Framework Category

Improvement

Improvement focuses on continuously enhancing cybersecurity capabilities by learning from evaluations, testing, operations, and real-world incidents.

It ensures that response plans and procedures are regularly updated and refined, incorporating lessons learned and adapting to changing conditions.

Implementation Questions

ID.IM-01

Improvements are identified from evaluations

Does your organization regularly conduct self-assessments of critical services that incorporate current threat intelligence and adversary tactics, techniques, and procedures (TTPs)?

Regular self-assessments help identify vulnerabilities in critical services before they can be exploited by threat actors using current attack methods.

Has your organization conducted third-party assessments or independent audits of your cybersecurity program within the past 12 months?

Independent assessments provide an objective evaluation of your cybersecurity program's effectiveness, identifying blind spots that internal teams might miss.

Does your organization utilize automated tools or systems to continuously evaluate compliance with your established cybersecurity requirements?

Automated compliance monitoring tools can continuously scan systems, networks, and applications to verify adherence to security policies, standards, and regulatory requirements without manual intervention. These solutions can include security information and event management (SIEM) systems, compliance scanning tools, configuration management databases, or custom scripts that regularly check system settings against baselines.

ID.IM-02

Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties

Does your organization have a process to identify and implement improvements to incident response procedures based on findings from exercises, tests, and reviews?

Continuous improvement is the concern here: whether you have a process to fold findings from exercises, tests, and reviews back into stronger incident response procedures.

Does your organization have a formal process to identify and implement improvements to business continuity, disaster recovery, and incident response plans based on exercises conducted with critical service providers and suppliers?

Learning from resilience exercises is the concern: whether you systematically improve continuity, disaster recovery, and incident response plans based on tests run with critical providers and suppliers. Organizations should conduct joint exercises with critical vendors and suppliers, document findings, and implement identified improvements to ensure coordinated response capabilities during actual disruptions.

Does your organization involve internal stakeholders (such as senior executives, legal, and HR) in security tests and exercises?

Including key internal stakeholders in security tests and exercises ensures broader organizational awareness and buy-in for security initiatives.

Does your organization conduct penetration testing on high-risk systems with leadership approval?

Penetration testing involves simulating real-world attacks to identify vulnerabilities in high-risk systems before malicious actors can exploit them. These tests should be conducted on systems that contain sensitive data or are critical to operations, with proper authorization from leadership to ensure awareness and support of the testing activities.

Has your organization tested its contingency plans for responding to and recovering from supply chain compromise incidents where products or services were found to be counterfeit or tampered with?

Supply chain incident readiness is being probed here, namely whether you have tested contingency plans for responding to and recovering from counterfeit or tampered products and services. Such exercises help verify that your organization can effectively detect, respond to, and recover from supply chain compromises that could introduce vulnerabilities or malicious code into your systems.

Does your organization collect and analyze security performance metrics to drive improvements to your cybersecurity program?

Measuring to improve is the subject here, specifically whether you collect and analyze security performance metrics and use them to strengthen your cybersecurity program. Performance metrics might include mean time to detect/respond to incidents, vulnerability remediation times, security tool coverage, or false positive rates from security monitoring tools.

ID.IM-03

Improvements are identified from execution of operational processes, procedures, and activities

Does your organization conduct formal lessons learned sessions with suppliers after significant projects or security incidents?

Collaborative lessons learned sessions with suppliers help identify areas for improvement in security practices, communication, and incident response. These sessions can reveal vulnerabilities in the supply chain, enhance supplier relationships, and lead to improved security controls across organizational boundaries.

Does your organization conduct an annual review of cybersecurity policies, processes, and procedures that incorporates lessons learned from incidents and operational experiences?

Regular reviews of cybersecurity documentation ensure that security practices remain current, effective, and aligned with evolving threats and business needs.

Does your organization use metrics to track and evaluate cybersecurity performance over time?

Cybersecurity metrics provide quantifiable data to assess the effectiveness of security controls, identify trends, and make informed decisions about resource allocation and risk management. Examples include number of security incidents, mean time to detect/respond, patch management compliance rates, and security training completion percentages.

ID.IM-04

Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved

Has your organization established and documented contingency plans for incident response, business continuity, and disaster recovery to address adverse events?

Contingency plans are essential for organizations to effectively respond to and recover from security incidents, service disruptions, or disasters that could impact operations or expose sensitive data. These plans should include defined procedures for incident detection, response protocols, recovery strategies, and communication workflows to minimize downtime and data loss.

Do your contingency plans include comprehensive contact information, communication procedures, scenario handling processes, and clear criteria for prioritization, escalation, and elevation?

Effective contingency plans must include detailed contact information for all key personnel, specific communication channels and procedures, documented processes for handling common scenarios, and clear criteria for when to prioritize, escalate or elevate issues. Without these elements, organizations risk delayed responses, miscommunication, and inconsistent handling of incidents during critical situations.

Has your organization implemented a formal vulnerability management plan that includes identification, assessment, prioritization, and remediation processes?

A vulnerability management plan is essential for systematically identifying and addressing security weaknesses across your systems and applications. This plan should outline processes for discovering vulnerabilities through scanning tools, assessing their severity based on potential impact, prioritizing fixes based on risk levels, and implementing appropriate remediation measures.

Does your organization have a process to communicate cybersecurity plans and updates to responsible personnel and affected stakeholders?

Effective cybersecurity implementation requires clear communication of plans and updates to ensure all responsible parties understand their roles and affected stakeholders are aware of changes that may impact them. Without proper communication, even well-designed security plans may fail due to inconsistent implementation or resistance from uninformed stakeholders.

Does your organization have a documented process for reviewing and updating cybersecurity plans at least annually or when significant improvements are needed?

Regular reviews of cybersecurity plans ensure they remain effective against evolving threats and align with organizational changes. Without systematic reviews, security controls may become outdated, creating vulnerabilities that could be exploited by attackers. This question assesses whether your organization has formalized the cadence and triggers for updating critical security documentation.