The first phase of the Journey follows the Identify function of NIST CSF 2.0: knowing which assets support the business, where they are exposed and what to fix first, in IT, OT and AI.
In short: The Identify phase of the Vortex Cybersecurity Journey follows the Identify function of NIST CSF 2.0, whose outcome is this: “The organization’s current cybersecurity risks are understood.” It starts with the Vortex Assessment, the maturity diagnostic based on NIST CSF 2.0 conducted by Vortex specialists, with the gap map and a roadmap in waves of 3, 6 and 12 months. Then Vortex Cockpit keeps identification continuous: it consolidates the asset inventory from all tools, reads the external surface every day and measures the Identify function in the Vortex Score. In OT, risk is prioritized by physical impact on the process, using the ISA/IEC 62443-3-2 Cyber-PHA.
In NIST CSF 2.0, the Identify function has three categories and works together with the Govern function, which sets the organization’s context, risk management strategy, roles, policy and supply chain risk management.
| Category | What the framework asks for | How Vortex delivers it |
|---|---|---|
| Asset Management (ID.AM) | Inventories of hardware, of software, services and systems, of data and of services provided by suppliers; representations of authorized network flows; assets prioritized by classification, criticality and impact on the mission; management throughout their life cycles (ID.AM-01 to ID.AM-08) | Vortex Cockpit asset inventory, consolidated from all sources, with assets seen by only one source flagged as unmanaged and a record with criticality, business service and end of support. In OT, passive inventory, with no operational impact, with a map of communication between the zones of the Purdue model |
| Risk Assessment (ID.RA) | Vulnerabilities identified, validated and recorded; threat intelligence; impacts and likelihoods; risks prioritized and responses planned and tracked; critical suppliers assessed prior to acquisition (ID.RA-01 to ID.RA-10) | Vulnerability management for infrastructure, web applications, containers, IaC and OT; threat intelligence (IOCs, TTPs, actors) with sector and regional context; external surface read every day, passively, as an attacker would see it; attack paths to critical assets and the cut-off points; OT Risk Assessment using the ISA/IEC 62443-3-2 Cyber-PHA; supplier risk assessment and monitoring (TPRM) |
| Improvement (ID.IM) | Improvements identified from evaluations, from security tests and exercises, including those with suppliers, and from operations; incident response plans maintained and improved (ID.IM-01 to ID.IM-04) | Remediation roadmap with owners and deadlines; actions ranked by posture gain and effort; defenses validated by controlled simulation (BAS), pentest and purple team; the Identify function score in the Vortex Score, always with the measurement coverage |
Categories and subcategories summarized by Vortex from NIST CSWP 29, The NIST Cybersecurity Framework (CSF) 2.0, February 26, 2024 (official text).
The Identify phase starts with a diagnostic and does not end there: inventory and exposure are measured every day, and each finding becomes an action with an owner and a deadline.
Where is the organization today?
What you get
What needs to be protected?
What you get
Where would an attacker get in, and what would it cost?
What you get
What changes first, and how do you prove it improved?
What you get
The Identify roadmap defines what the Protect phase implements, and the inventory feeds the monitoring of the Detect and Respond phase.
OT/ICS Risk Assessment at two water treatment plants and the operational control center of a water and sanitation company, with anonymized data. Priority was defined by physical impact, and unacceptable risk was reduced to zero without replacing the installed automation base. Read the case.
Energy, water and sanitation, logistics, steel and petrochemicals: OT/SCADA, compliance with ANEEL (Brazil’s electricity regulator) and ONS (Brazil’s national electric system operator) and operational risk.
Request the diagnostic (PT)From the factory floor to pharmaceutical production and diagnostic medicine: production, intellectual property, R&D and suppliers.
Request the assessment (PT)Hospitals and healthcare networks: LGPD and patient data, medical IoT and continuity of care.
Request the diagnostic (PT)Grouped by the three categories of the Identify function and by the Govern function of NIST CSF 2.0, which sets the context, risk management strategy, roles and policy that the Identify phase applies.
Asset Management (ID.AM) 6
Asset Management (ID.AM)
Passive discovery and continuous inventory of OT and ICS assets (PLCs, HMIs, SCADA, historians, RTUs), with identification that has no operational impact and a map of communication between the zones of the Purdue model.
Asset Management (ID.AM)
Continuous discovery and classification of the attack surface, internal and external, with exposures prioritized by risk and mapped against the business’s most critical assets.
Asset Management (ID.AM)
Automated discovery and classification of sensitive data, structured or unstructured, in file shares, databases, cloud storage, SaaS and endpoints. The foundation for effective DLP and DSPM.
Asset Management (ID.AM)
Continuous visibility into where sensitive data is, who has access to it, how it is configured and where there is a risk of exposure, with a focus on cloud and SaaS and correlation between identity, data and configuration.
Asset Management (ID.AM)
Management of the data life cycle: retention, archiving, secure disposal and legal hold policies in line with regulatory and business requirements.
Asset Management (ID.AM)
Discovery and protection of exposed surfaces related to AI: models, prompts, LLM endpoints, corporate shadow AI and leakage of sensitive data through chatbots.
Risk Assessment (ID.RA) 18
Risk Assessment (ID.RA)
Continuous discovery and monitoring of internet-facing assets (domains, subdomains, IPs, services, certificates) from the point of view of an external attacker: what they see first.
Risk Assessment (ID.RA)
The Infrastructure Vulnerability tool performs continuous scanning and analysis of servers, networks and devices to identify technical vulnerabilities. It classifies the risks found, guides remediation and helps keep the infrastructure protected against exploitable threats.
Risk Assessment (ID.RA)
This solution focuses on identifying vulnerabilities in web applications, such as SQL injection, XSS and authentication issues. The tool runs automated tests and provides detailed reports so that development teams can act quickly and precisely.
Risk Assessment (ID.RA)
Static analysis of the source code and dynamic testing of the running application, to find vulnerabilities in development and in production.
Risk Assessment (ID.RA)
Review of application security, from the architecture to the code and dependencies, with recommendations for the development life cycle.
Risk Assessment (ID.RA)
Analysis of open source libraries and third-party components to find known vulnerabilities (CVEs), license issues and supply chain risks, such as typosquatting and malicious packages.
Risk Assessment (ID.RA)
Consolidates and prioritizes application security findings from multiple tools (SAST, DAST, SCA, WAF, pentest) in a single platform, with correlation and deduplication.
Risk Assessment (ID.RA)
The Container Vulnerability tool analyzes container images for known vulnerabilities and insecure configurations. It allows container-based environments to be validated before they are released to production, ensuring security from build to runtime.
Risk Assessment (ID.RA)
This solution analyzes infrastructure as code (IaC) files, such as Terraform and CloudFormation, for security flaws in environment definitions. The tool detects insecure configurations before the infrastructure is created, ensuring secure environments from the start of automation.
Risk Assessment (ID.RA)
A combination of CSPM (configuration) and CIEM (cloud identity permissions) to continuously govern the posture and the effective permissions in multicloud environments.
Risk Assessment (ID.RA)
Assessment of the configuration, identities and security architecture in AWS, Azure and GCP, based on recognized benchmarks, with a prioritized remediation plan.
Risk Assessment (ID.RA)
Mapping of identity exposures: misconfigured privileged accounts, escalation paths, dangerous ACLs and unprotected delegations in Active Directory and Entra ID.
Risk Assessment (ID.RA)
OT-Vulnerability Management is a tool that identifies vulnerabilities in industrial assets, such as PLCs, SCADA systems and OT network devices. It provides visibility into technical flaws and guides the prioritization and remediation of risks in mission-critical environments.
Risk Assessment (ID.RA)
A graph of the possible attack paths between the entry points and the most critical assets. It finds the choke points whose remediation breaks several paths at once and maximizes the return on remediation.
Risk Assessment (ID.RA)
Threat modeling of critical systems and processes, to anticipate attack vectors and define controls while the solution is still being designed.
Risk Assessment (ID.RA)
Identification, analysis and treatment of cyber risks in the business context, to support investment and risk acceptance decisions.
Risk Assessment (ID.RA)
External, continuous assessment of security posture, as a score or letter grade, based on signals observable from the outside. Used in third-party risk management (TPRM) and in comparisons with the market.
Risk Assessment (ID.RA)
Assessment of the security posture of companies in mergers and acquisitions, to size risks and liabilities before the transaction.
Improvement (ID.IM) 8
Improvement (ID.IM)
Continuous, automated simulation of known techniques (MITRE ATT&CK) to validate the controls and the SOC’s detection coverage. It shows the distance between “we have the tool” and “it works”.
Improvement (ID.IM)
Autonomous, continuous red teaming: it simulates adversaries with defined objectives (critical assets, escalation, exfiltration) and revalidates the defenses 24x7.
Improvement (ID.IM)
Simulation of a real adversary, with defined objectives and MITRE ATT&CK techniques, to measure the organization’s ability to prevent, detect and respond to a targeted attack.
Improvement (ID.IM)
Controlled phishing and social engineering campaigns to measure people’s exposure and guide awareness actions.
Improvement (ID.IM)
Tabletop exercises with leadership and technical teams, simulating incidents such as ransomware, to test response plans, roles and communication.
Improvement (ID.IM)
Assessment of security operations maturity using the SOC-CMM model, across business, people, process, technology and services, with an evolution plan.
Improvement (ID.IM)
Assessment of governance and security in the use of AI, against references such as ISO/IEC 42001, NIST AI RMF and the LGPD.
Improvement (ID.IM)
Turning the gaps identified in assessments and audits into an action plan with owners, deadlines and priorities.
Govern (GV) 9
Govern (GV)
On-demand security leadership: a Vortex executive leads the cybersecurity program, governance and reporting to the board.
Govern (GV)
Definition of the cybersecurity program’s strategy and roadmap, with priorities, investments and indicators aligned with the business.
Govern (GV)
Drafting and review of information security policies, standards and procedures aligned with frameworks and regulatory requirements.
Govern (GV)
Preparation for compliance with the LGPD, PCI-DSS and ISO/IEC 27001: gap analysis, remediation plan and support through to the audit.
Govern (GV)
Policy Compliance is a tool that assesses how well the IT environment adheres to internal security policies and regulatory requirements. It automates checks and audits, points out deviations and provides recommendations to ensure the company complies with standards such as the LGPD, ISO/IEC 27001 and others.
Govern (GV)
Automation of LGPD and GDPR processes: mapping of personal data processing, consent management, handling of data subject rights and impact assessments (DPIA/RIPD).
Govern (GV)
OT governance aligned with IEC 62443 and NIST SP 800-82: policies, procedures, IT and OT roles and change management in the industrial environment.
Govern (GV)
Governance of AI use in the organization: inventory of AI systems, risk assessment by use case, compliance with the EU AI Act and NIST AI RMF, shadow AI monitoring and responsible use policies.
Govern (GV)
Consolidation and executive reporting of cyber exposures, with dashboards, exposure reduction KPIs, trends and comparison with industry benchmarks for senior management.
Vortex works in a vendor-agnostic way: technologies are recommended by the diagnostic, according to each organization’s environment and risks.
Control posture, Vortex Score by NIST CSF 2.0 function, asset inventory and external surface, in one platform.
Discover Vortex CockpitWhat ANEEL’s REN 964 and the ONS routine require, how IEC 62443 fits in, and a practical checklist.
Read the guide (PT)There are six: Govern (GV), Identify (ID), Protect (PR), Detect (DE), Respond (RS) and Recover (RC). Version 1.1, from 2018, had five; version 2.0, published by NIST on February 26, 2024, added Govern, which is why people still talk about the “five functions” of NIST. Govern sits at the center of the model because it informs how the organization implements the other five. The Vortex Cybersecurity Journey follows the six functions in three phases: Identify, with Govern; Protect; and Detect and Respond, with Recover.
It is the function whose outcome is this: “The organization’s current cybersecurity risks are understood.” It brings together three categories: Asset Management (ID.AM), Risk Assessment (ID.RA) and Improvement (ID.IM). Understanding the assets, the suppliers and the risks enables the organization to prioritize its efforts according to the risk management strategy defined in the Govern function.
Govern, a function created in version 2.0, sets the organization’s context, risk management strategy, roles and responsibilities, policy, oversight and supply chain risk management. Identify applies that strategy to today’s assets, vulnerabilities and threats and points out improvements. The Vortex maturity diagnostic assesses the CSF 2.0 functions, including Govern, and the Vortex Score measures both day to day.
The Vortex Assessment, conducted by specialists, measures maturity against NIST CSF 2.0 and shows the business moment and the stage of the cybersecurity journey. It delivers the gap map, a roadmap in waves of 3, 6 and 12 months, with owners and deadlines, and vendor-agnostic recommendations of the technologies and strategies to move forward.
It does not have to be. The diagnostic is the starting point, and Vortex Cockpit keeps identification continuous: the asset inventory is consolidated from all tools, the external surface is read every day and the controls are checked daily. Measurements older than seven days are disregarded, so that the score reflects the present.
With passive collection: the OT inventory identifies PLCs, HMIs, SCADA, historians and RTUs with no operational impact and maps communication between the zones of the Purdue model. In the water and sanitation case, 208 assets were inventoried, 40 of them OT, without touching the process, and risk was prioritized by physical impact, using the ISA/IEC 62443-3-2 Cyber-PHA.
Yes. NIST CSF 2.0 calls for inventories of services provided by suppliers (ID.AM-04) and the assessment of critical suppliers prior to acquisition (ID.RA-10), and addresses supply chain risk management in the Govern function (GV.SC). Vortex assesses and monitors the risk of suppliers and partners with criteria proportional to each one’s criticality. The third-party risk and SCRM guide (PT) details the supplier life cycle.
Tell us a little about your environment and your industry. A Vortex specialist will get back to you to arrange the diagnostic.
Updated on
