ID.IM-01 Improvements from evaluations
Finding improvements through evaluations: self-assessments of critical services, third-party assessments or independent audits, and automated compliance checks.
ID.IM Improvement
Improvement: identifying improvements from evaluations, tests and exercises and day-to-day operations, and maintaining incident response and other operational plans; four Subcategories.
ID.IM-02 Improvements from tests and exercises
Finding improvements through security tests and exercises, including tabletop exercises, penetration tests and continuity exercises run with suppliers and service providers.
ID.IM-03 Improvements from operations
Finding improvements from day-to-day execution of processes, procedures and activities, including lessons learned with suppliers, annual policy reviews and operational metrics.
ID.IM-04 Incident response and operational plans
Establishing, communicating, maintaining and improving incident response, business continuity, disaster recovery, vulnerability management and other plans that affect operations.
