Sort endpoint work by CSF function
Categorize endpoint security activities using NIST CSF functions.
Place each endpoint activity in the NIST CSF function it most directly supports. Identify Protect Detect Respond Recover Add owner and last-seen fields to endpoint inventory Require disk encryption on all laptops Enable attack surface reduction rules in audit mode Create detection for Office spawning PowerShell Define when analysts isolate a device Collect investigation package from a suspect endpoint Verify golden image restore after destructive malware Test backup admin credential separation Compare expected EDR agents to actual check-ins Block unsigned executables from user-writable folders
Sign up free — one personalized lesson every day, matched to your role and goals.
Already have an account? Sign in