id: "RA-03(04)" title: "Predictive Cyber Analytics" family: "RA" family_name: "Risk Assessment" sort_id: "ra-03.04" priority: "P1" implementation_level: "organization" parent: "RA-03" enhancement: True
Statement
Employ the following advanced automation and analytics capabilities to predict and identify risks to {{ insert: param, ra-03.04_odp.02 }}: {{ insert: param, ra-3.4_prm_2 }}.
Guidance
A properly resourced Security Operations Center (SOC) or Computer Incident Response Team (CIRT) may be overwhelmed by the volume of information generated by the proliferation of security tools and appliances unless it employs advanced automation and analytics to analyze the data. Advanced automation and analytics capabilities are typically supported by artificial intelligence concepts, including machine learning. Examples include Automated Threat Discovery and Response (which includes broad-based collection, context-based analysis, and adaptive response capabilities), automated workflow operations, and machine assisted decision tools. Note, however, that sophisticated adversaries may be able to extract information related to analytic parameters and retrain the machine learning to classify malicious activity as benign. Accordingly, machine learning is augmented by human monitoring to ensure that sophisticated adversaries are not able to conceal their activities.
Assessment Objective: {{ insert: param, ra-03.04_odp.01 }} are employed to predict and identify risks to {{ insert: param, ra-03.04_odp.02 }};
Assessment Objective: {{ insert: param, ra-03.04_odp.03 }} are employed to predict and identify risks to {{ insert: param, ra-03.04_odp.02 }}.
Risk assessment policy
security planning policy and procedures
procedures addressing organizational assessments of risk
risk assessment
risk assessment results
risk assessment reviews
risk assessment updates
risk reports
system security plan
other relevant documents or records
Organizational personnel with risk assessment responsibilities
organizational personnel with security responsibilities
Organizational processes for risk assessment
mechanisms supporting and/or conducting, documenting, reviewing, disseminating, and updating the risk assessment