id-ra-09-idra-09

name	ID.RA-09_idra-09
description	The authenticity and integrity of hardware and software are assessed prior to acquisition and use
category	information-gathering
version	2.0
author	cyberstrike-official
tags	["nist","csf","v2.0","id-ra-09","id","subcategory"]
tech_stack	["aws","azure","gcp","network"]
cwe_ids	["CWE-200"]
chains_with	[]
prerequisites	["Risk Assessment (ID.RA)"]
severity_boost	{}

ID.RA-09 ID.RA-09

Subcategory of: Risk Assessment (ID.RA)

High-Level Description

Function: IDENTIFY (ID) Framework: NIST Cybersecurity Framework v2.0

The authenticity and integrity of hardware and software are assessed prior to acquisition and use

What to Check

• Verify ID.RA-09 ID.RA-09 outcome is achieved
• Review documentation and evidence for ID.RA-09
• Assess organizational maturity for IDENTIFY function
• Map to SP 800-53 controls that satisfy ID.RA-09

How to Test

Step 1: Identify Current Profile

Determine the organization's current and target CSF profile tier for ID.RA-09.

Step 2: Assess Outcome Achievement

# Review organizational policies and procedures
# Check for evidence that ID.RA-09 outcome is met
# Interview stakeholders responsible for IDENTIFY

Step 3: Map to Technical Controls

Identify which SP 800-53 controls implement this CSF outcome and verify their operating effectiveness.

Tools

Tool	Purpose	Usage
cloud-audit-mcp	Assess cloud security posture	cloud_audit_* tools
Manual Review	Policy and procedure review	Interviews and documentation

Remediation Guide

Achieve the ID.RA-09 ID.RA-09 outcome:

The authenticity and integrity of hardware and software are assessed prior to acquisition and use

Risk Assessment

Finding	Severity	Impact
ID.RA-09 ID.RA-09 outcome not achieved	Medium	IDENTIFY Function Gap

CWE Categories

CWE ID	Title
CWE-200	Exposure of Sensitive Information

References

• NIST CSF v2.0