Identify

Equipment and other physical resources managed or held by the entity are inventoried.

The logical resources that support the processes of the entity's services are inventoried.

Networks and communication flows are mapped.

The services provided by suppliers are inventoried.

The assets are classified according to their criticality.

Data and metadata thereof shall be identified and recorded.

Systems, hardware, software, services and data are managed throughout your life cycles.

Data are destroyed according to the Data Classification and Management Policy.

The entity implements a change management process.

Asset vulnerabilities are identified and documented on the basis of the defined methodology.

The entity shares information on cybersecurity threats with stakeholders.

Internal and external threats are identified and documented on the basis of the defined methodology.

Potential impacts and their likelihood of threats are identified and recorded.

The entity shall assess the identified risks.

The entity shall ensure that risk responses are identified and prioritized.

The entity defines processes to receive information, analyze and respond to internal and external vulnerabilities.

Improvements are identified through assessments and information is shared with stakeholders.

Improvements are identified from cybersecurity testing and exercises.

The improvements are identified from the execution of operational processes, procedures and activities.