ID.IM-02 says improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties. A plan nobody has rehearsed is a guess. An exercise shows where the guess was wrong while the cost is still low.
CSF is voluntary guidance and there is no CSF certification.
What good looks like
You run at least one incident response exercise a year, a penetration test of selected high risk systems with leadership approval, and a continuity or recovery exercise that includes a critical supplier. Each produces written findings and tracked fixes. Executives, legal and HR take part when the scenario needs them.
How to implement it
- Pick a realistic scenario: ransomware on a file server, a leaked cloud key, or a supplier breach.
- Run a two hour tabletop with the people who would act: engineering, support, legal, an executive. Use a facilitator who does not own the plan.
- Write down the gaps as they appear: unclear owner, missing contact, a runbook that is out of date.
- Commission a penetration test for your most exposed system, and agree scope and rules of engagement in writing.
- Include one critical supplier in a recovery or communication drill, and test the contingency for the case where a delivered product turns out not to come from the contracted supplier or was altered.
- File every finding as an action with owner and date. Review in thirty days.
Evidence to collect
- Exercise scenario, attendee list and date.
- Findings and the action list with closure status.
- Penetration test report with remediation notes and retest results.
- Records of supplier participation.
Common gaps
- The exercise is run, the notes are filed, and nothing changes.
- Only the security team attends.
- Penetration test findings are fixed but not retested.
- Suppliers are never in the room.
Quick check
What is the smallest useful exercise?
A one hour tabletop with a single scenario and a written list of at least three improvements, each with an owner.
Does a test with no findings count?
It counts as evidence of testing, but be skeptical. If nothing was found, the scenario may have been too easy or the scope too narrow.
Sources
- NIST, The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29: https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
