NIST CSF 2.

0 AUDIT CHECKLIST
 NIST CSF 2.0 AUDIT CHECKLIST

NIST CSF 2.0 Audit Checklist

DETECT (DE): Possible cybersecurity attacks and compromises are found and
Function analyzed
Continuous Monitoring (DE.CM): Assets are monitored to find anomalies, indicators
Category of compromise, and other potentially adverse events
Subcategory Audit Questionnaire Compliance Status
Continuous Monitoring 1. Does the organization have systems and
(DE.CM): Assets are processes in place to continuously monitor
monitored to find networks and network services for potentially
anomalies, indicators of adverse events?
compromise, and other 2. What tools or technologies are used for network
potentially adverse events monitoring (e.g., intrusion detection systems,
network traffic analyzers, log management tools)?
3. How does the organization define and identify
potentially adverse events in the context of
network monitoring?
4. Are there established baselines for normal
network behaviour, and how are deviations from
these baselines detected and investigated?
5. How frequently are network monitoring tools and
processes reviewed and updated to address new
threats or technologies?
6. Are there documented procedures for responding
to and investigating potentially adverse events
detected through network monitoring?
7. How are the results of network monitoring
communicated to relevant stakeholders within the
organization?
8. Does the organization monitor both internal and
external network traffic?
9. Are there mechanisms in place to correlate data
from different network monitoring tools to improve
threat detection capabilities?
10. How does the organization ensure that network
monitoring activities comply with relevant privacy
and data protection regulations?
DE.CM-02: The physical 1. Does the organization have systems and
environment is monitored processes in place to monitor the physical
to find potentially adverse environment for potentially adverse events?
events 2. What types of physical security controls are
monitored (e.g., access control systems,
surveillance cameras, environmental sensors)?
3. How does the organization define and identify
potentially adverse events in the context of
physical environment monitoring?
4. Are there established baselines for normal
physical environment conditions, and how are
deviations from these baselines detected and
investigated?
 NIST CSF 2.0 AUDIT CHECKLIST

5. How frequently are physical monitoring systems

and processes reviewed and updated?
6. Are there documented procedures for responding
to and investigating potentially adverse events
detected through physical environment
monitoring?
7. How are the results of physical environment
monitoring communicated to relevant
stakeholders within the organization?
8. Does the organization integrate physical security
monitoring with cybersecurity monitoring efforts?
9. Are there mechanisms in place to ensure
continuous monitoring of critical physical areas,
even during power outages or other disruptions?
10. How does the organization ensure that physical
environment monitoring activities comply with
relevant privacy and labor regulations?
DE.CM-03: Personnel 1. Does the organization have systems and
activity and technology processes in place to monitor personnel activity
usage are monitored to and technology usage for potentially adverse
find potentially adverse events?
events 2. What types of personnel activities and technology
usage are monitored (e.g., login attempts, file
access, email usage, application usage)?
3. How does the organization define and identify
potentially adverse events in the context of
personnel activity and technology usage?
4. Are there established baselines for normal
personnel activity and technology usage, and how
are deviations from these baselines detected and
investigated?
5. How frequently are personnel activity and
technology usage monitoring systems and
processes reviewed and updated?
6. Are there documented procedures for responding
to and investigating potentially adverse events
detected through personnel and technology usage
monitoring?
7. How are the results of personnel activity and
technology usage monitoring communicated to
relevant stakeholders within the organization?
8. Does the organization have policies in place to
inform employees about monitoring activities and
ensure compliance with privacy regulations?
9. Are there mechanisms in place to detect and
investigate potential insider threats?
10. How does the organization balance the need for
monitoring with employee privacy concerns?
 NIST CSF 2.0 AUDIT CHECKLIST

DE.CM-06: External 1. Does the organization have systems and

service provider activities processes in place to monitor the activities and
and services are services of external service providers for
monitored to find potentially adverse events?
potentially adverse events 2. What types of external service provider activities
and services are monitored?
3. How does the organization define and identify
potentially adverse events in the context of
external service provider activities?
4. Are there established baselines for normal
external service provider activities, and how are
deviations from these baselines detected and
investigated?
5. How frequently are external service provider
monitoring systems and processes reviewed and
updated?
6. Are there documented procedures for responding
to and investigating potentially adverse events
detected through external service provider
monitoring?
7. How are the results of external service provider
monitoring communicated to relevant
stakeholders within the organization?
8. Does the organization have agreements in place
with external service providers that allow for
monitoring of their activities?
9. Are there mechanisms in place to ensure that
external service providers comply with the
organization's security policies and standards?
10. How does the organization ensure that its
monitoring of external service providers complies
with relevant contractual and legal requirements?
DE.CM-09: Computing 1. Does the organization have systems and
hardware and software, processes in place to monitor computing
runtime environments, hardware, software, runtime environments, and
and their data are their data for potentially adverse events?
monitored to find 2. What specific aspects of computing hardware,
potentially adverse events software, runtime environments, and data are
monitored (e.g., system logs, application logs,
configuration changes, data access patterns)?
3. How does the organization define and identify
potentially adverse events in the context of these
IT assets?
4. Are there established baselines for normal
behaviour of computing hardware, software,
runtime environments, and data, and how are
deviations from these baselines detected and
investigated?
5. How frequently are monitoring systems and
processes for these IT assets reviewed and
updated?
 NIST CSF 2.0 AUDIT CHECKLIST

6. Are there documented procedures for responding

to and investigating potentially adverse events
detected through monitoring of these IT assets?
7. How are the results of this monitoring
communicated to relevant stakeholders within the
organization?
8. Does the organization use automated tools for
monitoring and analyzing the behavior of
computing hardware, software, runtime
environments, and data?
9. Are there mechanisms in place to detect and
investigate potential malware infections,
unauthorized software installations, or
unauthorized changes to runtime environments?
10. How does the organization ensure that its
monitoring of computing hardware, software,
runtime environments, and data complies with
relevant privacy and data protection regulations?

Adverse Event Analysis (DE.AE): Anomalies, indicators of compromise, and other

Category potentially adverse events are analyzed to characterize the events and detect
cybersecurity incidents

Subcategory Audit Questionnaire Compliance Status

DE.AE-02: Potentially 1. Does the organization have a defined process for
adverse events are analyzing potentially adverse events?
analyzed to better 2. What criteria are used to identify and prioritize
understand associated potentially adverse events for analysis?
activities 3. How does the organization ensure that the
analysis of potentially adverse events is thorough
and timely?
4. What tools or technologies are used to support the
analysis of potentially adverse events?
5. Are there documented procedures for conducting
the analysis of potentially adverse events?
6. How does the organization capture and document
the findings from the analysis of potentially
adverse events?
7. Are there mechanisms in place to identify patterns
or trends across multiple potentially adverse
events?
8. How does the organization use the results of the
analysis to improve its overall security posture?
9. Are there clear roles and responsibilities assigned
for the analysis of potentially adverse events?
10. How does the organization's leadership ensure the
effectiveness of the analysis process for
potentially adverse events?
DE.AE-03: Information is 1. Does the organization have processes in place to
correlated from multiple correlate information from multiple sources when
sources analyzing cybersecurity events?
 NIST CSF 2.0 AUDIT CHECKLIST

2. What types of information sources are used in the

correlation process (e.g., log files, network traffic
data, threat intelligence feeds)?
3. How does the organization ensure that the
information from different sources is accurately
and effectively correlated?
4. What tools or technologies are used to support the
correlation of information from multiple sources?
5. Are there documented procedures for correlating
and analyzing information from multiple sources?
6. How does the organization handle discrepancies
or conflicts in information from different sources?
7. Are there mechanisms in place to identify complex
or sophisticated attacks that may only be visible
when correlating multiple data sources?
8. How does the organization use the correlated
information to improve its detection and response
capabilities?
9. Are there clear roles and responsibilities assigned
for the correlation and analysis of information
from multiple sources?
DE.AE-04: The estimated 1. Does the organization have a process for
impact and scope of estimating the impact and scope of adverse
adverse events are events?
understood 2. What criteria or metrics are used to assess the
impact of adverse events (e.g., financial loss,
operational disruption, data compromise)?
3. How does the organization determine the scope of
adverse events, including affected systems, data,
and users?
4. Are there documented procedures for assessing
and documenting the impact and scope of
adverse events?
5. What tools or methodologies are used to support
the impact and scope assessment process?
6. How does the organization ensure that the impact
and scope assessments are accurate and
consistent across different types of adverse
events?
7. Are there mechanisms in place to update the
impact and scope assessments as new
information becomes available?
8. How does the organization use the impact and
scope assessments to prioritize its response and
recovery efforts?
9. Are there clear roles and responsibilities assigned
for assessing the impact and scope of adverse
events?
 NIST CSF 2.0 AUDIT CHECKLIST

DE.AE-06: Information on 1. Does the organization have a process for providing

adverse events is information on adverse events to authorized staff
provided to authorized and tools?
staff and tools 2. How does the organization determine which staff
members and tools are authorized to receive
information on adverse events?
3. What types of information about adverse events
are shared with authorized staff and tools?
4. Are there mechanisms in place to ensure that
sensitive information about adverse events is
appropriately protected and shared only with
authorized parties?
5. How quickly is information about adverse events
made available to authorized staff and tools after
detection?
6. What communication channels or platforms are
used to share information about adverse events
with authorized staff and tools?
7. Are there procedures in place for escalating
information about critical or high-impact adverse
events to appropriate stakeholders?
8. How does the organization ensure that the
information provided about adverse events is
accurate, timely, and actionable?
9. Are there clear roles and responsibilities assigned
for managing and distributing information about
adverse events?
DE.AE-07: Cyber threat 1. Does the organization integrate cyber threat
intelligence and other intelligence and other contextual information into
contextual information its analysis of adverse events?
are integrated into the 2. What sources of cyber threat intelligence and
analysis contextual information does the organization use?
3. How does the organization ensure the reliability
and relevance of the threat intelligence and
contextual information it uses?
4. Are there processes in place to correlate threat
intelligence and contextual information with
observed adverse events?
5. How does the organization use threat intelligence
and contextual information to enhance its
understanding of potential threats and attack
patterns?
6. What tools or technologies are used to support the
integration of threat intelligence and contextual
information into the analysis process?
7. Are there mechanisms in place to update and
refine detection and analysis processes based on
new threat intelligence and contextual
information?
8. How does the organization measure the
effectiveness of integrating threat intelligence and
 NIST CSF 2.0 AUDIT CHECKLIST

contextual information into its analysis

processes?
9. Are there clear roles and responsibilities assigned
for managing and integrating threat intelligence
and contextual information?
DE.AE-08: Incidents are 1. Does the organization have defined criteria for
declared when adverse declaring an incident based on adverse events?
events meet the defined 2. What factors are considered in the incident
incident criteria declaration criteria (e.g., impact, scope, severity,
type of assets affected)?
3. How are the incident declaration criteria
communicated to relevant staff members?
4. Are there documented procedures for evaluating
adverse events against the incident declaration
criteria?
5. How does the organization ensure consistency in
applying the incident declaration criteria across
different types of adverse events?
6. What is the process for declaring an incident once
the defined criteria are met?
7. Are there mechanisms in place to escalate
potential incidents to appropriate decision-
makers for declaration?
8. How quickly are incidents typically declared after
the criteria are met?
9. Are there clear roles and responsibilities assigned
for evaluating adverse events and declaring
incidents?
NIST CSF 2.0 AUDIT CHECKLIST