What it asks for. This Identify category in CSF 2.0 asks the organisation to identify improvements to its cybersecurity risk management processes, procedures and activities across all functions. ID.IM-02 focuses on improvements found through security tests and exercises, including those done with suppliers.
In practice. Findings from penetration tests, tabletop exercises, red team work, audits and incidents are captured in a single improvement backlog with owners and due dates. Lessons learned are fed back into plans, playbooks and controls, and progress is reviewed by management. Evidence includes exercise and test reports, improvement registers and records showing actions were completed.
Common gaps. Exercises are often run but their findings are not tracked to closure. Improvements stay within the team that ran the test, so organisation wide processes do not change.