Question 1

How many NIST 800-53 controls are there?

Accepted Answer

The NIST 800-53 includes 20 different control families within its framework. Across the entire range of NIST 800-53 control families, there are 322 controls. Each NIST 800-53 control family has its own controls, which may or may not be applicable to any given organisation. Therefore, organisations using NIST 800-53 can choose the controls that are most applicable to them.

Question 2

What are the NIST 800-53 control families?

Accepted Answer

The NIST 800-53 control families are as follows:

AC – Access Control: 25 controls covering activities such as policies and procedures, account management, separation of duties and the policy of least privilege.

AT – Awareness and Training: 6 controls covering awareness and security training across all employees, as well as more technical training for privileged users.

AU – Audit and Accountability: 16 controls addressing the auditing and retention of records, as well as associated analysis, review and reporting.

CA – Assessment, Authorisation and Monitoring: 9 controls relating to penetration testing, monitoring of network connections and monitoring of external systems.

CM – Configuration Management: 14 controls covering configuration change, data action mapping and setting software policies.

CP – Contingency Planning: 13 controls relating to the creation, testing and implementation of business continuity strategies, as well as alternative solutions for data processing and storage.

IA – Identification and Authentication: 12 controls addressing the management of credentials, implementation of authentication policies and creation of systems for users, devices and services.

IR – Incident Response: 10 controls for establishing incident response education and training, as well as associated monitoring systems and reporting processes.

MA – Maintenance: 7 controls relating to the ongoing maintenance of systems, personnel and tools.

MP – Media Protection: 8 controls on securing and protecting the access, use, storage and transportation of media.

PE – Physical and Environmental Protection: 23 controls relating to protection against physical risk and damage, including access to emergency power and securing physical access in an incident.

PL – Planning: 11 controls for putting strategies in place to maintain a comprehensive security architecture, including impact assessments, activity planning and rules of behaviour.

PM – Programme Management: 32 controls dedicated to defining strategies for risk management and insider threats, as well as scaling architecture.

PS – Personnel Security: 9 controls for addressing the requirements for screening personnel (both internal and external), transferring personnel and terminating personnel, as well as position risk designation.

PT – Personally Identifiable Information Processing and Transparency: 8 controls addressing the creation of privacy notices, achieving consent and processing personally identifiable information.

RA – Risk Assessment: 10 controls relating to vulnerability scanning, risk assessments and ongoing privacy impact.

SA – System and Services Acquisition: 23 controls for the acquisition processes, allocation of resources and system development lifecycle, among others.

SC – System and Communications Protection: 51 controls addressing activities such as the partition of applications, securing passwords and cryptographic key management.

SI – System and Information Integrity: 23 controls relating to the implementation of system monitoring, alerting systems, spam protection and flaw remediation processes.

SR – Supply Chain Risk Management: 12 controls covering supplier assessments and reviews, risk management plans notification agreements and the inspection of systems or components.

Question 3

What’s the difference between NIST CSF and NIST 800-53?

Accepted Answer

Both the NIST 800-53 and the NIST Cybersecurity Framework (CSF) are widely used cybersecurity frameworks developed by the National Institute of Standards and Technology (NIST). Both frameworks offer guidance on how organisations can secure their IT infrastructure to prevent, control, mitigate, and respond to cyber threats and incidents.

While NIST CSF provides a broader framework for enhancing cybersecurity practices and policies, NIST 800-53 is a more comprehensive standard that provides specific security controls for each IT system.

Despite their commonalities, NIST CSF and 800-53 include some key differences. Continue reading to understand the difference between NIST CSF and NIST 800-53.

Question 4

What is the NIST CSF overview?

Accepted Answer

NIST CSF is a voluntary framework designed to help organisations, regardless of size or industry, develop and implement comprehensive cybersecurity protocols and practices. It is intended to help organisations audit their existing cybersecurity practices, identify potential oversights and weak points, and build procedures and policies that enable agile threat detection and response procedures.

CSF is organised into five key functions: Identify, Protect, Detect, Respond, and Recover. These functions are designed to include a set of outcomes that organisations can use to assess and improve their existing cybersecurity posture.

Because CSF is not geared towards any one industry or entity size, it is designed to be flexible and scalable. Therefore, while it provides a solid framework on which organisations can build their cybersecurity management programs, it lacks the comprehensive aspects of other standards.

Question 5

What is the NIST 800-53 overview?

Accepted Answer

NIST 800-53 is an information and cybersecurity standard that provides guidelines for federal agencies, information systems, and third-party contractors that work with the United States government. While NIST 800-53 is a mandatory standard for these entities, many outside organisations choose to adhere to its standards and best practices to bolster their cybersecurity and information security policies and procedures.

NIST 800-53 includes a list of controls to support the development of resilient and secure federal information systems. It provides guidance to these entities on how to select, implement, and assess these provided security and privacy controls.

Question 6

What are the similarities between NIST 800-53 and NIST CSF?

Accepted Answer

The main similarities between these two standards are:

Both standards are developed and updated by NIST.

Both include guidelines for protecting information, IT, and security systems.

Both provide security controls and implementation guidance.

Both are designed to be adaptable to meet the specific needs of an organisation.

Both enable organisations to assess the effectiveness of their security controls.

Both include frameworks for continuous security development.

Question 7

What are the differences between NIST 800-53 and NIST CSF?

Accepted Answer

The primary differences between NIST 800-53 and NIST CSF are:

CSF is a voluntary framework for organisations, whereas NIST 800-53 is mandatory for federal information systems, agencies, and contractors with the US government.

CSF is a framework, while NIST 800-53 is a set of standards.

CSF is more focused on risk management, while NIST 800-53 provides detailed security controls.

CSF provides cybersecurity best practices, while NIST 800-53 provide security controls.

Question 8

NIST 800-171 vs. 800-53: what’s the difference between NIST 800-53 and NIST 800-171?

Accepted Answer

NIST 800-171 and NIST 800-53 are two cybersecurity standards developed by the National Institute of Standards and Technology (NIST). Both of these standards provide security controls that can be implemented to reach a standard level of IT and information systems infrastructure security.

Despite having similar designs and goals, there is one key difference between NIST 800-53 and NIST 800-171: NIST 800-53 is a mandatory compliance standard for federal information systems, agencies, and contractors that work with the United States government. NIST 800-171, on the other hand, is a mandatory compliance standard for non-federal systems that handle Controlled Unclassified Information (CUI).

Continue reading to learn more about the similarities and differences between NIST 800-171 and NIST 800-53.

Question 9

What is the NIST 800-171 overview?

Accepted Answer

NIST 800-171 establishes guidelines for protecting sensitive information on the IT systems and networks of federal contractors. Through mandating top-tier cybersecurity practices for government contractors, the overall resilience of the federal supply chain is bolstered. NIST 800-171 focuses on safeguarding CUI to ensure that such sensitive data stored on contractors’ networks remains secure.

Question 10

What is the NIST 800-53 overview?

Accepted Answer

NIST 800-53 is a security compliance standard designed to secure the information and IT systems of federal agencies. The standard provides guidelines to secure any part of a federal information system that stores, processes, or transmits federal information. NIST 800-53 is also concerned with ensuring the safeguarding of classified data within federal systems.

Question 11

What are the similarities between NIST 800-171 and NIST 800-53?

Accepted Answer

These two standards bear many similarities. These include:

Both are frameworks that provide security standards for systems and organisations that work with government data.

Both standards take a risk-based approach and utilise security control families.

The controls used by each are designed to address various cybersecurity aspects, like access control, incident response, risk assessment, and system monitoring.

Question 12

What are the differences between NIST 800-171 and NIST 800-53?

Accepted Answer

There are also some key differences between these two standards. These include:

NIST 800-53 is mandatory for federal information systems and agencies that work with the US government, while NIST 800-171 is mandatory for contractors that work with the US government.

NIST 800-53 includes standards for securing classified data, whereas NIST 800-171 is intended to secure systems that house CUI, which is sensitive data that is not classified.

NIST 800-171 vs. 800-53: what’s the difference between NIST 800-53 and NIST 800-171?

NIST 800-171 overview

NIST 800-53 overview

NIST SP 800-171 vs. 800-53: Similarities

NIST 800-171 vs 800-53: Differences

Learn more about NIST compliance standards