# How items are categorised

Every knowledge base item can be filed against a standard taxonomy, so a
knowledge base of a few thousand items stays navigable and questions about the
same control sit together.

The taxonomy has two levels: **areas** at the top, each containing a set of
**categories**.

## Where the taxonomy comes from

It is derived from the [NIST Cybersecurity Framework 2.0](https://www.nist.gov/cyberframework),
whose six functions — Govern, Identify, Protect, Detect, Respond, and Recover —
form the first six areas, along with their categories and codes.

Two further areas cover ground that security questionnaires ask about but the
framework does not: **Application**, for questions about the software you
provide, and **AI**, for questions about how you use AI responsibly.

## How items are assigned

**On import.** **Auto categorize items** is switched on by default when you
[import from CSV](/knowledge-base/importing-from-csv/), so imported items are
filed as they arrive.

**When you create an item by hand.** ResponseHub suggests an area and category
from the question as you write it. You can accept the suggestion or pick your own.

You can change the area and category on any item at any time.

**Framework codes are a separate thing:** The taxonomy is how ResponseHub organises your knowledge base. The `framework`
and `code` columns on an imported item record which external framework a question
*came from*. The two are independent — an item can have both.

## The taxonomy

| Area | Covers | Categories |
|---|---|---|
| **Govern** (`GV`) | Cybersecurity risk management strategy, expectations, and policy | `GV.OC` Organizational Context<br />`GV.RM` Risk Management Strategy<br />`GV.RR` Roles, Responsibilities, and Authorities<br />`GV.PO` Policy<br />`GV.OV` Oversight<br />`GV.SC` Cybersecurity Supply Chain Risk Management |
| **Identify** (`ID`) | Current cybersecurity risks are understood | `ID.AM` Asset Management<br />`ID.RA` Risk Assessment<br />`ID.IM` Improvement |
| **Protect** (`PR`) | Safeguards to manage cybersecurity risks | `PR.AA` Identity Management, Authentication, and Access Control<br />`PR.AT` Awareness and Training<br />`PR.DS` Data Security<br />`PR.PS` Platform Security<br />`PR.IR` Technology Infrastructure Resilience |
| **Detect** (`DE`) | Cybersecurity attacks and compromises are found and analyzed | `DE.CM` Continuous Monitoring<br />`DE.AE` Adverse Event Analysis |
| **Respond** (`RS`) | Actions regarding detected cybersecurity incidents are taken | `RS.MA` Incident Management<br />`RS.AN` Incident Analysis<br />`RS.CO` Incident Response Reporting and Communication<br />`RS.MI` Incident Mitigation |
| **Recover** (`RC`) | Assets and operations affected by cybersecurity incidents are restored | `RC.RP` Incident Recovery Plan Execution<br />`RC.CO` Incident Recovery Communication |
| **Application** (`APP`) | Information relating to the applications provided by the organisation | — |
| **AI** (`AI`) | How the organisation uses AI responsibly | — |

Area names, category names, and their descriptions are taken from NIST CSF 2.0
and use American spelling, as the framework does.

## Next steps

- [Importing from CSV](/knowledge-base/importing-from-csv/)
- [Knowledge base items](/knowledge-base/knowledge-base-items/)