What it asks for. This Identify category asks the organisation to understand the cybersecurity risk to the organisation, its assets and individuals. It covers identifying and recording vulnerabilities in assets, using threat intelligence, identifying threats, assessing likelihood and impact, and prioritising responses.
In practice. Vulnerability scanning and other assessments feed a risk process that weighs threat, likelihood and business impact. Threat intelligence is consumed and applied to the organisation's own technology, and risk assessments are repeated when significant changes occur. Results drive prioritised treatment plans with owners. Evidence includes vulnerability reports, risk assessments, threat intelligence summaries and the resulting treatment decisions.
Common gaps. Risk assessments are often generic and not linked to real vulnerability or threat data. Vulnerability lists are produced without business context, which makes prioritisation difficult.