NIST Incident Response (800-61 Rev. 3)
106 CSF 2.0 outcomes with published incident-response priorities and profile guidance
All available frameworksWhat the app checks
Technical checks run for the selected scope, available connectors and credentials. Results provide evidence for review; missing data is not a pass.
Explicit requirement-to-test mappings
| Requirement | Collector / test | What it checks or supports |
|---|---|---|
| ID.RA-01 | VULN / VULN-IMPORT-001 | Supporting scoped observation only. Reconcile the selected program population, incident/exercise or supplier/product context, dates and full review action. No automatic conformity or control equivalence. |
| PR.AA-05 | ADSEC / AD-PRIV-001 | Supporting scoped observation only. Reconcile the selected program population, incident/exercise or supplier/product context, dates and full review action. No automatic conformity or control equivalence. |
| PR.AA-03 | ENTRA / ENTRA-MFA-REG-001 | Supporting scoped observation only. Reconcile the selected program population, incident/exercise or supplier/product context, dates and full review action. No automatic conformity or control equivalence. |
| PR.DS-01 | STORAGE / STOR-AT-REST-ENCRYPTION-001 | Supporting scoped observation only. Reconcile the selected program population, incident/exercise or supplier/product context, dates and full review action. No automatic conformity or control equivalence. |
| PR.DS-02 | CERTTLS / CERTTLS-POSTURE-001 | Supporting scoped observation only. Reconcile the selected program population, incident/exercise or supplier/product context, dates and full review action. No automatic conformity or control equivalence. |
| PR.PS-01 | WINDOWS / WIN-SMB1-001 | Supporting scoped observation only. Reconcile the selected program population, incident/exercise or supplier/product context, dates and full review action. No automatic conformity or control equivalence. |
| PR.PS-05 | WINDOWS / WIN-AV-001 | Supporting scoped observation only. Reconcile the selected program population, incident/exercise or supplier/product context, dates and full review action. No automatic conformity or control equivalence. |
| PR.IR-01 | WINDOWS / WIN-FW-001 | Supporting scoped observation only. Reconcile the selected program population, incident/exercise or supplier/product context, dates and full review action. No automatic conformity or control equivalence. |
| PR.DS-11 | BACKUP / VEEAM-REPO-001 | Supporting scoped observation only. Reconcile the selected program population, incident/exercise or supplier/product context, dates and full review action. No automatic conformity or control equivalence. |
What requires manual review
Confirm scope and applicability, review the requirement guidance, collect policies and records, conduct interviews or observations where needed, and assess evidence relevance and freshness. Record owners, rationale, workpaper conclusions and remediation. An assessor makes the final decision; a technical pass does not approve the whole framework.
Incident-response preparation and evidence review; no certification, automatic incident containment or statutory reporting determination.
Where it is available
This preparation framework is listed in the C32 Professional/MSP application catalog. Free retains its ISO assessment limits. Availability of a framework is separate from the extent of automated scanning.
Coverage shown here comes from the application’s C32 requirement and mapping catalogs.