NIST CSF 2.0 Identify Function: Assets, Risk & Improvement

What the Identify Function Covers

Knowing what you have (assets, data, suppliers' services), understanding cybersecurity risk to the organization, assets, and individuals, and feeding improvements across all six Functions from evaluations, tests, and operations.

Identify Categories (Official CSF 2.0)

Source: NIST CSWP 29, Table 1 / Appendix A — 3 Categories.

Why Identify Matters

Broken asset inventory breaks every downstream Function. ID.RA is where threat intelligence, vulnerabilities, likelihood/impact, and risk response live. ID.IM is the formal path from lessons learned (tests, exercises, incidents) into the backlog — including improvements that CSF 1.1 sometimes parked under Recover.

How CyberSilo Helps Operationalize Identify

• ThreatHawk SIEM — discovery and telemetry supporting ID.AM; vulnerability and threat context into ID.RA
• Compliance Standards Automation — Current Profile scoring on ID Subcategories; track ID.IM improvement actions
• ThreatSearch TIP — threat feeds that support ID.RA-style threat identification and prioritization
• Agentic SOC AI — triage signals that feed risk prioritization; not a substitute for an asset CMDB

Frequently Asked Questions

Where did Business Environment (ID.BE) go in CSF 2.0?

Organizational context outcomes were largely restructured under Govern as GV.OC. Use CSF 2.0 Category IDs (ID.AM, ID.RA, ID.IM) for Identify — not CSF 1.1 labels such as ID.BE.

Is ID.SC still an Identify Category?

No. In CSF 2.0, cybersecurity supply chain risk management is primarily under Govern as GV.SC. Identify has three Categories: ID.AM, ID.RA, and ID.IM.

How many Identify Categories are in CSF 2.0?

Three: Asset Management (ID.AM), Risk Assessment (ID.RA), and Improvement (ID.IM), per NIST CSWP 29 Table 1.

Related CSF 2.0 Function Guides

Govern · Protect · Detect · Respond · Recover