SAMMY UI is optimized for resolutions with a width 1024px and higher.
NIST CSF 2.0
Browse NIST CSF 2.0
ID.RA-01: Asset Vulnerability Identification
ID.RA-02: Information Sharing Forums
ID.RA-03: Threat Identification
ID.RA-04: Impact and Likelihood Analysis
ID.RA-05: Risk Exposure Determination and Prioritization
ID.RA-06: Risk Response Determination
ID.RA-07: Change and Exception Management
ID.RA-08: Vulnerability Disclosure Response
ID.RA-09: Integrity and Authenticity Verification
ID.RA-10: Critical Supplier Assessment
Vulnerability Disclosure Response
ID.RA-08: Processes for receiving, analyzing, and responding to vulnerability disclosures are established
  • Ex1:  Conduct vulnerability information sharing between the organization and its suppliers following the rules and protocols defined in contracts
  • Ex2:  Assign responsibilities and verify the execution of procedures for processing, analyzing the impact of, and responding to cybersecurity threat, vulnerability, or incident disclosures by suppliers, customers, partners, and government cybersecurity organizations
Tier
Not Applicable - Not applicable
No - The outcome(s) have not been meaningfully implemented.
Tier 1: Partial - Application of the organizational cybersecurity risk strategy is managed in an ad hoc manner. Prioritization is ad hoc and not formally based on objectives or threat environment.
Tier 2: Risk Informed - Risk management practices are approved by management but may not be established as organization-wide policy. The prioritization of cybersecurity activities and protection needs is directly informed by organizational risk objectives, the threat environment, or business/mission requirements.
Tier 3: Repeatable - The organization’s risk management practices are formally approved and expressed as policy. Risk-informed policies, processes, and procedures are defined, implemented as intended, and reviewed. Organizational cybersecurity practices are regularly updated based on the application of risk management processes to changes in business/mission requirements, threats, and technological landscape.
Tier 4: Adaptive - There is an organization-wide approach to managing cybersecurity risks that uses risk-informed policies, processes, and procedures to address potential cybersecurity events.
Description

Processes for receiving, analyzing, and responding to vulnerability disclosures are established