PDF 轉 Markdown

## Appendix A. CSF Core This appendix describes the Functions, Categories, and Subcategories of the CSF Core. Table 1 lists the CSF 2.0 Core Function and Category names and unique alphabetic identifiers. Each Function name in the table is linked to its portion of the appendix. The order of Functions, Categories, and Subcategories of the Core is not alphabetical; it is intended to resonate most with those charged with operationalizing risk management within an organization. The numbering of the Subcategories is intentionally not sequential; gaps in numbering indicate CSF 1.1 Subcategories that were relocated in CSF 2.0. **Table 1. CSF 2.0 Core Function and Category names and identifiers** |  Function | Category | Category Identifier  || --- | --- | --- ||  **Govern (GV)** | Organizational Context | GV.OC  ||   |  Risk Management Strategy | GV.RM  ||   |  Roles, Responsibilities, and Authorities | GV.RR  ||   |  Policy | GV.PO  ||   |  Oversight | GV.OV  ||   |  Cybersecurity Supply Chain Risk Management | GV.SC  ||  **Identify (ID)** | Asset Management | ID.AM  ||   |  Risk Assessment | ID.RA  ||   |  Improvement | ID.IM  ||  **Protect (PR)** | Identity Management, Authentication, and Access Control | PR.AA  ||   |  Awareness and Training | PR.AT  ||   |  Data Security | PR.DS  ||   |  Platform Security | PR.PS  ||   |  Technology Infrastructure Resilience | PR.IR  ||  **Detect (DE)** | Continuous Monitoring | DE.CM  ||   |  Adverse Event Analysis | DE.AE  |