CSEIG Explorer

The DoD Cyber Survivability Endorsement Implementation Guide asks a weapon system or a piece of defence critical infrastructure to keep working under attack, and to fail in a way the mission can absorb. It expresses that as ten Cyber Survivability Attributes. This tool lists all ten and the NIST SP 800-53 Rev. 5 controls that MITRE identified as supporting each one.

10 attributes 263 controls in the register 215 mapped to an attribute 14 techniques 51 approaches

Search an attribute by number, a control by its identifier with or without an enhancement, or any word from a control title, a technique or an approach. Leave the box empty to browse all ten attributes.

Try:
Loading the attribute register...

Where this comes from

  • QUOTED: the attribute names, the pillar each sits under, and the exemplar statement for each attribute are the CSEIG's own language as printed in MTR210700R1 (Mapping Cyber Resiliency to the CSEIG CSAs (Revision 1), September 2022). The control identifiers, the control names, the techniques and the approaches come from Appendix C, Table 17 of the same report. The Rev. 5 control titles shown beside each identifier come from the NIST SP 800-53 Rev. 5 catalogue, not from the report.
  • DERIVED: the counts on this page are counted from Table 17, not estimated. The register is 263 rows: 215 name at least one attribute and 48 are printed with the attribute column empty, so a control listed here without an attribute is listed that way by the report. The table spans 111 base controls and 202 enhancements.
  • NOT USED: Section 3 of the report presents the same analysis as a table per attribute. Its control identifier column is corrupted in places, where a printed identifier parses to a real control that is not the control the row names. Joining on it would credit an attribute to the wrong control, so it is used here only for the exemplar language, which is plain prose.
  • JUDGEMENT: which controls support which attribute is the report authors' assessment, reviewed by MITRE and an external subject matter expert group. This tool reports that assessment. It does not re-derive it, and a control appearing here is not evidence that any system implements it.

One wording in the register does not match the report's own vocabulary: the approach printed as Trust-Based Privileged Management in one row is defined as Trust-Based Privilege Management in Table 14. It is shown as printed.