DE.AE-04 says the estimated impact and scope of adverse events are understood. When something suspicious happens, the first questions are how many systems, which data, and how bad. This outcome asks you to have a way to answer them fast, and to refine the answer as facts arrive.
CSF is voluntary guidance. There is no CSF certification.
What good looks like
Your asset inventory tells you what a compromised host or account can reach and what data it holds. Tools help estimate scope, and a person can also make a reasoned estimate. Estimates are written down, reviewed, and updated as the investigation continues.
How to implement it
- Keep an inventory that links systems to data types and business owners.
- Create a short impact worksheet: affected assets, data involved, users affected, business processes interrupted, and a rating of low, medium, or high.
- Use log searches to widen or narrow scope: other hosts that touched the same indicator, other accounts from the same source.
- Record the first estimate and every revision with a timestamp.
- Feed the estimate into the incident decision under DE.AE-08.
A worked example
Security tooling flags a laptop that ran a suspicious script. A quick look at the inventory shows the laptop belongs to an engineer with access to the source code repositories and a cloud console. A log search for the same file hash finds it on one other machine. The analyst writes the first estimate: two devices, possible exposure of source code and cloud credentials, risk high. Over the next hour the cloud audit log shows no unusual console activity from the engineer's account, and the estimate is revised: credentials likely not used, scope limited to two devices, risk medium, with a note to rotate credentials anyway.
That sequence is exactly what the outcome asks for: a first estimate based on available facts, then refinement as more is learned.
Make the inventory do the work
The fastest way to understand impact is to know what each asset connects to and what it holds. Add three fields to your inventory: the data classification, the business owner, and the systems it connects to. During an event, those fields answer most scope questions in seconds.
Estimates are allowed to change
Do not wait for certainty before writing something down. A rough, honest estimate with a timestamp is more useful than silence. Each update should state what changed and why. Those notes later become the backbone of the post incident review.
Evidence to collect
- Blank and completed impact worksheets.
- Inventory fields linking assets to data.
- Examples of estimates revised during real or practice events.
Common gaps
No link between assets and data, so scope is a guess. Estimates held in someone's head. A single initial figure that is never updated.
Quick check
Can a person estimate impact without special tools?
Yes. NIST lists a person creating their own estimates as an acceptable approach. Write it down and revise it as facts arrive.
Sources
- NIST Cybersecurity Framework 2.0 (NIST CSWP 29), DE.AE-04 and its implementation examples.
