NIST CSF 2.0 ID.IM-03: Improve From Daily Operations

ID.IM-03 says improvements are identified from execution of operational processes, procedures, and activities. Your own routine work is a source of evidence. If patching always runs late or access requests always stall, the process needs a fix, and the data to prove it is already in your tools.

CSF is voluntary guidance. There is no CSF certification.

What good looks like

After significant events you hold a short lessons learned session, with suppliers where relevant. Policies and procedures are reviewed at least once a year with those lessons in hand. A few metrics are tracked over time and discussed.

How to implement it

1. Pick four or five operational metrics: time to patch critical issues, time to revoke access after offboarding, share of assets in the inventory with an owner, incident time to contain.
2. Record them monthly in one place.
3. After every real incident or near miss, hold a thirty minute review and log changes.
4. Schedule an annual review of each policy and procedure, with edits tracked.
5. Invite key suppliers to review sessions after joint incidents.

A worked example

Patch times are tracked monthly. In March the median time to patch critical issues is nineteen days against a target of seven. A short review shows that fixes wait for a weekly release train. The team adds an out of cycle release path for critical fixes and records the change. By June the median is five days. The improvement came from reading an operational metric, not from an incident, which is the point of the outcome.

Evidence to collect

• The metrics history.
• Lessons learned notes with actions.
• Policy version history showing annual review.

Common gaps

• Metrics measure volume, such as alerts handled, not outcomes.
• Reviews are scheduled and skipped.
• Policy edits never trace back to a lesson.

Quick check

Sources

• NIST, The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29: https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf