NIST CSF 2.0 ID.IM-01: Find Improvements From Evaluations

ID.IM-01 says improvements are identified from evaluations. Self assessments, independent audits and automated compliance checks all produce findings. This outcome checks that the findings turn into changes.

CSF is voluntary guidance. There is no CSF certification, so an evaluation here means your own or an outside party's assessment against requirements you chose.

What good looks like

Evaluations happen on a schedule. Each one produces a list of gaps, each gap has an owner and a date, and the list is reviewed until it closes.

How to implement it

1. Run a self assessment of your critical services at least yearly, using current threats as the lens.
2. Consider a third party assessment for the highest risk areas.
3. Automate checks where possible, such as continuous tests of cloud settings against your chosen controls.
4. Put every finding in one tracker with severity, owner and due date.
5. Review the tracker monthly and report progress to leadership.

A worked example

A company runs a self assessment against the CSF outcomes it chose to prioritize. The result is 31 gaps. The security lead sorts them by impact on critical services and picks the top eight for the next quarter, each with an owner and a date. The other 23 are logged with a target quarter. At the next review, five of eight are done, two slipped with reasons recorded, and one was reclassified. Leadership can see progress, and the next assessment starts from a known position rather than a blank page.

Evidence to collect

• Assessment reports with dates.
• The findings tracker with status history.
• Meeting notes showing review.

Common gaps

• Findings live in a PDF, not a tracker.
• The same finding appears in three consecutive years.
• Automated results exist but nobody triages them.

Quick check

Sources

• NIST, The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29: https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf