The CRI Profile MAPPING SCOPE

Operational vs. Policy and Procedural Controls

This effort is focused on the technical and operational elements of The CRI Profile and did not take into account the management elements that are often focused on organization specific policies and procedures. This decision was made because management specific capabilities are policy-based, and the intent of this effort was focusing on technical and operation capabilities that correlate to ATT&CK mitigations, techniques, and sub-techniques.

Mitigation vs. Monitoring

Capabilities that may only monitor adversary behaviors are out of scope. The focus of this effort is on technical capabilities that mitigate adversary techniques and sub-techniques. Consideration is not given for the potential that an adversary might be dissuaded or change their tactics to try and avoid detection if they thought activity was being monitored.

Diagnostic Statements vs. Function, Category, and Subcategory

This effort maps at the diagnostic statement level and does not map at the function, category, or subcategory level, although consideration was given to each diagnostic statement's grouping by function, category, and subcategory.

Implicit vs. Explicit Mitigation

This effort focuses on system-specific technical mitigations (e.g., block USB devices, perform data backups) and capabilities that support those mitigations rather than other, non-technical methods of mitigation (e.g., block physical access to systems, develop a backup policy).

Pre-compromise Mitigation

Those techniques only associated with the Pre-compromise Mitigation are excluded. These apply to techniques occurring before an adversary gains Initial Access, such as Reconnaissance and Resource Development techniques, and are considered out of scope.

The CRI Profile scoping decisions are captured below at the function and category level along with our rationale for diagnostic statements in those categories being in or out of scope: