rs-an-05-rsan-05

name	RS.AN-05_rsan-05
description	Processes are established to receive, analyze and respond to vulnerabilities disclosed to the organization from internal and external sources (e.g.
category	configuration
version	2.0
author	cyberstrike-official
tags	["nist","csf","v2.0","rs-an-05","rs","subcategory"]
tech_stack	["any"]
cwe_ids	[]
chains_with	[]
prerequisites	["Incident Analysis (RS.AN)"]
severity_boost	{}

RS.AN-05 RS.AN-05

Subcategory of: Incident Analysis (RS.AN)

High-Level Description

Function: RESPOND (RS) Framework: NIST Cybersecurity Framework v2.0

Processes are established to receive, analyze and respond to vulnerabilities disclosed to the organization from internal and external sources (e.g. internal testing, security bulletins, or security researchers)

What to Check

• Verify RS.AN-05 RS.AN-05 outcome is achieved
• Review documentation and evidence for RS.AN-05
• Assess organizational maturity for RESPOND function
• Map to SP 800-53 controls that satisfy RS.AN-05

How to Test

Step 1: Identify Current Profile

Determine the organization's current and target CSF profile tier for RS.AN-05.

Step 2: Assess Outcome Achievement

# Review organizational policies and procedures
# Check for evidence that RS.AN-05 outcome is met
# Interview stakeholders responsible for RESPOND

Step 3: Map to Technical Controls

Identify which SP 800-53 controls implement this CSF outcome and verify their operating effectiveness.

Tools

Tool	Purpose	Usage
cloud-audit-mcp	Assess cloud security posture	cloud_audit_* tools
Manual Review	Policy and procedure review	Interviews and documentation

Remediation Guide

Achieve the RS.AN-05 RS.AN-05 outcome:

Processes are established to receive, analyze and respond to vulnerabilities disclosed to the organization from internal and external sources (e.g. internal testing, security bulletins, or security researchers)

Risk Assessment

Finding	Severity	Impact
RS.AN-05 RS.AN-05 outcome not achieved	Medium	RESPOND Function Gap

CWE Categories

CWE ID	Title