CSF Identifiers - Revision history

Wikiadmin: Wikiadmin moved page Function and Category Identifiers to CSF Identifiers without leaving a redirect

2023-04-09T21:08:20Z

Wikiadmin moved page Function and Category Identifiers to CSF Identifiers without leaving a redirect

← Older revision		Revision as of 21:08, 9 April 2023
(No difference)

Wikiadmin at 21:04, 9 April 2023

2023-04-09T21:04:48Z

← Older revision		Revision as of 21:04, 9 April 2023
Line 1:		Line 1:
			'''Source of Reference: official [https://www.nist.gov/cyberframework/online-learning/components-framework Cybersecurity Framework Components] from National Institute of Standards and Technology (NIST).'''

			For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you.

	{\|class="wikitable" style="width: 85%;"		{\|class="wikitable" style="width: 85%;"
	! style="width: 15%"\| Function Unique Identifier		! style="width: 15%"\| Function Unique Identifier

Wikiadmin at 21:01, 9 April 2023

2023-04-09T21:01:14Z

← Older revision		Revision as of 21:01, 9 April 2023
Line 56:		Line 56:
	\|Detection Process		\|Detection Process
	\|-		\|-
	\|'''~~Specialized Assets~~'''		\|rowspan="5" style="text-align:center;"\|'''RS'''
	\|		\|rowspan="5" style="text-align:center;"\|Respond
	* Assets that may or may not process, store, or transmit CUI		\|style="text-align:center;"\|RS.RP
	* Assets include: ~~government property, Internet of Things (IoT) devices, Operational Technology (OT), Restricted Information Systems, and Test Equipment~~		\|Response Planning
	\|
	* Review the SSP in accordance with practice CA.L2-3.~~12.4~~
	* Do not assess against other CMMC practices
	\|-		\|-
	\|~~colspan~~="4"\|~~Assets that are not in the CMMC Assessment Scope~~		\|style="text-align:center;"\|RS.CO
			\|Communications
	\|-		\|-
	\|'''~~Out-of-Scope Assets~~'''		\|style="text-align:center;"\|RS.AN
	\|		\|Analysis
	* Assets that cannot process, store, or transmit CUI		\|-
	\|		\|style="text-align:center;"\|RS.MI
	* Assets are required to be physically or logically separated from CUI assets		\|Mitigation
	\|		\|-
	* None		\|style="text-align:center;"\|RS.IM
			\|Improvements
			\|-
			\|rowspan="3" style="text-align:center;"\|'''RC'''
			\|rowspan="3" style="text-align:center;"\|Recovery
			\|style="text-align:center;"\|RC.RP
			\|Recovery Planning
			\|-
			\|style="text-align:center;"\|RC.IM
			\|Improvements
			\|-
			\|style="text-align:center;"\|RC.CO
			\|Communications
	\|}		\|}

Wikiadmin at 20:58, 9 April 2023

2023-04-09T20:58:04Z

← Older revision		Revision as of 20:58, 9 April 2023
Line 25:		Line 25:
	\|Business Environment		\|Business Environment
	\|-		\|-
	\|'''~~Security Protection Assets~~'''		\|rowspan="6" style="text-align:center;"\|'''PR'''
	\|		\|rowspan="6" style="text-align:center;"\|Protect
	* Assets that provide security functions or capabilities to the contractor's CMMC Assessment Scope, irrespective of whether or not these assets process, store, or transmit CUI		\|style="text-align:center;"\|PR.AC
			\|Identity Management and Access Control
	\|-		\|-
	\|~~'''Contractor Risk Managed Assets'''~~		\|style="text-align:center;"\|PR.AT
	\|		\|Awareness and Training
	* Assets that can, but are not intended to, process, store, or transmit CUI because of security policy, procedures, and ~~practices in place~~		\|-
	* Assets are not required to be physically or logically separated from CUI assets		\|style="text-align:center;"\|PR.DS
	\|~~rowspan~~="2"\|		\|Data Security
	* Document in the asset inventory		\|-
	* Document in the SSP		\|style="text-align:center;"\|PR.IP
	** Show these assets are managed using the contractor’s risk-~~based security policies, procedures,~~ and ~~practices~~		\|Information Protection Processes and Procedures
	* Document in the network diagram of the CMMC Assessment Scope		\|-
	\|		\|style="text-align:center;"\|PR.MA
	* Review the SSP in accordance with practice CA.L2-3.12.4		\|Maintenance
	** If appropriately documented, do not assess against other CMMC practices		\|-
	** If contractor’s risk-~~based security policies, procedures, and practices documentation or other findings raise questions about these assets, the assessor can conduct a limited spot check to identify risks~~		\|style="text-align:center;"\|PR.PT
	** The limited spot check(s) shall not materially increase the assessment duration nor the assessment cost		\|Protective Technology
	** The limited spot check(s) will be within the defined assessment scope		\|-
			\|rowspan="3" style="text-align:center;"\|'''DE'''
			\|rowspan="3" style="text-align:center;"\|Detect
			\|style="text-align:center;"\|DE.AE
			\|Anomalies and Events
			\|-
			\|style="text-align:center;"\|DE.CM
			\|Security Continuous Monitoring
			\|-
			\|style="text-align:center;"\|DE.DP
			\|Detection Process
	\|-		\|-
	\|'''Specialized Assets'''		\|'''Specialized Assets'''

Wikiadmin at 20:49, 9 April 2023

2023-04-09T20:49:48Z

← Older revision		Revision as of 20:49, 9 April 2023
Line 5:		Line 5:
	! style="width: 50%"\| Category		! style="width: 50%"\| Category
	\|-		\|-
	\|rowspan="2"\|style="text-align:center;"\|'''ID'''		\|rowspan="6" style="text-align:center;"\|'''ID'''
	\|rowspan="2"\|style="text-align:center;"\|Identify		\|rowspan="6" style="text-align:center;"\|Identify
	\|ID.AM		\|style="text-align:center;"\|ID.AM
	\|Asset Management		\|Asset Management
	\|-		\|-
	\|ID.BE		\|style="text-align:center;"\|ID.BE
			\|Business Environment
			\|-
			\|style="text-align:center;"\|ID.GV
			\|Governance
			\|-
			\|style="text-align:center;"\|ID.RA
			\|Risk Assessment
			\|-
			\|style="text-align:center;"\|ID.RM
			\|Risk Management Strategy
			\|-
			\|style="text-align:center;"\|ID.SC
	\|Business Environment		\|Business Environment
	\|-		\|-

Wikiadmin at 20:46, 9 April 2023

2023-04-09T20:46:16Z

← Older revision		Revision as of 20:46, 9 April 2023
Line 5:		Line 5:
	! style="width: 50%"\| Category		! style="width: 50%"\| Category
	\|-		\|-
	\|rowspan="2"\|'''ID'''		\|rowspan="2"\|style="text-align:center;"\|'''ID'''
	\|rowspan="2"\|Identify		\|rowspan="2"\|style="text-align:center;"\|Identify
	\|ID.AM		\|ID.AM
	\|Asset Management		\|Asset Management

Wikiadmin at 20:43, 9 April 2023

2023-04-09T20:43:18Z

← Older revision		Revision as of 20:43, 9 April 2023
Line 9:		Line 9:
	\|ID.AM		\|ID.AM
	\|Asset Management		\|Asset Management
			\|-
	\|ID.BE		\|ID.BE
	\|Business Environment		\|Business Environment

Wikiadmin at 20:42, 9 April 2023

2023-04-09T20:42:51Z

← Older revision		Revision as of 20:42, 9 April 2023
Line 5:		Line 5:
	! style="width: 50%"\| Category		! style="width: 50%"\| Category
	\|-		\|-
	\|'''ID'''		\|rowspan="2"\|'''ID'''
	\|		\|rowspan="2"\|Identify
	* Assets that process, store, or transmit CUI		\|ID.AM
	\|rowspan="2"\|		\|Asset Management
	* Document in the asset inventory		\|ID.BE
	* Document in the System Security Plan (SSP)		\|Business Environment
	* Document in the network diagram of the CMMC Assessment Scope
	* Prepare to be assessed against CMMC practices
	\|~~rowspan="2"\|~~
	* Assess against CMMC practices
	\|-		\|-
	\|'''Security Protection Assets'''		\|'''Security Protection Assets'''

Wikiadmin at 20:39, 9 April 2023

2023-04-09T20:39:13Z

← Older revision		Revision as of 20:39, 9 April 2023
Line 5:		Line 5:
	! style="width: 50%"\| Category		! style="width: 50%"\| Category
	\|-		\|-
	\|'''~~Controlled Unclassified Information (CUI) Assets~~'''		\|'''ID'''
	\|		\|
	* Assets that process, store, or transmit CUI		* Assets that process, store, or transmit CUI

Wikiadmin at 20:36, 9 April 2023

2023-04-09T20:36:16Z

← Older revision		Revision as of 20:36, 9 April 2023
Line 4:		Line 4:
	! style="width: 20%"\| Category Unique Identifier		! style="width: 20%"\| Category Unique Identifier
	! style="width: 50%"\| Category		! style="width: 50%"\| Category
	\|-
	~~\|colspan="4"\|Assets that are in the CMMC Assessment Scope~~
	\|-		\|-
	\|'''Controlled Unclassified Information (CUI) Assets'''		\|'''Controlled Unclassified Information (CUI) Assets'''