rs-an-03-rsan-03

name	RS.AN-03_rsan-03
description	Analysis is performed to establish what has taken place during an incident and the root cause of the incident
category	configuration
version	2.0
author	cyberstrike-official
tags	["nist","csf","v2.0","rs-an-03","rs","subcategory"]
tech_stack	["any"]
cwe_ids	[]
chains_with	[]
prerequisites	["Incident Analysis (RS.AN)"]
severity_boost	{}

RS.AN-03 RS.AN-03

Subcategory of: Incident Analysis (RS.AN)

High-Level Description

Function: RESPOND (RS) Framework: NIST Cybersecurity Framework v2.0

Analysis is performed to establish what has taken place during an incident and the root cause of the incident

What to Check

• Verify RS.AN-03 RS.AN-03 outcome is achieved
• Review documentation and evidence for RS.AN-03
• Assess organizational maturity for RESPOND function
• Map to SP 800-53 controls that satisfy RS.AN-03

How to Test

Step 1: Identify Current Profile

Determine the organization's current and target CSF profile tier for RS.AN-03.

Step 2: Assess Outcome Achievement

# Review organizational policies and procedures
# Check for evidence that RS.AN-03 outcome is met
# Interview stakeholders responsible for RESPOND

Step 3: Map to Technical Controls

Identify which SP 800-53 controls implement this CSF outcome and verify their operating effectiveness.

Tools

Tool	Purpose	Usage
cloud-audit-mcp	Assess cloud security posture	cloud_audit_* tools
Manual Review	Policy and procedure review	Interviews and documentation

Remediation Guide

Achieve the RS.AN-03 RS.AN-03 outcome:

Analysis is performed to establish what has taken place during an incident and the root cause of the incident

Risk Assessment

Finding	Severity	Impact
RS.AN-03 RS.AN-03 outcome not achieved	Medium	RESPOND Function Gap

CWE Categories

CWE ID	Title
N/A	No direct CWE mapping

References

• NIST CSF v2.0