Adverse Event Analysis (DE.AE) — NIST CSF 2.0 Category

CategoryDE.AE — Adverse Event Analysis

FunctionDE — Detect CategoryDE.AE — Adverse Event Analysis

Official CSF Core outcome
Anomalies, indicators of compromise, and other potentially adverse events are analyzed to characterize the events and detect cybersecurity incidents.

Category outcome

NIST CSF 2.0 places Adverse Event Analysis (DE.AE) within the Detect Function. The official Category outcome is: “Anomalies, indicators of compromise, and other potentially adverse events are analyzed to characterize the events and detect cybersecurity incidents.”

This Category provides a structured way to address analysis, correlation, context, impact, scope, information delivery, and incident declaration. It groups related Subcategory outcomes without prescribing a specific technology, organizational model, or implementation sequence.

What this means in practice

A credible Adverse Event Analysis capability connects policy and risk decisions to repeatable operating practices. The organization should define scope, ownership, expected outcomes, evidence, exceptions, and reassessment triggers.

Implementation should be proportionate to mission needs, legal and contractual obligations, threat exposure, business impact, and the organization’s risk appetite. The same Category may be implemented differently across systems and business contexts.

Implementation priorities

The following priorities translate the Category into an operating capability. They are starting points for design and governance, not a replacement for architecture, procedures, or risk analysis.

Enrich events with asset, identity, vulnerability, threat, and business context.
Correlate evidence across sources and preserve timelines and analytical rationale.
Determine affected scope, likely impact, confidence, and uncertainty.
Deliver actionable information to authorized people and automated tools.
Use defined criteria and authority to declare incidents promptly.

Evidence and measurement

Evidence should show that the Category’s outcomes are achieved in the intended scope, remain effective, and are reviewed when conditions change. A policy, tool purchase, or completed checklist is not sufficient by itself.

Triage and analytical records
Correlation rules, cases, timelines, and evidence links
Threat intelligence and contextual enrichment records
Impact, scope, confidence, and incident-declaration decisions
Escalation and information-delivery logs

Subcategories within DE.AE

This Category contains 6 CSF 2.0 Subcategory outcomes. Each outcome has a dedicated Bare Metal Cyber profile with the official NIST statement and original implementation guidance.

DE.AE-02 — Analyze Potentially Adverse Events: Potentially adverse events are analyzed to better understand associated activities
DE.AE-03 — Correlate Information from Multiple Sources: Information is correlated from multiple sources
DE.AE-04 — Understand Event Impact and Scope: The estimated impact and scope of adverse events are understood
DE.AE-06 — Provide Event Information to Authorized Staff and Tools: Information on adverse events is provided to authorized staff and tools
DE.AE-07 — Integrate Threat Intelligence and Context: Cyber threat intelligence and other contextual information are integrated into the analysis
DE.AE-08 — Declare Incidents Using Defined Criteria: Incidents are declared when adverse events meet the defined incident criteria

Using this Category in Current and Target Profiles

For a Current Profile, record which Subcategory outcomes are achieved, the scope of the assessment, and the evidence supporting the judgment. For a Target Profile, select the outcomes needed to meet risk management objectives and describe the target conditions.

Prioritize the resulting gaps by mission consequence, risk exposure, dependencies, obligations, implementation effort, and the value of the improvement. Record the owner and the evidence that will demonstrate closure.

Common failure modes

The following conditions can create the appearance of coverage without reliable outcome achievement. Treat them as hypotheses to test during assessments, exercises, and operational reviews.

Analysts review isolated alerts without cross-source context.
Incident criteria are vague or require excessive approval.
Impact and scope estimates are not updated as evidence changes.
Automated actions receive information without adequate authorization or validation.

Source, scope, and attribution

The Category identifier, name, description, and Subcategory outcomes are from NIST CSWP 29. Bare Metal Cyber’s implementation, evidence, failure-mode, and Profile guidance is original educational material.

The CSF describes outcomes, not mandatory implementation steps. Use NIST’s current online Implementation Examples and Informative References when selecting practices and controls for a specific environment.

Certification relevance

This subject appears in or supports the following certification bodies of knowledge:

Search Bare Metal Cyber