x
x
x

Framework Core

The Framework Core consists of common cybersecurity activities and goals. It is comprised of five concurrent and continuous functions representing activities that assist with defining and implementing the cybersecurity program. The functions are Identify, Protect, Detect, Respond, and Recover.

Functions are subdivided into categories representing cybersecurity goals which tie agency and security needs to desired outcomes. Examples of categories include Asset Management, Access Control, and Detection Processes.

Categories are further divided into subcategories that provide specific outcomes of technical and/or management activities. Examples of subcategories include External information systems are catalogued, Data-at-rest is protected, and Notifications from detection systems are investigated.

Respond

The Response Function describes activities that will help an agency to take action regarding a detected cybersecurity event. These activities will support the ability to contain the impact of a potential cybersecurity event.

Response Planning

RS.RP

Executing and maintaining response processes to ensure timely response to detected cybersecurity events.

  1. Execute the response plan during or after a cybersecurity event.

Associated Artifacts:

Communications

RS.CO

Coordinating response activities with internal and external stakeholders, as appropriate, to include external support from law enforcement agencies.

  1. Ensure personnel know their roles and order of operations (i.e. ensure personnel know which actions or tasks to complete in the correct order and within any required timeframes) when a response is needed.
  2. Report all cybersecurity events according to established criteria.
  3. Ensure information is shared according to documented response plans.
  4. Ensure coordination with stakeholders occurs according to documented response plans.
  5. Ensure voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness (i.e. maintaining knowledge and an understanding of the security health and operations of the network, the possible cybersecurity threats, and business/mission dependencies) .

Analysis

RS.AN

Conducting analysis to ensure adequate response and support recovery activities.

  1. Investigate all notifications from detection systems.
  2. Ensure the impact of all incidents are understood.
  3. Perform forensics to understand why and how systems are attacked, and to understand how to prevent future attacks.
  4. Categorize all incidents according to response plans.
  5. Processes are established to receive, analyze and respond to vulnerabilities disclosed to the organization from internal and external sources (e.g. internal testing, security bulletins, or security researchers) .

Mitigation

RS.MI

Performing activities to prevent expansion of an event, mitigate its effects, and eradicate the incident.

  1. Contain incidents to prevent expansion to other systems or other areas of the network.
  2. Mitigate incidents to reduce the effect of the event.
  3. Mitigate newly identified vulnerabilities or document them as accepted risks.

Improvements

RS.IM

Improving agency response activities by incorporating lessons learned from current and previous detection/response activities.

  1. Incorporate lessons learned into response plans.
  2. Periodically update response strategies.
⇡