Mission, stakeholders, dependencies, legal and regulatory requirements understood and informing cybersecurity risk management.

Priorities, constraints, risk tolerance, and assumptions established and used to support operational risk decisions.

Cybersecurity roles, responsibilities, and authorities established and communicated to foster accountability and performance.

Organizational cybersecurity policy established, communicated, and enforced.

Results of organization-wide cybersecurity risk management activities and performance used to inform, improve, and adjust strategy.

Supply chain risk management processes identified, established, managed, monitored, and improved.

Assets that enable the organization to achieve business purposes identified and managed consistent with their relative importance to organizational objectives and the risk strategy.

Cybersecurity risk to the organization, assets, and individuals understood by the organization.

Improvements to organizational cybersecurity risk management processes, procedures, and activities identified across all CSF Functions.

Access to physical and logical assets limited to authorized users, services, and hardware and managed commensurate with risk.

Personnel provided with cybersecurity awareness and training so they can perform their cybersecurity-related tasks.

Data managed consistent with the organization's risk strategy to protect confidentiality, integrity, and availability.

Hardware, software, and services of physical and virtual platforms managed consistent with the organization's risk strategy.

Security architectures managed with the organization's risk strategy to protect asset confidentiality, integrity, and availability, and organizational resilience.

Assets monitored to find anomalies, indicators of compromise, and other potentially adverse events.

Anomalies, indicators of compromise, and other potentially adverse events analyzed to characterize the events and detect cybersecurity incidents.

Responses to detected cybersecurity incidents managed.

Investigations conducted to ensure effective response and support forensics and recovery activities.

Response activities coordinated with internal and external stakeholders as required by laws, regulations, or policies.

Activities performed to prevent expansion of an event and mitigate its effects.

Restoration activities performed to ensure operational availability of systems and services affected by cybersecurity incidents.

Restoration activities coordinated with internal and external parties.