CISA Cyber Resilience Review (CRR) v4.0
CISA's Cyber Resilience Review: the 42 goals and their practices across ten domains that an organisation is assessed against for one critical service, from asset and controls management through change, vulnerability, incident and continuity management to risk, external dependencies, training and situational awareness, scored on the six-level MIL scale.
CISA Cyber Resilience Review (CRR) v4.0 is a compliance framework from United States with 10 domains and 42 controls. The largest domains are Asset Management – CISA Cyber Resilience Review (CRR) v4.0 (7 controls), External Dependencies Management – CISA Cyber Resilience Review (CRR) v4.0 (5 controls), Incident Management – CISA Cyber Resilience Review (CRR) v4.0 (5 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (10)
Asset Management – CISA Cyber Resilience Review (CRR) v4.0
| Code | Title |
|---|---|
| cisa-cyber-resilience-review::AM.1 | Services are identified and prioritised |
| cisa-cyber-resilience-review::AM.2 | Assets are inventoried with authority and responsibility established |
| cisa-cyber-resilience-review::AM.3 | The relationship between assets and the services they support is established |
| cisa-cyber-resilience-review::AM.4 | The asset inventory is managed |
| cisa-cyber-resilience-review::AM.5 | Access to assets is managed |
| cisa-cyber-resilience-review::AM.6 | Information assets are categorised and managed for sustainment and protection |
| cisa-cyber-resilience-review::AM.7 | Facility assets supporting the critical service are prioritised and managed |
Configuration and Change Management – CISA Cyber Resilience Review (CRR) v4.0
| Code | Title |
|---|---|
| cisa-cyber-resilience-review::CCM.1 | The lifecycle of assets is managed |
| cisa-cyber-resilience-review::CCM.2 | The integrity of technology and information assets is managed |
| cisa-cyber-resilience-review::CCM.3 | Asset configuration baselines are established |
Controls Management – CISA Cyber Resilience Review (CRR) v4.0
| Code | Title |
|---|---|
| cisa-cyber-resilience-review::CM.1 | Control objectives are established |
| cisa-cyber-resilience-review::CM.2 | Controls are implemented |
| cisa-cyber-resilience-review::CM.3 | Control designs are analysed to ensure they satisfy control objectives |
| cisa-cyber-resilience-review::CM.4 | The internal control system is assessed to ensure control objectives are met |
External Dependencies Management – CISA Cyber Resilience Review (CRR) v4.0
| Code | Title |
|---|---|
| cisa-cyber-resilience-review::EDM.1 | External dependencies are identified and prioritised to ensure operation of high-value services |
| cisa-cyber-resilience-review::EDM.2 | Risks due to external dependencies are identified and managed |
| cisa-cyber-resilience-review::EDM.3 | Relationships with external entities are formally established and maintained |
| cisa-cyber-resilience-review::EDM.4 | Performance of external entities is managed |
| cisa-cyber-resilience-review::EDM.5 | Dependencies on public services and infrastructure service providers are identified |
Incident Management – CISA Cyber Resilience Review (CRR) v4.0
| Code | Title |
|---|---|
| cisa-cyber-resilience-review::IM.1 | A process for identifying, analysing, responding to and learning from incidents is established |
| cisa-cyber-resilience-review::IM.2 | A process for detecting, reporting, triaging and analysing events is established |
| cisa-cyber-resilience-review::IM.3 | Incidents are declared |
| cisa-cyber-resilience-review::IM.4 | A process for responding to and recovering from incidents is established |
| cisa-cyber-resilience-review::IM.5 | Post-incident lessons learned are translated into improvement strategies |
Risk Management – CISA Cyber Resilience Review (CRR) v4.0
| Code | Title |
|---|---|
| cisa-cyber-resilience-review::RM.1 | A strategy for identifying, analysing and mitigating risks is developed |
| cisa-cyber-resilience-review::RM.2 | Risk tolerances are identified and the focus of risk management activities is established |
| cisa-cyber-resilience-review::RM.3 | Risks are identified |
| cisa-cyber-resilience-review::RM.4 | Risks are analysed and assigned a disposition |
| cisa-cyber-resilience-review::RM.5 | Risks to assets and services are mitigated and controlled |
Service Continuity Management – CISA Cyber Resilience Review (CRR) v4.0
| Code | Title |
|---|---|
| cisa-cyber-resilience-review::SCM.1 | Service continuity plans for high-value services are developed |
| cisa-cyber-resilience-review::SCM.2 | Service continuity plans are reviewed to resolve conflicts between plans |
| cisa-cyber-resilience-review::SCM.3 | Service continuity plans are tested to ensure they meet their stated objectives |
| cisa-cyber-resilience-review::SCM.4 | Service continuity plans are executed and reviewed |
Situational Awareness – CISA Cyber Resilience Review (CRR) v4.0
| Code | Title |
|---|---|
| cisa-cyber-resilience-review::SA.1 | Threat monitoring is performed |
| cisa-cyber-resilience-review::SA.2 | The requirements for communicating threat information are established |
| cisa-cyber-resilience-review::SA.3 | Threat information is communicated |
Training and Awareness – CISA Cyber Resilience Review (CRR) v4.0
| Code | Title |
|---|---|
| cisa-cyber-resilience-review::TA.1 | Cybersecurity awareness and training programmes are established |
| cisa-cyber-resilience-review::TA.2 | Awareness and training activities are conducted |
Vulnerability Management – CISA Cyber Resilience Review (CRR) v4.0
| Code | Title |
|---|---|
| cisa-cyber-resilience-review::VM.1 | Preparation for vulnerability analysis and resolution |
| cisa-cyber-resilience-review::VM.2 | A process for identifying and analysing vulnerabilities is established and maintained |
| cisa-cyber-resilience-review::VM.3 | Exposure to identified vulnerabilities is managed |
| cisa-cyber-resilience-review::VM.4 | The root causes of vulnerabilities are addressed |
What is CISA Cyber Resilience Review (CRR) v4.0 and who does it apply to?
CISA Cyber Resilience Review (CRR) v4.0 is a compliance framework from United States with 10 domains and 42 controls. CISA's Cyber Resilience Review: the 42 goals and their practices across ten domains that an organisation is assessed against for one critical service, from asset and controls management through change, vulnerability, incident and continuity management to risk, external dependencies, training and situational awareness, scored on the six-level MIL scale. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does CISA Cyber Resilience Review (CRR) v4.0 actually require?
CISA Cyber Resilience Review (CRR) v4.0 has 42 controls organised across 10 domains. The largest domains are Asset Management – CISA Cyber Resilience Review (CRR) v4.0 (7 controls), External Dependencies Management – CISA Cyber Resilience Review (CRR) v4.0 (5 controls), Incident Management – CISA Cyber Resilience Review (CRR) v4.0 (5 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of CISA Cyber Resilience Review (CRR) v4.0 do I already cover?
CISA Cyber Resilience Review (CRR) v4.0 does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.
How do I implement CISA Cyber Resilience Review (CRR) v4.0?
Start your CISA Cyber Resilience Review (CRR) v4.0 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about CISA Cyber Resilience Review (CRR) v4.0 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 42 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,248 frameworks.
Get Started Free →Free forever, no credit card required