering
Ex5: Use technologies with a presence on endpoints to detect cyber health issues
(e.g., missing patches, malware infections, unauthorized software), and redirect
the endpoints to a remediation environment before access is authorized
Adverse Event Analysis (DE.AE):
Anomalies, indicators of
compromise, and other
potentially adverse events are
analyzed to characterize the
events and detect cybersecurity
incidents

24
 NIST CSF 2.0 Implementation Examples

Category Subcategory Implementation Examples

DE.AE-02: Potentially adverse Ex1: Use security information and event management (SIEM) or other tools to
events are analyzed to better continuously monitor log events for known malicious and suspicious activity
understand associated activities Ex2: Utilize up-to-date cyber threat intelligence in log analysis tools to improve
detection accuracy and characterize threat actors, their methods, and indicators of
compromise
Ex3: Regularly conduct manual reviews of log events for technologies that cannot
be sufficiently monitored through automation
Ex4: Use log analysis tools to generate reports on their findings
DE.AE-03: Information is correlated Ex1: Constantly transfer log data generated by other sources to a relatively small
from multiple sources number of log servers
Ex2: Use event correlation technology (e.g., SIEM) to collect information captured
by multiple sources
Ex3: Utilize cyber threat intelligence to help correlate events among log sources
DE.AE-04: The estimated impact Ex1: Use SIEMs or other tools to estimate impact and scope, and review and
and scope of adverse events are refine the estimates
determined Ex2: A person creates their own estimates of impact and scope
DE.AE-06: Information on adverse Ex1: Use cybersecurity software to generate alerts and provide them to the
events is provided to authorized security operations center (SOC), incident responders, and incident response tools
staff and tools Ex2: Incident responders and other authorized personnel can access log analysis
findings at all times
Ex3: Automatically create and assign tickets in the organization’s ticketing system
when certain types of alerts occur
Ex4: Manually create and assign tickets in the organization’s ticketing system
when technical staff discover indicators of compromise
DE.AE-07: Cyber threat intelligence Ex1: Securely provide cyber threat intelligence feeds to detection technologies,
and other contextual information processes, and personnel
are integrated into the analysis Ex2: Securely provide information from asset inventories to detection
technologies, processes, and personnel
Ex3: Rapidly acquire and analyze vulnerability disclosures for the organization’s
technologies from suppliers, vendors, and third-party security advisories

25
 NIST CSF 2.0 Implementation Examples

Category Subcategory Implementation Examples

DE.AE-08: Incidents are declared Ex1: Apply incident criteria to known and assumed characteristics of activity in
when adverse events meet the order to determine whether an incident should be declared
defined incident criteria Ex2: Take known false positives into account when applying incident criteria
Incident Management (RS.MA):
Responses to detected
cybersecurity incidents are
managed
RS.MA-01: The incident response Ex1: Detection technologies automatically report confirmed incidents
plan is executed in coordination Ex2: Request incident response assistance from the organization’s incident
with relevant third parties once an response outsourcer
incident is declared
Ex3: Designate an incident lead for each incident
Ex4: Initiate execution of additional cybersecurity plans as needed to support
incident response (for example, business continuity and disaster recovery)
RS.MA-02: Incident reports are Ex1: Preliminarily review incident reports to confirm that they are cybersecurity-
triaged and validated related and necessitate incident response activities
Ex2: Apply criteria to estimate the severity of an incident
RS.MA-03: Incidents are Ex1: Further review and categorize incidents based on the type of incident (e.g.,
categorized and prioritized data breach, ransomware, DDoS, account compromise)
Ex2: Prioritize incidents based on their scope, likely impact, and time-critical
nature
Ex3: Select incident response strategies for active incidents by balancing the need
to quickly recover from an incident with the need to observe the attacker or
conduct a more thorough investigation
RS.MA-04: Incidents are escalated Ex1: Track and validate the status of all ongoing incidents
or elevated as needed Ex2: Coordinate incident escalation or elevation with designated internal and
external stakeholders
RS.MA-05: The criteria for initiating Ex1: Apply incident recovery criteria to known and assumed characteristics of the
incident recovery are applied incident to determine whether incident recovery processes should be initiated
Ex2: Take the possible operational disruption of incident recovery activities into
account

26
 NIST CSF 2.0 Implementation Examples

Category Subcategory Implementation Examples

Incident Analysis (RS.AN):
Investigations are conducted to
ensure effective response and
support forensics and recovery
activities
RS.AN-03: Analysis is performed to Ex1: Determine the sequence of events that occurred during the incident and
determine what has taken place which assets and resources were involved in each event
during an incident and the root Ex2: Attempt to determine what vulnerabilities, threats, and threat actors were
cause of the incident directly or indirectly involved in the incident
Ex3: Analyze the incident to find the underlying, systemic root causes
Ex4: Check any cyber deception technology for additional information on attacker
behavior
RS.AN-06: Actions performed Ex1: Require each incident responder and others (e.g., system administrators,
during an investigation are cybersecurity engineers) who perform incident response tasks to record their
recorded, and the records’ integrity actions and make the record immutable
and provenance are preserved Ex2: Require the incident lead to document the incident in detail and be
responsible for preserving the integrity of the documentation and the sources of
all information being reported
RS.AN-07: Incident data and Ex1: Collect, preserve, and safeguard the integrity of all pertinent incident data
metadata are collected, and their and metadata (e.g., data source, date/time of collection) based on evidence
integrity and provenance are preservation and chain-of-custody procedures
preserved
RS.AN-08: An incident’s magnitude Ex1: Review other potential targets of the incident to search for indicators of
is estimated and validated compromise and evidence of persistence
Ex2: Automatically run tools on targets to look for indicators of compromise and
evidence of persistence
Incident Response Reporting and
Communication (RS.CO):
Response activities are
coordinated with internal and
external stakeholders as required
by laws, regulations, or policies

27
 NIST CSF 2.0 Implementation Examples

Category Subcategory Implementation Examples

RS.CO-02: Internal and external Ex1: Follow the organization’s breach notification procedures after discovering a
stakeholders are notified of data breach incident, including notifying affected customers
incidents Ex2: Notify business partners and customers of incidents in accordance with
contractual requirements
Ex3: Notify law enforcement agencies and regulatory bodies of incidents based
on criteria in the incident response plan and management approval
RS.CO-03: Information is shared Ex1: Securely share information consistent with response plans and information
with designated internal and sharing agreements
external stakeholders Ex2: Voluntarily share information about an attacker’s observed TTPs, with all
sensitive data removed, with an Information Sharing and Analysis Center (ISAC)
Ex3: Notify HR when malicious insider activity occurs
Ex4: Regularly update senior leadership on the status of major incidents
Ex5: Follow the rules and protocols defined in contracts for incident information
sharing between the organization and its suppliers
Ex6: Coordinate crisis communication methods between the organization and its
critical suppliers
Incident Mitigation (RS.MI):
Activities are performed to
prevent expansion of an event
and mitigate its effects
RS.MI-01: Incidents are contained Ex1: Cybersecurity technologies (e.g., antivirus software) and cybersecurity
features of other technologies (e.g., operating systems, network infrastructure
devices) automatically perform containment actions
Ex2: Allow incident responders to manually select and perform containment
actions
Ex3: Allow a third party (e.g., internet service provider, managed security service
provider) to perform containment actions on behalf of the organization
Ex4: Automatically transfer compromised endpoints to a remediation virtual local
area network (VLAN)

28
 NIST CSF 2.0 Implementation Examples

Category Subcategory Implementation Examples

RS.MI-02: Incidents are eradicated Ex1: Cybersecurity technologies and cybersecurity features of other technologies
(e.g., operating systems, network infrastructure devices) automatically perform
eradication actions
Ex2: Allow incident responders to manually select and perform eradication
actions
Ex3: Allow a third party (e.g., managed security service provider) to perform
eradication actions on behalf of the organization
Incident Recovery Plan
Execution (RC.RP): Restoration
activities are performed to
ensure operational availability of
systems and services affected by
cybersecurity incidents
RC.RP-01: The recovery portion of Ex1: Begin recovery procedures during or after incident response processes
the incident response plan is Ex2: Make all individuals with recovery responsibilities aware of the plans for
executed once initiated from the recovery and the authorizations required to implement each aspect of the plans
incident response process
RC.RP-02: Recovery actions are Ex1: Select recovery actions based on the criteria defined in the incident response
selected, scoped, prioritized, and plan and available resources
performed Ex2: Change planned recovery actions based on a reassessment of organizational
needs and resources
RC.RP-03: The integrity of backups Ex1: Check restoration assets for indicators of compromise, file corruption, and
and other restoration assets is other integrity issues before use
verified before using them for
restoration
RC.RP-04: Critical mission functions Ex1: Use business impact and system categorization records (including service
and cybersecurity risk management delivery objectives) to validate that essential services are restored in the
are considered to establish post- appropriate order
incident operational norms Ex2: Work with system owners to confirm the successful restoration of systems
and the return to normal operations
Ex3: Monitor the performance of restored systems to verify the adequacy of the
restoration

29
 NIST CSF 2.0 Implementation Examples

Category Subcategory Implementation Examples

RC.RP-05: The integrity of restored Ex1: Check restored assets for indicators of compromise and remediation of root
assets is verified, systems and causes of the incident before production use
services are restored, and normal Ex2: Verify the correctness and adequacy of the restoration actions taken before
operating status is confirmed putting a restored system online
RC.RP-06: The criteria for Ex1: Prepare an after-action report that documents the incident itself, the
determining the end of incident response and recovery actions taken, and lessons learned
recovery are applied, and incident- Ex2: Declare the end of incident recovery once the criteria are met
related documentation is
completed
Incident Recovery
Communication (RC.CO):
Restoration activities are
coordinated with internal and
external parties
RC.CO-03: Recovery activities and Ex1: Securely share recovery information, including restoration progress,
progress in restoring operational consistent with response plans and information sharing agreements
capabilities are communicated to Ex2: Regularly update senior leadership on recovery status and restoration
designated internal and external progress for major incidents
stakeholders
Ex3: Follow the rules and protocols defined in contracts for incident information
sharing between the organization and its suppliers
Ex4: Coordinate crisis communication between the organization and its critical
suppliers
RC.CO-04: Public updates on Ex1: Follow the organization’s breach notification procedures for recovering from
incident recovery are shared using a data breach incident
approved methods and messaging Ex2: Explain the steps being taken to recover from the incident and to prevent a
recurrence

30