ID.RA-01 reads: "Vulnerabilities in assets are identified, validated, and recorded". Evidence has three parts: scan or advisory output that identifies, triage notes that validate, and a tracker entry that records. If one part is missing, the outcome is only partly shown.
The three verbs
NIST CSF 2.0 was published in February 2024 as NIST CSWP 29. Subcategory ID.RA-01 sits under the Identify function, in the Risk Assessment category, and its text is: "Vulnerabilities in assets are identified, validated, and recorded".
Each verb asks for something different. Identify means you look. Validate means someone checks the finding is real and relevant to your asset. Record means the result is written somewhere that persists. CSF subcategories are outcomes, and the framework does not prescribe how to reach them, so you pick the artifacts.
Mapping the verbs to artifacts
| Verb | Engineering artifact | Detail to keep |
|---|---|---|
| Identified | Dependency, container and code scan results; advisory feed matches | Date, scope, tool version |
| Validated | Triage note: reachable or not, exploitable or not, affected version confirmed | Who decided and on what basis |
| Recorded | Tracker item or register entry | Owner, severity, status, due date |
A scan export with no triage shows identification only. A tracker full of items with no validation notes shows recording without analysis. The strongest story is a few real findings traced through all three.
Steps to show the full chain
- Define the asset scope: repositories, images and services from your inventory.
- Run scans on a schedule and on pull requests, and store the dated output.
- Subscribe to advisories for key components and log what you receive.
- Triage each finding: affected version, whether the vulnerable code is used, whether a fix exists.
- Record the decision, including no action with a reason.
- Review open items on a regular rhythm and keep the minutes or a dated export.
Step 5 matters. A recorded decision not to act, with an expiry date, is a legitimate outcome and shows the process is thinking.
Related subcategories
ID.RA-01 neighbors others in the same category. ID.RA-05 uses threats, vulnerabilities, likelihoods and impacts to prioritize risk response. ID.RA-06 covers choosing, planning and tracking risk responses. ID.RA-08 covers receiving and responding to vulnerability disclosures. One well kept tracker can serve all four if it carries priority, owner and status.
Try it yourself
Step through the vulnerability management demo and watch a finding move from detected to triaged to tracked. Those are the identify, validate and record stages.
Click through it at your own pace, or open it full screen.
Where Safeguard fits
Safeguard offers dependency scanning, reachability analysis and compliance and evidence automation, which can produce dated finding records and framework mapped evidence. Fix PRs are off by default, with every category on Manual. You can try the free scan at gold.safeguard.sh/scan. Mapping is a starting point, not a verdict on compliance.
Quick check
Is a scan report enough for ID.RA-01?
It shows identification. Validation and recording need triage notes and a persistent record, so add those.
Does CSF 2.0 require a specific scanner?
No. Subcategories describe outcomes. You choose the methods and show they produce the outcome.
Sources
Last reviewed: 19 October 2026.
