NIST-INFORMED CYBERSECURITY SOLUTIONS

NIST 800-53 rev 5 Crosswalk– Security and Privacy Controls for Information Systems and Organizations is a Privacy Framework. It encompasses “Security and Privacy Controls for Information Systems and Organizations.” SP 800-53 contains a catalog of controls for developing security policies and processes for organizations and information systems.

The document is a vital component of the NIST Risk Management Framework (RMF) and the Federal Information Security Modernization Act of 2014 (FISMA), formerly the Federal Information Security Management Act of 2002.

NIST designed the controls so applicable organizations can tailor them to their systems. The parameters apply to systems that store, process, or transmit federal information to protect the data’s Confidentiality, Integrity, and Availability (CIA).

Published in 2022, NIST SP 1800-10 is titled “Protecting Information and System Integrity in Industrial Control System Environments: Cybersecurity for the Manufacturing Sector.” The guidance suggests that critical manufacturers establish cybersecurity plans that begin by:

• Identifying their assets.
• Training their employees.
• Conducting a risk assessment.

From these three steps, manufacturers can apply NIST SP 1800-10 guidance and cybersecurity solutions to determine which tools, patches, and updates they can deploy to help mitigate their risk.

It provides examples that map to the NIST Cybersecurity Framework (CSF) and NIST SP 800-53 Rev. 5 (the foundation for NIST SP 800-171). It enables manufacturers to discover how commercial toolsets can be part of a comprehensive cybersecurity program.

NIST SP 800-171 rev. 2 is “Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.” (NIST released a draft of 800-171 revision 3 in May 2023.)

The publication sets out confidentiality-oriented controls required for all components of nonfederal information systems that process, store, or transmit controlled unclassified information (CUI).

It focuses on safeguarding CUI within nonfederal information systems and organizations, focusing on the confidentiality arena of the CIA triad.

Examples of CUI include controlled procurement and acquisition, and technical information. A complete list of CUI categories is identified in the National Archives CUI Registry. NIST SP 800-171 is also a requirement of DFARS 252.204.7012 for Federal contractors and subcontractors.

Foxguard’s Information Security Management System (ISMS) includes ISO 27001:2013 certified and compliance with all applicable NIST SP 800-171 controls.

NIST SP 800-82, Rev. 2, is “Guide to Industrial Control Systems (ICS) Security.” It provides guidance on how to secure ICS, including supervisory control and data acquisition (SCADA) systems, distributed control systems (DCS) and other control system configurations, such as programmable logic controllers (PLC). Rev. 3 is in draft format. It will be renamed “Guide to Operational Technology (OT) Security.”