Skip to content

IDENTIFY

Objective

Understand what you are defending and what threatens it. Every downstream capability, from detection coverage to response prioritisation and recovery ordering, depends on the quality of this function. An unknown asset cannot be monitored, patched, or restored.

Core capabilities

StandardOCDFFunction from NIST CSF 2.0; the capability breakdown and IDs are this framework's.

ID Capability Description
ID-1 Asset inventory Continuously maintained inventory of hardware, software, cloud resources, data flows, and their owners. Includes shadow-IT discovery.
ID-2 Data classification Data mapped and classified as public, internal, confidential or special-category personal data, with owners assigned.
ID-3 Crown-jewel analysis Identification of business-critical services and the assets they depend on; drives detection and recovery priority.
ID-4 Vulnerability identification Regular authenticated scanning, cloud posture assessment, and external attack-surface monitoring, with internet-facing edge devices listed by name, owner and version. Findings are checked against known-exploited catalogues such as CISA KEV, because known exploitation on an exposed asset predicts real risk better than a CVSS score. Do not depend on the NVD for scores: since April 2026 NIST fully enriches only known-exploited CVEs and software the US government uses or classes as critical, so most new CVEs carry only the score in the CVE record itself, if any. Use that score, vendor advisories and known-exploited catalogues.
ID-5 Threat landscape & intelligence A documented threat profile: which actors, sectors and MITRE ATT&CK techniques are relevant to your organisation. Consume national CSIRT and ENISA advisories. A-tier deep dive on building a full CTI capability: Deep dive: CTI capability.
ID-6 Risk assessment Periodic risk assessments combining assets, threats, and vulnerabilities; results feed GOVERN.
ID-7 Improvement identification Lessons from assessments, audits, exercises and incidents are captured as improvement actions, per CSF 2.0 ID.IM.

CIA mapping

OCDFThis framework's mapping of each capability to confidentiality, integrity and availability.

Capability C I A Rationale
ID-1 Asset inventory ● ● ● Foundation for protecting all objectives.
ID-2 Data classification ● ○ ○ Primarily identifies where Confidentiality matters most, including GDPR special categories.
ID-3 Crown jewels ○ ● ● Business-critical services are usually Availability/Integrity-driven.
ID-4 Vulnerability mgmt ● ● ● Vulnerabilities threaten all three objectives.
ID-5 Threat intel ● ● ● Ransomware threatens A/I; espionage threatens C, so the threat profile tells you which dominates.
ID-6 Risk assessment ● ● ● Rates impact per objective; the output is where each objective's appetite is exceeded.
ID-7 Improvement ○ ○ ○ An enabler: it serves whichever objective the finding concerns.

● primary, ○ secondary or indirect. Rows where all three are ○ are enablers: they protect nothing themselves, but the others depend on them.

Roles & staffing

PractitionerTypical roles from practice. Staffing figures and their arithmetic are under staffing and cost in Operating models.

  • Asset and configuration owners — usually in IT operations.
  • CTI analyst — may be part-time or shared at Level 1–2.
  • Vulnerability analyst — often combined with detection engineering in small teams.
  • Data Protection Officer — for data mapping and GDPR records of processing under Art. 30, which double as excellent data-classification input.

Maturity criteria

OCDFThis framework's criteria. Not a certification standard.

The criteria that score IDENTIFY are kept in one place for all six functions: the maturity self-assessment, IDENTIFY, with the same text in the interactive tool. Its Level 2 criteria include the minimum form of NIS2 Art. 21(2)(a), (e) and (i), marked there; see the NIS2 Article 21 crosswalk. How levels are scored is in the maturity model.

EU regulatory hooks

LawParaphrased from the legal texts. Check the article itself and your national law; not legal advice.

  • NIS2 Art. 21(2)(a), (e) — risk analysis policies and vulnerability handling/disclosure.
  • NIS2 Art. 21(2)(d) — supply chain security requires knowing your suppliers and dependencies, which is an asset and dependency inventory.
  • GDPR Art. 30 — records of processing activities: reuse as data-flow inventory.
  • DORA Art. 8 — identification of ICT-supported business functions and information assets.
  • CRA, the Cyber Resilience Act — relevant when you produce or procure "products with digital elements"; feeds procurement requirements.
  • ENISA Threat Landscape — published annually; a recommended baseline input for the threat profile. The 2026 edition, published in September 2026, covers incidents in 2025.

External dependencies

PractitionerTypical dependencies from experience; yours will differ.

Dependency Party Type Agree up front
Crown-jewel list agreed and signed Business service owners [GATE] Workshop participation; annual re-confirmation
Asset/CMDB data and reconciliation IT operations [HARD] Data quality ownership; reconciliation cadence
Access to cloud tenants and SaaS admin telemetry Platform/cloud teams [HARD] Read access for discovery and posture tools
Data classification decisions Data owners [HARD] Owners named per store; classification deadline
Records of processing under Art. 30 as data-flow input DPO [SOFT] Reuse rather than duplicate

Sources

Open CDC Framework, licensed CC BY 4.0. Credits: References & credits.