Skip to content

Capability index

OCDF

Every capability in the framework, with the document that defines it and the lowest implementation tier that should adopt it. The framework addresses capabilities by ID throughout, so this is the page to come back to whenever a reference like PR-7 or DE-4 appears and you want the detail.

Tier column: E Essential, S Standard, A Advanced. Higher tiers include everything below them, so an S-tier CDC adopts the E rows too. Two S-tier capabilities, DE-2 and PR-8, also have a basic form in Essential; the tier map says which. The NIS2 column marks the capabilities that carry the legal floor: the article or Art. 21(2) point whose minimum they deliver. For an entity in NIS2 scope a marked capability is never "above tier"; do at least its Level 2 form. PR-8 is the one marked capability above Essential, because only its basic form, security requirements when buying or changing critical systems, is part of the floor. See the legal floor and the NIS2 Article 21 crosswalk. On the website, filter by function or by your tier to see just what applies to you.

ID Capability Function Tier NIS2
GV-1 CDC charter & mandate GOVERN E
GV-2 Risk management integration GOVERN S
GV-3 Policy framework GOVERN E 21(2)(a)
GV-4 Roles & accountability GOVERN E
GV-5 Budget & resourcing governance GOVERN S
GV-6 Supply chain risk governance GOVERN E 21(2)(d)
GV-7 Oversight & reporting GOVERN E Art. 20, 21(2)(f)
ID-1 Asset inventory IDENTIFY E 21(2)(i)
ID-2 Data classification IDENTIFY S
ID-3 Crown-jewel analysis IDENTIFY E
ID-4 Vulnerability identification IDENTIFY E 21(2)(e)
ID-5 Threat landscape & intelligence IDENTIFY E
ID-6 Risk assessment IDENTIFY E 21(2)(a)
ID-7 Improvement identification IDENTIFY S
PR-1 Identity & access management PROTECT E 21(2)(i), (j)
PR-2 Awareness & training PROTECT E 21(2)(g)
PR-3 Data security PROTECT E 21(2)(h)
PR-4 Platform hardening & secure configuration PROTECT E 21(2)(g)
PR-5 Vulnerability remediation & patching PROTECT E 21(2)(e)
PR-6 Network security & segmentation PROTECT S
PR-7 Resilient technology infrastructure PROTECT E 21(2)(c)
PR-8 Secure development & change PROTECT S 21(2)(e), basic form
PR-9 Email & web protections PROTECT E 21(2)(g)
DE-1 Log collection & management DETECT E 21(2)(b)
DE-2 Detection engineering DETECT S
DE-3 Alert triage & analysis DETECT E 21(2)(b)
DE-4 Coverage assessment DETECT S
DE-5 Threat hunting DETECT S
DE-6 Detection validation DETECT A
DE-7 Anomaly & integrity monitoring DETECT S
RS-1 Incident response plan RESPOND E 21(2)(b), (j)
RS-2 Playbooks RESPOND E 21(2)(b)
RS-3 Incident analysis & forensics RESPOND S
RS-4 Containment & eradication RESPOND E 21(2)(b)
RS-5 Incident reporting & communication RESPOND E Art. 23
RS-6 Crisis management interface RESPOND E 21(2)(c)
RS-7 Exercises RESPOND E 21(2)(b), (f)
RC-1 Recovery planning RECOVER E 21(2)(c)
RC-2 Trusted restoration RECOVER S
RC-3 Recovery execution & verification RECOVER S
RC-4 Recovery communication RECOVER E
RC-5 Lessons learned & improvement loop RECOVER E
RC-6 Business continuity integration RECOVER S

Open CDC Framework, licensed CC BY 4.0. Generated from the capability tables in the six function documents (Govern through Recover).