The 22 categories group related cybersecurity outcomes within each function. Each category has a two-letter code prefixed by its function. Filter by function to browse.
GV · Govern
GV.OC
Organisational Context
The circumstances — mission, stakeholder expectations, dependencies — that inform risk management decisions are understood.
GV · Govern
GV.RM
Risk Management Strategy
Risk management objectives, risk appetite, and risk tolerance are established and communicated.
GV · Govern
GV.RR
Roles, Responsibilities & Authorities
Cybersecurity roles and responsibilities for the workforce are established, communicated, and enforced.
GV · Govern
GV.PO
Policy
Organisational cybersecurity policy is established, communicated, and enforced.
GV · Govern
GV.OV
Oversight
Results of organisation-wide cybersecurity risk management are used to inform and improve the cybersecurity program.
GV · Govern
GV.SC
Cybersecurity Supply Chain Risk Management
Cyber supply chain risk management processes are identified, established, managed, monitored, and improved by organisational stakeholders.
ID · Identify
ID.AM
Asset Management
Assets — data, hardware, software, systems, facilities, services — that enable the organisation to achieve business purposes are identified and managed.
ID · Identify
ID.RA
Risk Assessment
Cybersecurity risk to the organisation, assets, and individuals is identified and prioritised, consistent with risk strategy and risk appetite.
ID · Identify
ID.IM
Improvement
Improvements to organisational cybersecurity risk management processes, procedures, and activities are identified across all CSF functions.
PR · Protect
PR.AA
Identity Management, Authentication & Access Control
Access to physical and logical assets is limited to authorised users, services, and hardware — managed consistent with assessed risk.
PR · Protect
PR.AT
Awareness and Training
The organisation's personnel are provided with cybersecurity awareness and training so they can perform related cybersecurity tasks.
PR · Protect
PR.DS
Data Security
Data are managed consistent with the organisation's risk strategy — protecting confidentiality, integrity, and availability.
PR · Protect
PR.PS
Platform Security
The hardware, software, and services of physical and virtual platforms are managed consistent with the organisation's risk strategy.
PR · Protect
PR.IR
Technology Infrastructure Resilience
Security architectures are managed with the organisation's risk strategy to protect individual assets and technology infrastructure.
DE · Detect
DE.CM
Continuous Monitoring
Assets are monitored to find anomalies, indicators of compromise, and other adverse events — at a cadence sufficient to meet organisational risk objectives.
DE · Detect
DE.AE
Adverse Event Analysis
Anomalies, indicators of compromise, and other adverse events are analysed to characterise the events and detect cybersecurity incidents.
RS · Respond
RS.MA
Incident Management
Responses to detected cybersecurity incidents are managed according to the organisation's incident response plan.
RS · Respond
RS.AN
Incident Analysis
Investigations are conducted to ensure effective response and support forensics and recovery activities.
RS · Respond
RS.CO
Incident Response Reporting and Communication
Response activities are coordinated with internal and external stakeholders as required by laws, regulations, or policies.
RS · Respond
RS.MI
Incident Mitigation
Activities are performed to prevent expansion of an event and mitigate its effects.
RC · Recover
RC.RP
Incident Recovery Plan Execution
Restoration activities are performed to ensure operational availability of systems and services affected by cybersecurity incidents.
RC · Recover
RC.CO
Incident Recovery Communication
Restoration activities are coordinated with internal and external parties — notifications are sent after a cybersecurity incident.