What it asks for. The Identify function asks organisations to understand their current cybersecurity risks. It covers asset management, risk assessment and improvement, giving the basis for prioritising effort in line with the risk strategy set under Govern.
In practice. A mature organisation keeps current inventories of hardware, software, services, data and suppliers, with owners and criticality ratings. Vulnerabilities, threats, likelihood and impact are assessed, and risk responses are prioritised and tracked. Improvements are identified from assessments, exercises and incidents. Evidence includes asset and data inventories, data flow maps, risk assessments, a risk register with treatment plans, and records of lessons learned feeding back into the programme.
Common gaps. Common gaps are incomplete inventories, especially for cloud, SaaS and shadow IT, and risk assessments done once rather than maintained. Improvement actions are often captured but not tracked to closure.