ID.RA-01 Vulnerabilities identified and recorded
Identifying, validating and recording vulnerabilities in assets through scanning, architecture review, software testing, facility assessments, threat intelligence and process review.
ID.RA Risk assessment
Risk Assessment: vulnerabilities, threat intelligence, threats, likelihood and impact, inherent risk, risk response, change and exception management, vulnerability disclosure, authenticity checks and supplier assessment; ten Subcategories.
ID.RA-02 Threat intelligence received
Receiving cyber threat intelligence from information sharing forums and other sources, ingesting feeds into security tools and reviewing advisories on threat actors.
ID.RA-03 Threats identified and recorded
Identifying and recording internal and external threats, using threat intelligence on likely actors, threat hunting and processes for spotting insider threats.
ID.RA-04 Impacts and likelihoods recorded
Estimating the likelihood and business impact of threats exploiting vulnerabilities, recorded in risk registers and including cascading failures across systems of systems.
ID.RA-05 Inherent risk and prioritization
Combining threats, vulnerabilities, likelihoods and impacts to understand inherent risk and prioritize risk responses, including threat modeling.
ID.RA-06 Risk responses planned and tracked
Choosing, prioritizing, planning, tracking and communicating risk responses (accept, transfer, mitigate or avoid), with progress tracked in a POA&M or risk register.
ID.RA-07 Changes and exceptions managed
Formal change and exception management: documenting, reviewing, testing and approving changes and exceptions, recording their risks and rollback plans, and revisiting accepted risks.
ID.RA-08 Vulnerability disclosure handling
Processes for receiving, analyzing and responding to vulnerability disclosures from suppliers, customers, partners and government cybersecurity organizations.
ID.RA-09 Hardware and software authenticity
Assessing the authenticity and integrity of hardware and software before acquiring and using them, as protection against counterfeit or tampered components.
ID.RA-10 Critical supplier assessment
Assessing critical suppliers before acquisition against business and cybersecurity requirements, including their own supply chains; the risk assessment counterpart of GV.SC-06 due diligence.
