NIST CSF 2.0 Identify Function: ID.AM, ID.RA, ID.IM

Identify changed more than any other Function between CSF 1.1 and 2.0, and many Current Profiles still score it against the old structure. In CSF 2.0 (NIST CSWP 29, 26 February 2024) governance, risk strategy and supply chain moved out to Govern, while vulnerability scanning, improvement and planning outcomes moved in from Protect, Detect, Respond and Recover. NIST's one-line definition is that the organisation's current cybersecurity risks are understood. This guide works through all 21 Identify Subcategories across Asset Management, Risk Assessment and Improvement, with NIST's Implementation Examples, the 1.1 to 2.0 moves, evidence an assessor should expect, framework mappings and where non-human identities belong in the inventory. It is for risk managers, asset and vulnerability management leads, GRC teams and auditors who already know the CSF basics.

Key takeaways

Identify now has three Categories and 21 Subcategories: ID.AM Asset Management (7), ID.RA Risk Assessment (10) and ID.IM Improvement (4).
Governance left, operations arrived. ID.BE, ID.GV, ID.RM and ID.SC moved to Govern; vulnerability scanning (from DE.CM-08), change and exception risk (from PR.IP-03) and response and recovery plans (from PR.IP-09) now sit in Identify.
Inventories cover services, data and flows. ID.AM-02 names API services and cloud applications, ID.AM-04 covers supplier services and ID.AM-07 adds data inventories, so a hardware list is far from enough.
ID.IM is the improvement engine for the whole CSF. Lessons from evaluations, tests, exercises and operations across all Functions land here, including incident response and contingency plans (ID.IM-04).
Machine identities belong in the inventory. Service accounts, API keys, workload identities and AI agents are part of the "services and systems" ID.AM-02 expects you to know about.

What changed from CSF 1.1

The CSF 2.0 catalogue records where every withdrawn 1.1 outcome went. The moves that matter for Identify are:

CSF 1.1 outcome	Now in CSF 2.0	Effect on an Identify assessment
ID.BE Business Environment, ID.GV Governance, ID.RM Risk Management Strategy	GV.OC, GV.PO, GV.RR, GV.RM	Score these in Govern, not Identify
ID.SC Supply Chain Risk Management	Mostly GV.SC; ID.SC-02 and ID.SC-04 partly to ID.RA-10; ID.SC-05 partly to ID.IM-02	Supplier assessment before acquisition stays in Identify
ID.AM-06 Cybersecurity roles	GV.RR-02, GV.SC-02	Removed from Asset Management
DE.AE-01 Network baseline	ID.AM-03	Data flow baselines are now an inventory outcome
DE.CM-08 Vulnerability scans; PR.IP-12 Vulnerability management plan	ID.RA-01 (and PR.PS-02)	Scanning is evidence for Identify, not Detect
PR.IP-03 Configuration change control	ID.RA-07 (and PR.PS-01)	Change and exception risk assessed in Identify
PR.DS-03, PR.IP-02, PR.IP-06, PR.MA	ID.AM-08 (with PR.PS)	Life cycle, disposal and maintenance join one outcome
RS.AN-05 Vulnerability disclosure processes	ID.RA-08	Disclosure handling is a risk assessment outcome
PR.IP-09 and PR.IP-10 Response and recovery plans, testing	ID.IM-04, ID.IM-02	Plans and their tests are scored here
PR.IP-07, PR.IP-08, RS.IM, RC.IM, DE.DP-03, DE.DP-05	ID.IM-02, ID.IM-03, ID.IM-04	All improvement outcomes consolidated

ID.AM Asset Management

Category statement: assets (data, hardware, software, systems, facilities, services, people) that enable the organisation to achieve business purposes are identified and managed consistent with their relative importance to organisational objectives and the risk strategy. Implementation Examples below are paraphrased from the CSF 2.0 Core; CSWP 29 states that the CSF does not prescribe how outcomes should be achieved, so treat them as illustrations.

Subcategory	Outcome	NIST Implementation Examples (summarised)
ID.AM-01	Inventories of hardware managed by the organisation are maintained	Cover IT, IoT, OT and mobile devices; monitor networks to detect new hardware and update inventories automatically
ID.AM-02	Inventories of software, services and systems managed by the organisation are maintained	Include commercial, open-source and custom software, API services and cloud applications; monitor containers and virtual machines for changes; keep a system inventory
ID.AM-03	Representations of authorised network communication and internal and external data flows are maintained	Baselines of flows within wired and wireless networks, with third parties and for IaaS; document expected ports, protocols and services
ID.AM-04	Inventories of services provided by suppliers are maintained	All external IaaS, PaaS, SaaS, APIs and hosted services; update before a new service is used
ID.AM-05	Assets are prioritised based on classification, criticality, resources and impact on the mission	Define prioritisation criteria per asset class, apply them, review periodically or after significant change
ID.AM-07	Inventories of data and corresponding metadata for designated data types are maintained	List designated data types (PII, PHI, financial account numbers, IP, OT data); discover new instances; tag with classifications; track provenance, owner and geolocation
ID.AM-08	Systems, hardware, software, services and data are managed throughout their life cycles	Security across life cycles; find shadow IT; remove redundant systems; secure before production; update inventories on transfer; destroy data per retention policy and sanitise media on retirement

Note the gap at ID.AM-06: it was withdrawn and the number was not reused. The weak spots in most assessments are ID.AM-03 (flow baselines rarely exist outside regulated network zones) and ID.AM-07 (data inventories are confused with a data classification policy). See the Asset Inventory and CMDB Security Guide and the Data Classification Guide.

ID.RA Risk Assessment

Category statement: the cybersecurity risk to the organisation, assets and individuals is understood by the organisation. This is the largest Identify Category.

Subcategory	Outcome	NIST Implementation Examples (summarised)
ID.RA-01	Vulnerabilities in assets are identified, validated and recorded	Vulnerability scanning for unpatched and misconfigured software; architecture review; testing in-house software; physical assessment of facilities; threat intelligence on new vulnerabilities; review of processes for weaknesses
ID.RA-02	Cyber threat intelligence is received from information sharing forums and sources	Securely ingest intelligence feeds into tools; review advisories on actors and TTPs; track vulnerability types in emerging technologies
ID.RA-03	Internal and external threats are identified and recorded	Know which actors are likely to target you and their TTPs; threat hunting; processes to identify internal threat actors
ID.RA-04	Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded	Business and security estimate likelihood and impact together and record them in risk registers; enumerate impacts of unauthorised access; consider cascading failures
ID.RA-05	Threats, vulnerabilities, likelihoods and impacts are used to understand inherent risk and inform risk response prioritisation	Threat models; prioritise investment by estimated likelihood and impact
ID.RA-06	Risk responses are chosen, prioritised, planned, tracked and communicated	Accept, transfer, mitigate or avoid using plan criteria; select compensating controls; track in a POA&M or risk register; communicate in priority order
ID.RA-07	Changes and exceptions are managed, assessed for risk impact, recorded and tracked	Formal review and approval of changes and exceptions; document risks of making or not making a change and how to roll back; review accepted risks tied to future milestones
ID.RA-08	Processes for receiving, analysing and responding to vulnerability disclosures are established	Share vulnerability information with suppliers under contract rules; assign responsibility for disclosures from suppliers, customers, partners and government
ID.RA-09	The authenticity and integrity of hardware and software are assessed prior to acquisition and use	Assess authenticity and security of critical technology products before acquisition
ID.RA-10	Critical suppliers are assessed prior to acquisition	Supplier risk assessments against business and cybersecurity requirements, including the supply chain

Reading ID.RA as a pipeline

ID.RA-01 to ID.RA-03 gather inputs (vulnerabilities, intelligence, threats), ID.RA-04 and ID.RA-05 turn them into risk, and ID.RA-06 and ID.RA-07 decide and track the response. An organisation with excellent scanning but no likelihood and impact estimates meets ID.RA-01 and fails ID.RA-04 and ID.RA-05. NIST SP 800-30 Rev 1, the Guide for Conducting Risk Assessments, remains the method reference; the scoring method itself should follow the standard method required by GV.RM-06. See the NIST SP 800-30 Risk Assessment Guide, the Risk-Based Vulnerability Management Guide and the Security Exceptions and Risk Acceptance Guide.

ID.IM Improvement

Category statement: improvements to organisational cybersecurity risk management processes, procedures and activities are identified across all CSF Functions. The scope is deliberately cross-Function.

Subcategory	Outcome	NIST Implementation Examples (summarised)
ID.IM-01	Improvements are identified from evaluations	Self-assessments of critical services against current TTPs; third-party assessments or independent audits; automated compliance evaluation
ID.IM-02	Improvements are identified from security tests and exercises, including those with suppliers and relevant third parties	Tabletop exercises, simulations and tests; exercises with critical suppliers; involve executives, legal and HR; penetration testing of high-risk systems; exercise plans for counterfeit or altered products; analyse tool performance metrics
ID.IM-03	Improvements are identified from execution of operational processes, procedures and activities	Lessons learned sessions with suppliers; annual review of policies and procedures for lessons learned; metrics on operational performance over time
ID.IM-04	Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained and improved	Contingency plans (incident response, business continuity, disaster recovery) with contacts, scenarios and escalation criteria; a vulnerability management plan; communicate plans; review annually or when significant improvement is needed

ID.IM-04 surprises many readers: the existence and maintenance of the incident response and recovery plans is an Identify outcome, while their execution is in Respond and Recover. See the NIST CSF 2.0 Recover Function and the Incident Response Plan Template.

Where identity and NHIs fit

Identity outcomes proper sit in Protect (PR.AA-01: identities and credentials for authorised users, services and hardware are managed). Identify decides whether you know those identities exist and how risky they are.

ID.AM-02 and ID.AM-04: inventories of services, API services and supplier services should list the non-human identities that connect them: service accounts, API keys, OAuth applications, workload identities and AI agents, each with an owner. See the NHI Discovery Across Cloud, SaaS, CI/CD and On-Premises Environments.
ID.AM-08 life cycle: identities and credentials need decommissioning like any asset. Microsoft's 2024 incident is the cautionary case: a forgotten test tenant and an OAuth app gave the attacker a path to executive mailboxes.
ID.AM-03 flows: machine-to-machine flows, including calls to third-party APIs, are part of the authorised data flow baseline.
ID.RA-01 and ID.RA-04: over-privileged, unrotated or ownerless credentials are vulnerabilities to record and rate, not just hygiene findings. See the NHI Inventory Reconciliation.

Implementing Identify step by step

Re-baseline the profile: move any 1.1 ID.BE, ID.GV, ID.RM and ID.SC scores to Govern, and pull in evidence for scanning, plans and improvement that used to be scored elsewhere.
Agree asset classes and sources of truth: hardware, software and systems, cloud and SaaS services, data types and non-human identities, with one authoritative source per class and reconciliation between them.
Automate discovery: network, endpoint, cloud API and identity provider discovery feeding the inventory, per the ID.AM-01 and ID.AM-02 examples.
Prioritise assets (ID.AM-05): write criteria linking criticality to business services, then apply them so vulnerability and monitoring effort follows priority.
Join the risk pipeline: connect scanning, threat intelligence and threat records to a risk register with likelihood and impact (ID.RA-01 to ID.RA-05). See the Risk Register Template.
Govern changes and exceptions (ID.RA-07): every exception has an owner, a risk statement and an expiry; review accepted risks tied to future milestones.
Stand up disclosure handling (ID.RA-08): a published route for researchers and a process for supplier advisories. See the Bug Bounty and Vulnerability Disclosure Guide.
Close the loop (ID.IM): one improvement backlog fed by audits, tests, exercises, incidents and operations, reviewed on a fixed cycle.

Small versus large organisations: a small business can meet most of Identify with a spreadsheet inventory exported from its device management and cloud admin consoles, a SaaS list, a short risk register and an annual plan review (NIST's Small Business Quick-Start Guide, SP 1300, is aimed at this case). Large organisations struggle with reconciliation rather than discovery: several tools each hold part of the truth, so measure coverage and conflicts, not tool count.

Evidence and measurement

Subcategory	Weak evidence	Strong evidence
ID.AM-01, ID.AM-02	A CMDB export	Reconciliation reports showing discovered assets matched to inventory, with unknowns triaged
ID.AM-03	A network diagram	Maintained flow baselines with expected ports and protocols, used by monitoring
ID.AM-07	A classification policy	Discovery results showing where designated data types live, with owners
ID.RA-04, ID.RA-05	Scanner severity scores	Risk register entries with business-agreed likelihood and impact
ID.RA-07	A change approval board	Exception register with risk statements, owners and expiry dates reviewed
ID.IM-02	Exercise attendance	Findings from exercises tracked to closure

Metrics that show Identify is working

Inventory coverage: percentage of discovered assets and non-human identities matched to an inventory record with an owner.
Unknown asset dwell time: median days from discovery of an unmanaged asset to triage.
Risk-rated vulnerabilities: percentage of critical findings with a recorded risk response (ID.RA-06).
Expired exceptions: number of exceptions past expiry without renewal.
Improvement throughput: percentage of ID.IM actions closed by due date.

Mapping to other frameworks

For formal crosswalks use NIST's CSF 2.0 Informative References in the CSF 2.0 Reference Tool. This table is an orientation by control purpose.

Identify outcome	SP 800-53 Rev 5 (related)	ISO/IEC 27001:2022 Annex A	CIS Controls v8.1
ID.AM-01, 02, 04	CM-8 System Component Inventory, PM-5 System Inventory, SA-9 External System Services	5.9 Inventory of information and other associated assets	Controls 1, 2 and 15
ID.AM-05	RA-2 Security Categorization, RA-9 Criticality Analysis	5.12 Classification of information	Control 1
ID.AM-07	CM-12 Information Location	5.12, 5.13 Labelling of information	Control 3
ID.RA-01	RA-5 Vulnerability Monitoring and Scanning, CA-8 Penetration Testing	8.8 Management of technical vulnerabilities	Controls 7 and 18
ID.RA-02, 03	PM-16 Threat Awareness Program, SI-5 Security Alerts, Advisories, and Directives, RA-10 Threat Hunting	5.7 Threat intelligence	Not a specific Control
ID.RA-04 to 06	RA-3 Risk Assessment, RA-7 Risk Response	Clauses 6.1.2 and 6.1.3	Not a specific Control
ID.RA-07	CM-3 Configuration Change Control, CM-4 Impact Analyses	8.32 Change management	Control 4
ID.RA-09, 10	SR-11 Component Authenticity, SR-6 Supplier Assessments and Reviews	5.19, 5.21	Control 15
ID.IM-01 to 04	CA-2 Control Assessments, CP-2 Contingency Plan, IR-8 Incident Response Plan, IR-3 Incident Response Testing	Clauses 9 and 10; 5.27	Controls 17 and 18

Common failure patterns

Scoring Identify with the 1.1 model: governance evidence inflates Identify while scanning, exceptions and plans are scored nowhere.
Hardware-only inventories: SaaS, APIs, data stores and machine identities are missing, so ID.AM-02, 04 and 07 are overstated.
Scanner output as risk assessment: CVSS scores without business impact do not meet ID.RA-04 or ID.RA-05.
Exceptions that never expire: ID.RA-07 asks for tracking, and permanent exceptions become invisible risk.
Improvement as a slide: lessons are captured after incidents and exercises but never assigned, dated or closed.
No decommissioning: test tenants, old integrations and their credentials survive because ID.AM-08 is applied to servers only.

Practitioner checklist

Score all 21 Identify Subcategories individually against the 2.0 structure.
Name one source of truth per asset class, including SaaS, data and non-human identities.
Automate discovery and measure unmatched assets weekly.
Write and apply asset prioritisation criteria tied to business services.
Maintain authorised data flow baselines for critical zones and third-party connections.
Record vulnerabilities and threats in a risk register with likelihood, impact and response.
Give every exception an owner, risk statement and expiry date.
Publish a vulnerability disclosure route and assign supplier advisory handling.
Run one improvement backlog fed by audits, tests, exercises and incidents.

NIST CSF 2.0 Identify Function Guide: All 21 Outcomes Explained and Evidenced