Comparison

800-53 vs CPS 234

NIST SP 800-53 Rev 5.2 · APRA CPS 234 Information Security · data 2026-10-27

Requirement-level comparison of NIST SP 800-53 Rev 5.2 and APRA CPS 234 Information Security, in both directions, derived from published crosswalks and ControlMapping's curated topics.

Have 800-53 → need CPS 234

24 reqs

23 mapped · · 1 no mapping Open in gap view →

Of 24 APRA CPS 234 Information Security requirements, 23 map to something in 800-53, 0 are only loosely related, and 1 have no mapping in our data.

CPS 234 is principles-based: it requires controls commensurate with threats without naming them, so most technical topics show no link. APRA's guide CPG 234 names specific practices but is not binding and not mapped. All links are editorial.

Likely new work: CPS 234 requirements with no mapping to 800-53 (1)

CPS 234	Requirement	Match	800-53	Evidence
Testing control effectiveness · 1
Para 29	Escalate deficiencies that can't be fixed quickly	No mapping in our data	—	No mapping to 800-53 in our data.

Mapped (23)

CPS 234	Requirement	Match	800-53	Evidence
Roles and responsibilities · 2
Para 13	Board ultimately responsible for information security	Editorial	PM-2 PM-9 PM-28+3	Same topic: Roles & Responsibilities, Risk Management (editorial pick)
Para 14	Define information security roles and responsibilities	Editorial	PM-2 PM-29 PS-9	Same topic: Roles & Responsibilities (editorial pick)
Information security capability · 3
Para 15	Maintain a capability commensurate with threats	Editorial	PM-9 PM-28 RA-7	Same topic: Risk Management (editorial pick)
Para 16	Assess third parties' information security capability	Editorial	PM-30 SA-4 SA-9+4	Same topic: Supply Chain Risk, Vendor Risk Mgmt (editorial pick)
Para 17	Keep capability current as threats and vulnerabilities change	Editorial	CA-8 PM-15 PM-16+4	Same topic: Vulnerability Mgmt, Threat Intelligence (editorial pick)
Policy framework · 2
Para 18	Maintain an information security policy framework	Editorial	PL-1 PM-1	Same topic: Governance Policy (editorial pick)
Para 19	Policies direct everyone with security obligations	Editorial	PL-1 PM-1	Same topic: Governance Policy (editorial pick)
Information asset identification and classification · 1
Para 20	Classify information assets by criticality and sensitivity	Editorial	CM-8 PM-5 RA-2	Same topic: Asset Management, Data Classification (editorial pick)
Implementation of controls · 2
Para 21	Timely controls commensurate with risk and asset life-cycle	Editorial	RA-3 RA-7 SC-8+2	Same topic: Risk Assessment, Data Protection (editorial pick)
Para 22	Evaluate the design of third parties' controls	Editorial	PM-30 SA-4 SA-9+4	Same topic: Supply Chain Risk, Vendor Risk Mgmt (editorial pick)
Incident management · 4
Para 23	Detect and respond to incidents in a timely manner	Editorial	IR-2 IR-3 IR-4+2	Same topic: Incident Response (editorial pick)
Para 24	Maintain information security response plans	Editorial	IR-2 IR-3 IR-4+1	Same topic: Incident Response (editorial pick)
Para 25	Response plans cover all stages and escalation	Editorial	IR-2 IR-3 IR-4+2	Same topic: Incident Response, Lessons Learned (editorial pick)
Para 26	Review and test response plans annually	Editorial	IR-2 IR-3 IR-4+1	Same topic: Incident Response (editorial pick)
Testing control effectiveness · 4
Para 27	Systematic testing programme for control effectiveness	Editorial	CA-8 PM-9 PM-28+2	Same topic: Vulnerability Mgmt, Risk Management (editorial pick)
Para 28	Check third parties' control testing is adequate	Editorial	SA-4 SA-9 SR-6	Same topic: Vendor Risk Mgmt (editorial pick)
Para 30	Testing by skilled, functionally independent specialists	Editorial	CA-8 RA-5	Same topic: Vulnerability Mgmt (editorial pick)
Para 31	Review the testing programme at least annually	Editorial	PM-9 PM-28 RA-7	Same topic: Risk Management (editorial pick)
Internal audit · 3
Para 32	Internal audit reviews control design and effectiveness	Editorial	CA-2 PM-4 PM-6	Same topic: Compliance (editorial pick)
Para 33	Assurance provided by appropriately skilled personnel	Editorial	CA-2 PM-4 PM-6	Same topic: Compliance (editorial pick)
Para 34	Internal audit assesses third-party assurance relied on	Editorial	CA-2 PM-4 PM-6+3	Same topic: Compliance (editorial pick)
APRA notification · 2
Para 35	Notify APRA of material incidents within 72 hours	Editorial	IR-6	Same topic: Reporting (editorial pick)
Para 36	Notify APRA of material control weaknesses within 10 business days	Editorial	IR-6	Same topic: Reporting (editorial pick)

Have CPS 234 → need 800-53

300 reqs

37 mapped · · 176 no mapping Open in gap view →

Of 300 NIST SP 800-53 Rev 5.2 requirements, 37 map to something in CPS 234, 87 are only loosely related, and 176 have no mapping in our data.

Likely new work: 800-53 requirements with no mapping to CPS 234 (176)

800-53	Requirement	Match	CPS 234	Evidence
AC Access Control · 18
AC-5	Separation of Duties	No mapping in our data	—	No mapping to CPS 234 in our data.
AC-6	Least Privilege	No mapping in our data	—	No mapping to CPS 234 in our data.
AC-7	Unsuccessful Logon Attempts	No mapping in our data	—	No mapping to CPS 234 in our data.
AC-8	System Use Notification	No mapping in our data	—	No mapping to CPS 234 in our data.
AC-9	Previous Logon Notification	No mapping in our data	—	No mapping to CPS 234 in our data.
AC-10	Concurrent Session Control	No mapping in our data	—	No mapping to CPS 234 in our data.
AC-11	Device Lock	No mapping in our data	—	No mapping to CPS 234 in our data.
AC-12	Session Termination	No mapping in our data	—	No mapping to CPS 234 in our data.
AC-14	Permitted Actions Without Identification or Authentication	No mapping in our data	—	No mapping to CPS 234 in our data.
AC-16	Security and Privacy Attributes	No mapping in our data	—	No mapping to CPS 234 in our data.
AC-17	Remote Access	No mapping in our data	—	No mapping to CPS 234 in our data.
AC-18	Wireless Access	No mapping in our data	—	No mapping to CPS 234 in our data.
AC-19	Access Control for Mobile Devices	No mapping in our data	—	No mapping to CPS 234 in our data.
AC-21	Information Sharing	No mapping in our data	—	No mapping to CPS 234 in our data.
AC-22	Publicly Accessible Content	No mapping in our data	—	No mapping to CPS 234 in our data.
AC-23	Data Mining Protection	No mapping in our data	—	No mapping to CPS 234 in our data.
AC-24	Access Control Decisions	No mapping in our data	—	No mapping to CPS 234 in our data.
AC-25	Reference Monitor	No mapping in our data	—	No mapping to CPS 234 in our data.
AT Awareness and Training · 4
AT-2	Literacy Training and Awareness	No mapping in our data	—	No mapping to CPS 234 in our data.
AT-3	Role-based Training	No mapping in our data	—	No mapping to CPS 234 in our data.
AT-4	Training Records	No mapping in our data	—	No mapping to CPS 234 in our data.
AT-6	Training Feedback	No mapping in our data	—	No mapping to CPS 234 in our data.
AU Audit and Accountability · 9
AU-2	Event Logging	No mapping in our data	—	No mapping to CPS 234 in our data.
AU-3	Content of Audit Records	No mapping in our data	—	No mapping to CPS 234 in our data.
AU-4	Audit Log Storage Capacity	No mapping in our data	—	No mapping to CPS 234 in our data.
AU-5	Response to Audit Logging Process Failures	No mapping in our data	—	No mapping to CPS 234 in our data.
AU-7	Audit Record Reduction and Report Generation	No mapping in our data	—	No mapping to CPS 234 in our data.
AU-8	Time Stamps	No mapping in our data	—	No mapping to CPS 234 in our data.
AU-10	Non-repudiation	No mapping in our data	—	No mapping to CPS 234 in our data.
AU-11	Audit Record Retention	No mapping in our data	—	No mapping to CPS 234 in our data.
AU-14	Session Audit	No mapping in our data	—	No mapping to CPS 234 in our data.
CA Assessment, Authorization and Monitoring · 3
CA-5	Plan of Action and Milestones	No mapping in our data	—	No mapping to CPS 234 in our data.
CA-6	Authorization	No mapping in our data	—	No mapping to CPS 234 in our data.
CA-9	Internal System Connections	No mapping in our data	—	No mapping to CPS 234 in our data.
CM Configuration Management · 8
CM-2	Baseline Configuration	No mapping in our data	—	No mapping to CPS 234 in our data.
CM-4	Impact Analyses	No mapping in our data	—	No mapping to CPS 234 in our data.
CM-5	Access Restrictions for Change	No mapping in our data	—	No mapping to CPS 234 in our data.
CM-6	Configuration Settings	No mapping in our data	—	No mapping to CPS 234 in our data.
CM-7	Least Functionality	No mapping in our data	—	No mapping to CPS 234 in our data.
CM-10	Software Usage Restrictions	No mapping in our data	—	No mapping to CPS 234 in our data.
CM-11	User-installed Software	No mapping in our data	—	No mapping to CPS 234 in our data.
CM-14	Signed Components	No mapping in our data	—	No mapping to CPS 234 in our data.
CP Contingency Planning · 10
CP-2	Contingency Plan	No mapping in our data	—	No mapping to CPS 234 in our data.
CP-3	Contingency Training	No mapping in our data	—	No mapping to CPS 234 in our data.
CP-4	Contingency Plan Testing	No mapping in our data	—	No mapping to CPS 234 in our data.
CP-6	Alternate Storage Site	No mapping in our data	—	No mapping to CPS 234 in our data.
CP-7	Alternate Processing Site	No mapping in our data	—	No mapping to CPS 234 in our data.
CP-8	Telecommunications Services	No mapping in our data	—	No mapping to CPS 234 in our data.
CP-10	System Recovery and Reconstitution	No mapping in our data	—	No mapping to CPS 234 in our data.
CP-11	Alternate Communications Protocols	No mapping in our data	—	No mapping to CPS 234 in our data.
CP-12	Safe Mode	No mapping in our data	—	No mapping to CPS 234 in our data.
CP-13	Alternative Security Mechanisms	No mapping in our data	—	No mapping to CPS 234 in our data.
IA Identification and Authentication · 12
IA-2	Identification and Authentication (Organizational Users)	No mapping in our data	—	No mapping to CPS 234 in our data.
IA-3	Device Identification and Authentication	No mapping in our data	—	No mapping to CPS 234 in our data.
IA-4	Identifier Management	No mapping in our data	—	No mapping to CPS 234 in our data.
IA-5	Authenticator Management	No mapping in our data	—	No mapping to CPS 234 in our data.
IA-6	Authentication Feedback	No mapping in our data	—	No mapping to CPS 234 in our data.
IA-7	Cryptographic Module Authentication	No mapping in our data	—	No mapping to CPS 234 in our data.
IA-8	Identification and Authentication (Non-organizational Users)	No mapping in our data	—	No mapping to CPS 234 in our data.
IA-9	Service Identification and Authentication	No mapping in our data	—	No mapping to CPS 234 in our data.
IA-10	Adaptive Authentication	No mapping in our data	—	No mapping to CPS 234 in our data.
IA-11	Re-authentication	No mapping in our data	—	No mapping to CPS 234 in our data.
IA-12	Identity Proofing	No mapping in our data	—	No mapping to CPS 234 in our data.
IA-13	Identity Providers and Authorization Servers	No mapping in our data	—	No mapping to CPS 234 in our data.
IR Incident Response · 1
IR-9	Information Spillage Response	No mapping in our data	—	No mapping to CPS 234 in our data.
MA Maintenance · 4
MA-3	Maintenance Tools	No mapping in our data	—	No mapping to CPS 234 in our data.
MA-4	Nonlocal Maintenance	No mapping in our data	—	No mapping to CPS 234 in our data.
MA-5	Maintenance Personnel	No mapping in our data	—	No mapping to CPS 234 in our data.
MA-7	Field Maintenance	No mapping in our data	—	No mapping to CPS 234 in our data.
MP Media Protection · 6
MP-2	Media Access	No mapping in our data	—	No mapping to CPS 234 in our data.
MP-3	Media Marking	No mapping in our data	—	No mapping to CPS 234 in our data.
MP-4	Media Storage	No mapping in our data	—	No mapping to CPS 234 in our data.
MP-5	Media Transport	No mapping in our data	—	No mapping to CPS 234 in our data.
MP-6	Media Sanitization	No mapping in our data	—	No mapping to CPS 234 in our data.
MP-7	Media Use	No mapping in our data	—	No mapping to CPS 234 in our data.
PE Physical and Environmental Protection · 21
PE-2	Physical Access Authorizations	No mapping in our data	—	No mapping to CPS 234 in our data.
PE-3	Physical Access Control	No mapping in our data	—	No mapping to CPS 234 in our data.
PE-4	Access Control for Transmission	No mapping in our data	—	No mapping to CPS 234 in our data.
PE-5	Access Control for Output Devices	No mapping in our data	—	No mapping to CPS 234 in our data.
PE-6	Monitoring Physical Access	No mapping in our data	—	No mapping to CPS 234 in our data.
PE-8	Visitor Access Records	No mapping in our data	—	No mapping to CPS 234 in our data.
PE-9	Power Equipment and Cabling	No mapping in our data	—	No mapping to CPS 234 in our data.
PE-10	Emergency Shutoff	No mapping in our data	—	No mapping to CPS 234 in our data.
PE-11	Emergency Power	No mapping in our data	—	No mapping to CPS 234 in our data.
PE-12	Emergency Lighting	No mapping in our data	—	No mapping to CPS 234 in our data.
PE-13	Fire Protection	No mapping in our data	—	No mapping to CPS 234 in our data.
PE-14	Environmental Controls	No mapping in our data	—	No mapping to CPS 234 in our data.
PE-15	Water Damage Protection	No mapping in our data	—	No mapping to CPS 234 in our data.
PE-16	Delivery and Removal	No mapping in our data	—	No mapping to CPS 234 in our data.
PE-17	Alternate Work Site	No mapping in our data	—	No mapping to CPS 234 in our data.
PE-18	Location of System Components	No mapping in our data	—	No mapping to CPS 234 in our data.
PE-19	Information Leakage	No mapping in our data	—	No mapping to CPS 234 in our data.
PE-20	Asset Monitoring and Tracking	No mapping in our data	—	No mapping to CPS 234 in our data.
PE-21	Electromagnetic Pulse Protection	No mapping in our data	—	No mapping to CPS 234 in our data.
PE-22	Component Marking	No mapping in our data	—	No mapping to CPS 234 in our data.
PE-23	Facility Location	No mapping in our data	—	No mapping to CPS 234 in our data.
PL Planning · 6
PL-4	Rules of Behavior	No mapping in our data	—	No mapping to CPS 234 in our data.
PL-7	Concept of Operations	No mapping in our data	—	No mapping to CPS 234 in our data.
PL-8	Security and Privacy Architectures	No mapping in our data	—	No mapping to CPS 234 in our data.
PL-9	Central Management	No mapping in our data	—	No mapping to CPS 234 in our data.
PL-10	Baseline Selection	No mapping in our data	—	No mapping to CPS 234 in our data.
PL-11	Baseline Tailoring	No mapping in our data	—	No mapping to CPS 234 in our data.
PM Program Management · 11
PM-7	Enterprise Architecture	No mapping in our data	—	No mapping to CPS 234 in our data.
PM-8	Critical Infrastructure Plan	No mapping in our data	—	No mapping to CPS 234 in our data.
PM-10	Authorization Process	No mapping in our data	—	No mapping to CPS 234 in our data.
PM-14	Testing, Training, and Monitoring	No mapping in our data	—	No mapping to CPS 234 in our data.
PM-17	Protecting Controlled Unclassified Information on External Systems	No mapping in our data	—	No mapping to CPS 234 in our data.
PM-20	Dissemination of Privacy Program Information	No mapping in our data	—	No mapping to CPS 234 in our data.
PM-21	Accounting of Disclosures	No mapping in our data	—	No mapping to CPS 234 in our data.
PM-25	Minimization of Personally Identifiable Information Used in Testing, Training, and Research	No mapping in our data	—	No mapping to CPS 234 in our data.
PM-26	Complaint Management	No mapping in our data	—	No mapping to CPS 234 in our data.
PM-27	Privacy Reporting	No mapping in our data	—	No mapping to CPS 234 in our data.
PM-32	Purposing	No mapping in our data	—	No mapping to CPS 234 in our data.
PS Personnel Security · 6
PS-2	Position Risk Designation	No mapping in our data	—	No mapping to CPS 234 in our data.
PS-3	Personnel Screening	No mapping in our data	—	No mapping to CPS 234 in our data.
PS-4	Personnel Termination	No mapping in our data	—	No mapping to CPS 234 in our data.
PS-5	Personnel Transfer	No mapping in our data	—	No mapping to CPS 234 in our data.
PS-6	Access Agreements	No mapping in our data	—	No mapping to CPS 234 in our data.
PS-8	Personnel Sanctions	No mapping in our data	—	No mapping to CPS 234 in our data.
PT PII Processing and Transparency · 7
PT-2	Authority to Process Personally Identifiable Information	No mapping in our data	—	No mapping to CPS 234 in our data.
PT-3	Personally Identifiable Information Processing Purposes	No mapping in our data	—	No mapping to CPS 234 in our data.
PT-4	Consent	No mapping in our data	—	No mapping to CPS 234 in our data.
PT-5	Privacy Notice	No mapping in our data	—	No mapping to CPS 234 in our data.
PT-6	System of Records Notice	No mapping in our data	—	No mapping to CPS 234 in our data.
PT-7	Specific Categories of Personally Identifiable Information	No mapping in our data	—	No mapping to CPS 234 in our data.
PT-8	Computer Matching Requirements	No mapping in our data	—	No mapping to CPS 234 in our data.
RA Risk Assessment · 1
RA-6	Technical Surveillance Countermeasures Survey	No mapping in our data	—	No mapping to CPS 234 in our data.
SA System and Services Acquisition · 5
SA-2	Allocation of Resources	No mapping in our data	—	No mapping to CPS 234 in our data.
SA-16	Developer-provided Training	No mapping in our data	—	No mapping to CPS 234 in our data.
SA-20	Customized Development of Critical Components	No mapping in our data	—	No mapping to CPS 234 in our data.
SA-21	Developer Screening	No mapping in our data	—	No mapping to CPS 234 in our data.
SA-23	Specialization	No mapping in our data	—	No mapping to CPS 234 in our data.
SC System and Communications Protection · 29
SC-2	Separation of System and User Functionality	No mapping in our data	—	No mapping to CPS 234 in our data.
SC-3	Security Function Isolation	No mapping in our data	—	No mapping to CPS 234 in our data.
SC-6	Resource Availability	No mapping in our data	—	No mapping to CPS 234 in our data.
SC-10	Network Disconnect	No mapping in our data	—	No mapping to CPS 234 in our data.
SC-15	Collaborative Computing Devices and Applications	No mapping in our data	—	No mapping to CPS 234 in our data.
SC-17	Public Key Infrastructure Certificates	No mapping in our data	—	No mapping to CPS 234 in our data.
SC-18	Mobile Code	No mapping in our data	—	No mapping to CPS 234 in our data.
SC-23	Session Authenticity	No mapping in our data	—	No mapping to CPS 234 in our data.
SC-25	Thin Nodes	No mapping in our data	—	No mapping to CPS 234 in our data.
SC-26	Decoys	No mapping in our data	—	No mapping to CPS 234 in our data.
SC-27	Platform-independent Applications	No mapping in our data	—	No mapping to CPS 234 in our data.
SC-29	Heterogeneity	No mapping in our data	—	No mapping to CPS 234 in our data.
SC-30	Concealment and Misdirection	No mapping in our data	—	No mapping to CPS 234 in our data.
SC-31	Covert Channel Analysis	No mapping in our data	—	No mapping to CPS 234 in our data.
SC-34	Non-modifiable Executable Programs	No mapping in our data	—	No mapping to CPS 234 in our data.
SC-35	External Malicious Code Identification	No mapping in our data	—	No mapping to CPS 234 in our data.
SC-36	Distributed Processing and Storage	No mapping in our data	—	No mapping to CPS 234 in our data.
SC-37	Out-of-band Channels	No mapping in our data	—	No mapping to CPS 234 in our data.
SC-38	Operations Security	No mapping in our data	—	No mapping to CPS 234 in our data.
SC-41	Port and I/O Device Access	No mapping in our data	—	No mapping to CPS 234 in our data.
SC-42	Sensor Capability and Data	No mapping in our data	—	No mapping to CPS 234 in our data.
SC-44	Detonation Chambers	No mapping in our data	—	No mapping to CPS 234 in our data.
SC-45	System Time Synchronization	No mapping in our data	—	No mapping to CPS 234 in our data.
SC-46	Cross Domain Policy Enforcement	No mapping in our data	—	No mapping to CPS 234 in our data.
SC-47	Alternate Communications Paths	No mapping in our data	—	No mapping to CPS 234 in our data.
SC-48	Sensor Relocation	No mapping in our data	—	No mapping to CPS 234 in our data.
SC-49	Hardware-enforced Separation and Policy Enforcement	No mapping in our data	—	No mapping to CPS 234 in our data.
SC-50	Software-enforced Separation and Policy Enforcement	No mapping in our data	—	No mapping to CPS 234 in our data.
SC-51	Hardware-based Protection	No mapping in our data	—	No mapping to CPS 234 in our data.
SI System and Information Integrity · 12
SI-2	Flaw Remediation	No mapping in our data	—	No mapping to CPS 234 in our data.
SI-6	Security and Privacy Function Verification	No mapping in our data	—	No mapping to CPS 234 in our data.
SI-11	Error Handling	No mapping in our data	—	No mapping to CPS 234 in our data.
SI-13	Predictable Failure Prevention	No mapping in our data	—	No mapping to CPS 234 in our data.
SI-14	Non-persistence	No mapping in our data	—	No mapping to CPS 234 in our data.
SI-15	Information Output Filtering	No mapping in our data	—	No mapping to CPS 234 in our data.
SI-17	Fail-safe Procedures	No mapping in our data	—	No mapping to CPS 234 in our data.
SI-19	De-identification	No mapping in our data	—	No mapping to CPS 234 in our data.
SI-20	Tainting	No mapping in our data	—	No mapping to CPS 234 in our data.
SI-21	Information Refresh	No mapping in our data	—	No mapping to CPS 234 in our data.
SI-22	Information Diversity	No mapping in our data	—	No mapping to CPS 234 in our data.
SI-23	Information Fragmentation	No mapping in our data	—	No mapping to CPS 234 in our data.
SR Supply Chain Risk Management · 3
SR-4	Provenance	No mapping in our data	—	No mapping to CPS 234 in our data.
SR-7	Supply Chain Operations Security	No mapping in our data	—	No mapping to CPS 234 in our data.
SR-9	Tamper Resistance and Detection	No mapping in our data	—	No mapping to CPS 234 in our data.

Check these: only loosely related (a shared CSF outcome, not a mapping) (87)

800-53	Requirement	Match	CPS 234	Evidence
AC Access Control · 5
AC-1	Policy and Procedures	Loosely related	Para 18 Para 19	Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping
AC-2	Account Management	Loosely related	Para 21 Para 23	Only shares CSF PR.DS-10, DE.CM-01: related, not a mapping
AC-3	Access Enforcement	Loosely related	Para 21	Only shares CSF PR.DS-10: related, not a mapping
AC-4	Information Flow Enforcement	Loosely related	Para 21	Only shares CSF PR.DS-10: related, not a mapping
AC-20	Use of External Systems	Loosely related	Para 20	Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping
AT Awareness and Training · 1
AT-1	Policy and Procedures	Loosely related	Para 18 Para 19	Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping
AU Audit and Accountability · 6
AU-1	Policy and Procedures	Loosely related	Para 18 Para 19	Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping
AU-6	Audit Record Review, Analysis, and Reporting	Loosely related	Para 23	Only shares CSF DE.AE-02: related, not a mapping
AU-9	Protection of Audit Information	Loosely related	Para 21	Only shares CSF PR.DS-10: related, not a mapping
AU-12	Audit Record Generation	Loosely related	Para 23	Only shares CSF DE.CM-01: related, not a mapping
AU-13	Monitoring for Information Disclosure	Loosely related	Para 21	Only shares CSF PR.DS-10: related, not a mapping
AU-16	Cross-organizational Audit Logging	Loosely related	Para 21	Only shares CSF PR.DS-02: related, not a mapping
CA Assessment, Authorization and Monitoring · 3
CA-1	Policy and Procedures	Loosely related	Para 18 Para 19	Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping
CA-3	Information Exchange	Loosely related	Para 21	Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping
CA-7	Continuous Monitoring	Loosely related	Para 23 Para 16 Para 17+5	Only shares CSF DE.AE-02, DE.CM-01, DE.CM-06, ID.RA-01: related, not a mapping
CM Configuration Management · 5
CM-1	Policy and Procedures	Loosely related	Para 18 Para 19	Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping
CM-3	Configuration Change Control	Loosely related	Para 23	Only shares CSF DE.CM-01: related, not a mapping
CM-9	Configuration Management Plan	Loosely related	Para 20	Only shares CSF ID.AM-08: related, not a mapping
CM-12	Information Location	Loosely related	Para 20	Only shares CSF ID.AM-07: related, not a mapping
CM-13	Data Action Mapping	Loosely related	Para 20	Only shares CSF ID.AM-07, ID.AM-08: related, not a mapping
CP Contingency Planning · 2
CP-1	Policy and Procedures	Loosely related	Para 18 Para 19	Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping
CP-9	System Backup	Loosely related	Para 21	Only shares CSF PR.DS-01, PR.DS-10: related, not a mapping
IA Identification and Authentication · 1
IA-1	Policy and Procedures	Loosely related	Para 18 Para 19	Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping
IR Incident Response · 2
IR-1	Policy and Procedures	Loosely related	Para 18 Para 19	Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping
IR-5	Incident Monitoring	Loosely related	Para 23 Para 24 Para 25+1	Only shares CSF RS.MA-02, RS.MA-03, RS.MA-04: related, not a mapping
MA Maintenance · 3
MA-1	Policy and Procedures	Loosely related	Para 18 Para 19	Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping
MA-2	Controlled Maintenance	Loosely related	Para 20	Only shares CSF ID.AM-08: related, not a mapping
MA-6	Timely Maintenance	Loosely related	Para 20	Only shares CSF ID.AM-08: related, not a mapping
MP Media Protection · 2
MP-1	Policy and Procedures	Loosely related	Para 18 Para 19	Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping
MP-8	Media Downgrading	Loosely related	Para 21	Only shares CSF PR.DS-01: related, not a mapping
PE Physical and Environmental Protection · 1
PE-1	Policy and Procedures	Loosely related	Para 18 Para 19	Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping
PL Planning · 1
PL-2	System Security and Privacy Plans	Loosely related	Para 20	Only shares CSF ID.AM-08: related, not a mapping
PM Program Management · 10
PM-3	Information Security and Privacy Resources	Loosely related	Para 13 Para 14 Para 15+2	Only shares CSF GV.RM-03, GV.RR-03: related, not a mapping
PM-11	Mission and Business Process Definition	Loosely related	Para 17 Para 21	Only shares CSF ID.RA-04: related, not a mapping
PM-12	Insider Threat Program	Loosely related	Para 17 Para 21	Only shares CSF ID.RA-03: related, not a mapping
PM-13	Security and Privacy Workforce	Loosely related	Para 13 Para 14	Only shares CSF GV.RR-02: related, not a mapping
PM-18	Privacy Program Plan	Loosely related	Para 13 Para 15 Para 16+5	Only shares CSF GV.RM-06, GV.SC-03: related, not a mapping
PM-19	Privacy Program Leadership Role	Loosely related	Para 13 Para 14 Para 16+1	Only shares CSF GV.RR-01, GV.RR-02, GV.SC-09: related, not a mapping
PM-22	Personally Identifiable Information Quality Management	Loosely related	Para 20	Only shares CSF ID.AM-08: related, not a mapping
PM-23	Data Governance Body	Loosely related	Para 13 Para 14 Para 20	Only shares CSF GV.RR-01, GV.RR-02, ID.AM-08: related, not a mapping
PM-24	Data Integrity Board	Loosely related	Para 13 Para 14	Only shares CSF GV.RR-01, GV.RR-02: related, not a mapping
PM-31	Continuous Monitoring Strategy	Loosely related	Para 16 Para 22	Only shares CSF GV.SC-03, GV.SC-09: related, not a mapping
PS Personnel Security · 2
PS-1	Policy and Procedures	Loosely related	Para 18 Para 19	Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping
PS-7	External Personnel Security	Loosely related	Para 16 Para 22 Para 28+1	Only shares CSF DE.CM-06: related, not a mapping
PT PII Processing and Transparency · 1
PT-1	Policy and Procedures	Loosely related	Para 18 Para 19	Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping
RA Risk Assessment · 4
RA-1	Policy and Procedures	Loosely related	Para 18 Para 19	Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping
RA-8	Privacy Impact Assessments	Loosely related	Para 17 Para 21	Only shares CSF ID.RA-04: related, not a mapping
RA-9	Criticality Analysis	Loosely related	Para 16 Para 22 Para 28+4	Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping
RA-10	Threat Hunting	Loosely related	Para 17	Only shares CSF DE.AE-07: related, not a mapping
SA System and Services Acquisition · 10
SA-1	Policy and Procedures	Loosely related	Para 18 Para 19	Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping
SA-3	System Development Life Cycle	Loosely related	Para 20	Only shares CSF ID.AM-08: related, not a mapping
SA-5	System Documentation	Loosely related	Para 16 Para 20 Para 22	Only shares CSF ID.RA-09, ID.AM-02: related, not a mapping
SA-8	Security and Privacy Engineering Principles	Loosely related	Para 20 Para 21	Only shares CSF ID.AM-08, PR.DS-10: related, not a mapping
SA-10	Developer Configuration Management	Loosely related	Para 16 Para 22	Only shares CSF ID.RA-09: related, not a mapping
SA-11	Developer Testing and Evaluation	Loosely related	Para 16 Para 17 Para 22+2	Only shares CSF ID.RA-09, ID.RA-01: related, not a mapping
SA-15	Development Process, Standards, and Tools	Loosely related	Para 16 Para 17 Para 22+2	Only shares CSF ID.RA-09, ID.RA-01: related, not a mapping
SA-17	Developer Security and Privacy Architecture and Design	Loosely related	Para 16 Para 22	Only shares CSF ID.RA-09: related, not a mapping
SA-22	Unsupported System Components	Loosely related	Para 20	Only shares CSF ID.AM-08: related, not a mapping
SA-24	Design For Cyber Resiliency	Loosely related	Para 13 Para 15 Para 27+1	Only shares CSF GV.RM-03: related, not a mapping
SC System and Communications Protection · 16
SC-1	Policy and Procedures	Loosely related	Para 18 Para 19	Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping
SC-4	Information in Shared System Resources	Loosely related	Para 21	Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping
SC-5	Denial-of-service Protection	Loosely related	Para 23	Only shares CSF DE.CM-01: related, not a mapping
SC-7	Boundary Protection	Loosely related	Para 21 Para 23	Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10, DE.CM-01: related, not a mapping
SC-11	Trusted Path	Loosely related	Para 21	Only shares CSF PR.DS-02, PR.DS-10: related, not a mapping
SC-12	Cryptographic Key Establishment and Management	Loosely related	Para 21	Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping
SC-13	Cryptographic Protection	Loosely related	Para 21	Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping
SC-16	Transmission of Security and Privacy Attributes	Loosely related	Para 21	Only shares CSF PR.DS-02: related, not a mapping
SC-20	Secure Name/Address Resolution Service (Authoritative Source)	Loosely related	Para 23	Only shares CSF DE.CM-01: related, not a mapping
SC-21	Secure Name/Address Resolution Service (Recursive or Caching Resolver)	Loosely related	Para 23	Only shares CSF DE.CM-01: related, not a mapping
SC-22	Architecture and Provisioning for Name/Address Resolution Service	Loosely related	Para 23	Only shares CSF DE.CM-01: related, not a mapping
SC-24	Fail in Known State	Loosely related	Para 21	Only shares CSF PR.DS-10: related, not a mapping
SC-32	System Partitioning	Loosely related	Para 21	Only shares CSF PR.DS-01, PR.DS-10: related, not a mapping
SC-39	Process Isolation	Loosely related	Para 21	Only shares CSF PR.DS-01, PR.DS-10: related, not a mapping
SC-40	Wireless Link Protection	Loosely related	Para 21	Only shares CSF PR.DS-02, PR.DS-10: related, not a mapping
SC-43	Usage Restrictions	Loosely related	Para 21	Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping
SI System and Information Integrity · 7
SI-1	Policy and Procedures	Loosely related	Para 18 Para 19	Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping
SI-3	Malicious Code Protection	Loosely related	Para 21	Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping
SI-8	Spam Protection	Loosely related	Para 21	Only shares CSF PR.DS-02: related, not a mapping
SI-10	Information Input Validation	Loosely related	Para 21	Only shares CSF PR.DS-10: related, not a mapping
SI-12	Information Management and Retention	Loosely related	Para 20	Only shares CSF ID.AM-07, ID.AM-08: related, not a mapping
SI-16	Memory Protection	Loosely related	Para 21	Only shares CSF PR.DS-10: related, not a mapping
SI-18	Personally Identifiable Information Quality Operations	Loosely related	Para 20	Only shares CSF ID.AM-08: related, not a mapping
SR Supply Chain Risk Management · 5
SR-1	Policy and Procedures	Loosely related	Para 18 Para 19	Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping
SR-5	Acquisition Strategies, Tools, and Methods	Loosely related	Para 16 Para 22 Para 20+2	Only shares CSF GV.SC-05, GV.SC-06, GV.SC-09, ID.RA-09…: related, not a mapping
SR-8	Notification Agreements	Loosely related	Para 25 Para 23 Para 24+3	Only shares CSF RS.CO-03, RS.MA-01: related, not a mapping
SR-10	Inspection of Systems or Components	Loosely related	Para 16 Para 22	Only shares CSF GV.SC-05, ID.RA-09: related, not a mapping
SR-12	Component Disposal	Loosely related	Para 20	Only shares CSF ID.AM-08: related, not a mapping

Mapped (37)

800-53	Requirement	Match	CPS 234	Evidence
CA Assessment, Authorization and Monitoring · 2
CA-2	Control Assessments	Editorial	Para 32 Para 33 Para 34	Same topic: Compliance (editorial pick)
CA-8	Penetration Testing	Editorial	Para 17 Para 27 Para 30	Same topic: Vulnerability Mgmt (editorial pick)
CM Configuration Management · 1
CM-8	System Component Inventory	Editorial	Para 20	Same topic: Asset Management (editorial pick)
IR Incident Response · 6
IR-2	Incident Response Training	Editorial	Para 23 Para 24 Para 25+1	Same topic: Incident Response (editorial pick)
IR-3	Incident Response Testing	Editorial	Para 23 Para 24 Para 25+1	Same topic: Incident Response (editorial pick)
IR-4	Incident Handling	Editorial	Para 23 Para 24 Para 25+1	Same topic: Incident Response, Lessons Learned (editorial pick)
IR-6	Incident Reporting	Editorial	Para 35 Para 36	Same topic: Reporting (editorial pick)
IR-7	Incident Response Assistance	Editorial	Para 25	Same topic: Communication (editorial pick)
IR-8	Incident Response Plan	Editorial	Para 23 Para 24 Para 25+1	Same topic: Incident Response (editorial pick)
PL Planning · 1
PL-1	Policy and Procedures	Editorial	Para 18 Para 19	Same topic: Governance Policy (editorial pick)
PM Program Management · 11
PM-1	Information Security Program Plan	Editorial	Para 18 Para 19	Same topic: Governance Policy (editorial pick)
PM-2	Information Security Program Leadership Role	Editorial	Para 13 Para 14	Same topic: Roles & Responsibilities (editorial pick)
PM-4	Plan of Action and Milestones Process	Editorial	Para 32 Para 33 Para 34	Same topic: Compliance (editorial pick)
PM-5	System Inventory	Editorial	Para 20	Same topic: Asset Management (editorial pick)
PM-6	Measures of Performance	Editorial	Para 32 Para 33 Para 34	Same topic: Compliance (editorial pick)
PM-9	Risk Management Strategy	Editorial	Para 13 Para 15 Para 27+1	Same topic: Risk Management (editorial pick)
PM-15	Security and Privacy Groups and Associations	Editorial	Para 17	Same topic: Threat Intelligence (editorial pick)
PM-16	Threat Awareness Program	Editorial	Para 17	Same topic: Threat Intelligence (editorial pick)
PM-28	Risk Framing	Editorial	Para 13 Para 15 Para 27+1	Same topic: Risk Management (editorial pick)
PM-29	Risk Management Program Leadership Roles	Editorial	Para 13 Para 14	Same topic: Roles & Responsibilities (editorial pick)
PM-30	Supply Chain Risk Management Strategy	Editorial	Para 16 Para 22	Same topic: Supply Chain Risk (editorial pick)
PS Personnel Security · 1
PS-9	Position Descriptions	Editorial	Para 13 Para 14	Same topic: Roles & Responsibilities (editorial pick)
RA Risk Assessment · 4
RA-2	Security Categorization	Editorial	Para 20	Same topic: Data Classification (editorial pick)
RA-3	Risk Assessment	Editorial	Para 17 Para 21	Same topic: Risk Assessment (editorial pick)
RA-5	Vulnerability Monitoring and Scanning	Editorial	Para 17 Para 27 Para 30	Same topic: Vulnerability Mgmt (editorial pick)
RA-7	Risk Response	Editorial	Para 13 Para 15 Para 17+3	Same topic: Risk Management, Risk Assessment (editorial pick)
SA System and Services Acquisition · 2
SA-4	Acquisition Process	Editorial	Para 16 Para 22 Para 28+1	Same topic: Vendor Risk Mgmt (editorial pick)
SA-9	External System Services	Editorial	Para 16 Para 22 Para 28+1	Same topic: Vendor Risk Mgmt (editorial pick)
SC System and Communications Protection · 2
SC-8	Transmission Confidentiality and Integrity	Editorial	Para 21	Same topic: Data Protection (editorial pick)
SC-28	Protection of Information at Rest	Editorial	Para 21	Same topic: Data Protection (editorial pick)
SI System and Information Integrity · 3
SI-4	System Monitoring	Editorial	Para 23	Same topic: Intrusion Detection (editorial pick)
SI-5	Security Alerts, Advisories, and Directives	Editorial	Para 17	Same topic: Threat Intelligence (editorial pick)
SI-7	Software, Firmware, and Information Integrity	Editorial	Para 21	Same topic: Data Protection (editorial pick)
SR Supply Chain Risk Management · 4
SR-2	Supply Chain Risk Management Plan	Editorial	Para 16 Para 22	Same topic: Supply Chain Risk (editorial pick)
SR-3	Supply Chain Controls and Processes	Editorial	Para 16 Para 22	Same topic: Supply Chain Risk (editorial pick)
SR-6	Supplier Assessments and Reviews	Editorial	Para 16 Para 22 Para 28+1	Same topic: Vendor Risk Mgmt (editorial pick)
SR-11	Component Authenticity	Editorial	Para 16 Para 22	Same topic: Supply Chain Risk (editorial pick)

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Mapped = curated together in a ControlMapping topic, or linked directly. Crosswalks don't prove compliance. Methodology · Download the data · Report a mistake.

800-53 vs CPS 234

Have 800-53 → need CPS 234

Have CPS 234 → need 800-53

By topic