NIST CSF 2.0 RS.AN-08: Estimate Incident Magnitude

RS.AN-08 says an incident's magnitude is estimated and validated. Early on, you do not know how far an attacker got. This outcome asks you to produce a working estimate of scope, then test it by looking for the same signs of compromise elsewhere. The estimate drives decisions on notification, containment and resourcing. No CSF certification exists.

What good looks like

Within the first hours, the incident lead writes down what is known: affected systems, accounts and data types, plus what is unknown. Then the team checks other likely targets for indicators of compromise and persistence, such as new accounts, scheduled tasks, unfamiliar keys and odd outbound connections. The estimate is revised as findings arrive and the final scope is signed off.

How to implement it

• Keep a scope table in the incident document: system, evidence of compromise, status, confidence.
• Build a short list of indicators from the first compromised host or account.
• Search for those indicators across all endpoints, cloud accounts and code repositories. Automate the search with your endpoint tool or log queries.
• Look for persistence: new credentials, API keys, OAuth grants, startup items and scheduled jobs.
• Rate magnitude with a simple scale agreed beforehand, such as number of systems and sensitivity of data.
• Have a second person review the estimate before you communicate it outside the team.

A worked example

A malicious script is found on one developer laptop. The first scope estimate says one machine. The lead extracts three indicators: a file hash, a scheduled task name and an outbound domain. An endpoint query across all laptops finds the task on two more machines. A cloud audit search finds a new access key created from the first laptop's session. The estimate grows to three machines and one cloud account, and the key is revoked. The revised estimate is reviewed and signed off before leadership is briefed.

Evidence to collect

• The scope table with revision history.
• Search queries and their results.
• The severity scale.
• The sign off from the incident lead.

Common gaps

Scope stops at the first machine found. Persistence checks are skipped. The estimate is given to leadership without validation and then corrected loudly. No agreed scale exists, so every incident is argued from scratch.

Quick check

Sources

• NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29: https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
• NIST CSF 2.0 Reference Tool and implementation examples: https://csrc.nist.gov/Projects/Cybersecurity-Framework/Filters#/csf/filters