Comparison
800-53 vs Essential Eight
NIST SP 800-53 Rev 5.2 · ASD Essential Eight · data 2026-10-27
Requirement-level comparison of NIST SP 800-53 Rev 5.2 and ASD Essential Eight, in both directions, derived from published crosswalks and ControlMapping's curated topics.
Of 126 ASD Essential Eight requirements, 57 map to something in 800-53, 69 are only loosely related, and 0 have no mapping in our data.
Essential Eight here means the ISM controls ASD tags for Maturity Levels One to Three; each row shows its levels (ML1–ML3). ASD publishes no crosswalk to other frameworks, so every match is ControlMapping editorial.
Check these: only loosely related (a shared CSF outcome, not a mapping) (69)
| Essential Eight | Requirement | Match | 800-53 | Evidence |
|---|---|---|---|---|
| Patch applications · 6 | ||||
| ISM-0304 | ML3 Applications other than office productivity suites, web browsers and their extensions… | CA-2CA-7CA-8+5 | Only shares CSF ID.RA-01: related, not a mapping | |
| ISM-1690 | ML1, ML2, ML3 Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within two weeks of… | CA-2CA-7CA-8+5 | Only shares CSF ID.RA-01: related, not a mapping | |
| ISM-1692 | ML3 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within 48… | CA-2CA-7CA-8+5 | Only shares CSF ID.RA-01: related, not a mapping | |
| ISM-1700 | ML2, ML3 A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in applications other than office… | CA-2CA-7CA-8+5 | Only shares CSF ID.RA-01: related, not a mapping | |
| ISM-1901 | ML3 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release when… | CA-2CA-7CA-8+5 | Only shares CSF ID.RA-01: related, not a mapping | |
| ISM-1905 | ML1, ML2, ML3 Online services that are no longer supported by vendors are removed | CA-2CA-7CA-8+5 | Only shares CSF ID.RA-01: related, not a mapping | |
| Patch operating systems · 10 | ||||
| ISM-1407 | ML3 The latest release, or the previous release, of operating systems are used | SA-10CA-2CA-7+5 | Only shares CSF PR.PS-02, PR.PS-03, ID.RA-01: related, not a mapping | |
| ISM-1694 | ML1, ML2, ML3 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within two weeks… | SA-10CA-2CA-7+5 | Only shares CSF PR.PS-02, PR.PS-03, ID.RA-01: related, not a mapping | |
| ISM-1696 | ML3 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within 48 hours of… | SA-10CA-2CA-7+5 | Only shares CSF PR.PS-02, PR.PS-03, ID.RA-01: related, not a mapping | |
| ISM-1697 | ML3 Patches, updates or other vendor mitigations for vulnerabilities in drivers are applied within one month of release… | SA-10CA-2CA-7+5 | Only shares CSF PR.PS-02, PR.PS-03, ID.RA-01: related, not a mapping | |
| ISM-1703 | ML3 A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in drivers | SA-10CA-2CA-7+5 | Only shares CSF PR.PS-02, PR.PS-03, ID.RA-01: related, not a mapping | |
| ISM-1879 | ML3 Patches, updates or other vendor mitigations for vulnerabilities in drivers are applied within 48 hours of release… | SA-10CA-2CA-7+5 | Only shares CSF PR.PS-02, PR.PS-03, ID.RA-01: related, not a mapping | |
| ISM-1900 | ML3 A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in firmware | SA-10CA-2CA-7+5 | Only shares CSF PR.PS-02, PR.PS-03, ID.RA-01: related, not a mapping | |
| ISM-1902 | ML3 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within one month of… | SA-10CA-2CA-7+5 | Only shares CSF PR.PS-02, PR.PS-03, ID.RA-01: related, not a mapping | |
| ISM-1903 | ML3 Patches, updates or other vendor mitigations for vulnerabilities in firmware are applied within 48 hours of release… | SA-10CA-2CA-7+5 | Only shares CSF PR.PS-02, PR.PS-03, ID.RA-01: related, not a mapping | |
| ISM-1904 | ML3 Patches, updates or other vendor mitigations for vulnerabilities in firmware are applied within one month of release… | SA-10CA-2CA-7+5 | Only shares CSF PR.PS-02, PR.PS-03, ID.RA-01: related, not a mapping | |
| Multi-factor authentication · 9 | ||||
| ISM-1505 | ML3 Multi-factor authentication is used to authenticate human users of data repositories | AC-7AC-12IA-2+5 | Only shares CSF PR.AA-03: related, not a mapping | |
| ISM-1680 | ML1, ML2, ML3 Multi-factor authentication (where available) is used to authenticate human users to… | AC-7AC-12IA-2+5 | Only shares CSF PR.AA-03: related, not a mapping | |
| ISM-1681 | ML1, ML2, ML3 Multi-factor authentication is used to authenticate customers to online customer… | AC-7AC-12IA-2+5 | Only shares CSF PR.AA-03: related, not a mapping | |
| ISM-1682 | ML2, ML3 Multi-factor authentication used for authenticating human users of systems is… | AC-7AC-12IA-2+5 | Only shares CSF PR.AA-03: related, not a mapping | |
| ISM-1873 | ML2 Multi-factor authentication used for authenticating customers of online customer services provides a… | AC-7AC-12IA-2+5 | Only shares CSF PR.AA-03: related, not a mapping | |
| ISM-1874 | ML3 Multi-factor authentication used for authenticating customers of online customer services is phishing-resistant | AC-7AC-12IA-2+5 | Only shares CSF PR.AA-03: related, not a mapping | |
| ISM-1892 | ML1, ML2, ML3 Multi-factor authentication is used to authenticate human users to their organisation’s online customer services that… | AC-7AC-12IA-2+5 | Only shares CSF PR.AA-03: related, not a mapping | |
| ISM-1893 | ML1, ML2, ML3 Multi-factor authentication is used to authenticate human users to third-party online customer services that process… | AC-7AC-12IA-2+5 | Only shares CSF PR.AA-03: related, not a mapping | |
| ISM-1894 | ML3 Multi-factor authentication used for authenticating human users of data repositories is… | AC-7AC-12IA-2+5 | Only shares CSF PR.AA-03: related, not a mapping | |
| Restrict administrative privileges · 11 | ||||
| ISM-1649 | ML3 Just-in-time administration is used for the administration of systems and their resources | AC-2AC-2(7)AC-3+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1650 | ML2, ML3 Privileged user account and security group management events are centrally logged | AC-2AC-2(7)AC-3+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1685 | ML2, ML3 Credentials for break glass accounts, local administrator accounts and service accounts… | AC-2AC-2(7)AC-3+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1686 | ML3 Credential Guard functionality is enabled | AC-2AC-2(7)AC-3+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1687 | ML2, ML3 Privileged operating environments are not virtualised within unprivileged operating… | AC-2AC-2(7)AC-3+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1688 | ML1, ML2, ML3 Unprivileged user accounts cannot be used to log on to privileged operating environments | AC-2AC-2(7)AC-3+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1689 | ML1, ML2, ML3 Privileged user accounts (excluding local administrator accounts) cannot be used to log… | AC-2AC-2(7)AC-3+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1861 | ML3 Local Security Authority protection functionality is enabled | AC-2AC-2(7)AC-3+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1883 | ML1, ML2, ML3 Privileged user accounts explicitly authorised to access online services are strictly… | AC-2AC-2(7)AC-3+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1897 | ML3 Remote Credential Guard functionality is enabled | AC-2AC-2(7)AC-3+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1898 | ML3 Secure Admin Workstations are used in the performance of administrative activities | AC-2AC-2(7)AC-3+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| Application control · 5 | ||||
| ISM-1582 | ML2, ML3 Application control rulesets are validated at least annually | CM-7CM-7(5)SC-34+1 | Only shares CSF PR.PS-05: related, not a mapping | |
| ISM-1656 | ML3 Application control is implemented on non-internet-facing servers | CM-7CM-7(5)SC-34+1 | Only shares CSF PR.PS-05: related, not a mapping | |
| ISM-1658 | ML3 Application control restricts the execution of drivers to an organisation-approved set | CM-7CM-7(5)SC-34+1 | Only shares CSF PR.PS-05: related, not a mapping | |
| ISM-1659 | ML3 Microsoft’s vulnerable driver blocklist is implemented | CM-7CM-7(5)SC-34+1 | Only shares CSF PR.PS-05: related, not a mapping | |
| ISM-1871 | ML2, ML3 Application control is applied to all locations other than user profiles and temporary… | CM-7CM-7(5)SC-34+1 | Only shares CSF PR.PS-05: related, not a mapping | |
| Restrict Microsoft Office macros · 10 | ||||
| ISM-1487 | ML3 Only privileged human users responsible for checking that Microsoft Office macros are… | CM-7AC-19(5)CM-2+5 | Only shares CSF PR.PS-01, PR.PS-05: related, not a mapping | |
| ISM-1489 | ML1, ML2, ML3 Microsoft Office macro security settings cannot be changed by human users | CM-7AC-19(5)CM-2+5 | Only shares CSF PR.PS-01, PR.PS-05: related, not a mapping | |
| ISM-1671 | ML1, ML2, ML3 Microsoft Office macros are disabled for human users that do not have a demonstrated… | CM-7AC-19(5)CM-2+5 | Only shares CSF PR.PS-01, PR.PS-05: related, not a mapping | |
| ISM-1672 | ML1, ML2, ML3 Microsoft Office macro antivirus scanning is enabled | CM-7AC-19(5)CM-2+5 | Only shares CSF PR.PS-01, PR.PS-05: related, not a mapping | |
| ISM-1673 | ML2, ML3 Microsoft Office macros are blocked from making Win32 API calls | CM-7AC-19(5)CM-2+5 | Only shares CSF PR.PS-01, PR.PS-05: related, not a mapping | |
| ISM-1674 | ML3 Only Microsoft Office macros running from within a sandboxed environment, a Trusted… | CM-7AC-19(5)CM-2+5 | Only shares CSF PR.PS-01, PR.PS-05: related, not a mapping | |
| ISM-1675 | ML3 Microsoft Office macros digitally signed by an untrusted publisher cannot be enabled… | CM-7AC-19(5)CM-2+5 | Only shares CSF PR.PS-01, PR.PS-05: related, not a mapping | |
| ISM-1676 | ML3 Microsoft Office’s list of trusted publishers is validated at least annually | CM-7AC-19(5)CM-2+5 | Only shares CSF PR.PS-01, PR.PS-05: related, not a mapping | |
| ISM-1890 | ML3 Microsoft Office macros are checked to ensure they are free of malicious code before… | CM-7AC-19(5)CM-2+5 | Only shares CSF PR.PS-01, PR.PS-05: related, not a mapping | |
| ISM-1891 | ML3 Microsoft Office macros digitally signed by signatures other than V3 signatures cannot… | CM-7AC-19(5)CM-2+5 | Only shares CSF PR.PS-01, PR.PS-05: related, not a mapping | |
| User application hardening · 13 | ||||
| ISM-1485 | ML1, ML2, ML3 Web browsers do not process web advertisements from the internet | AC-19(5)CM-2CM-3+5 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1486 | ML1, ML2, ML3 Web browsers do not process Java from the internet | AC-19(5)CM-2CM-3+5 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1542 | ML2, ML3 Microsoft Office is configured to prevent activation of Object Linking and Embedding… | AC-19(5)CM-2CM-3+5 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1622 | ML3 PowerShell is configured to use Constrained Language Mode | AC-19(5)CM-2CM-3+5 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1655 | ML3 .NET Framework 3.5 (includes .NET 2.0 and 3.0) is disabled or removed | AC-19(5)CM-2CM-3+5 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1667 | ML2, ML3 Microsoft Office is blocked from creating child processes | AC-19(5)CM-2CM-3+5 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1668 | ML2, ML3 Microsoft Office is blocked from creating executable content | AC-19(5)CM-2CM-3+5 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1669 | ML2, ML3 Microsoft Office is blocked from injecting code into other processes | AC-19(5)CM-2CM-3+5 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1670 | ML2, ML3 PDF applications are blocked from creating child processes | AC-19(5)CM-2CM-3+5 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1823 | ML2, ML3 Office productivity suite security settings cannot be changed by human users | AC-19(5)CM-2CM-3+5 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1824 | ML2, ML3 PDF application security settings cannot be changed by human users | AC-19(5)CM-2CM-3+5 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1889 | ML2, ML3 Command line process creation events are centrally logged | AC-19(5)CM-2CM-3+5 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1896 | ML3 Memory integrity functionality is enabled | AC-19(5)CM-2CM-3+5 | Only shares CSF PR.PS-01: related, not a mapping | |
| Regular backups · 5 | ||||
| ISM-1705 | ML2, ML3 Privileged user accounts (excluding backup administrator accounts) cannot access… | CP-9CP-2CP-4+1 | Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping | |
| ISM-1706 | ML3 Privileged user accounts (excluding backup administrator accounts) cannot access their… | CP-9CP-2CP-4+1 | Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping | |
| ISM-1708 | ML3 Backup administrator accounts are prevented from modifying and deleting backups during… | CP-9CP-2CP-4+1 | Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping | |
| ISM-1812 | ML1, ML2, ML3 Unprivileged user accounts cannot access backups belonging to other user accounts | CP-9CP-2CP-4+1 | Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping | |
| ISM-1813 | ML3 Unprivileged user accounts cannot access their own backups | CP-9CP-2CP-4+1 | Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping | |
Mapped (57)
| Essential Eight | Requirement | Match | 800-53 | Evidence |
|---|---|---|---|---|
| Patch applications · 6 | ||||
| ISM-1691 | ML1, ML2 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release | Editorial | SI-2 | Same topic: Patch Management (editorial pick) |
| ISM-1693 | ML2, ML3 Patches, updates or other vendor mitigations for vulnerabilities in applications other… | Editorial | SI-2 | Same topic: Patch Management (editorial pick) |
| ISM-1698 | ML1, ML2, ML3 A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in online… | Editorial | CA-8RA-5 | Same topic: Vulnerability Mgmt (editorial pick) |
| ISM-1699 | ML1, ML2, ML3 A vulnerability scanner is used at least weekly to identify missing patches or updates… | Editorial | CA-8RA-5 | Same topic: Vulnerability Mgmt (editorial pick) |
| ISM-1704 | ML1, ML2, ML3 Office productivity suites, web browsers and their extensions, email clients, PDF… | Editorial | SI-2 | Same topic: Patch Management (editorial pick) |
| ISM-1876 | ML1, ML2, ML3 Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within 48 hours of… | Editorial | SI-2 | Same topic: Patch Management (editorial pick) |
| Patch applications & Patch operating systems · 2 | ||||
| ISM-1807 | ML1, ML2, ML3 An automated method of asset discovery is used at least fortnightly to support the… | Editorial | CA-8CM-8PM-5+1 | Same topic: Vulnerability Mgmt, Asset Management (editorial pick) |
| ISM-1808 | ML1, ML2, ML3 A vulnerability scanner with an up-to-date vulnerability database is used for… | Editorial | CA-8RA-5 | Same topic: Vulnerability Mgmt (editorial pick) |
| Patch operating systems · 5 | ||||
| ISM-1501 | ML1, ML2, ML3 Operating systems that are no longer supported by vendors are replaced | Editorial | SI-2 | Same topic: Patch Management (editorial pick) |
| ISM-1695 | ML1, ML2 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within one month of release | Editorial | SI-2 | Same topic: Patch Management (editorial pick) |
| ISM-1701 | ML1, ML2, ML3 A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in… | Editorial | CA-8RA-5 | Same topic: Vulnerability Mgmt (editorial pick) |
| ISM-1702 | ML1, ML2, ML3 A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in operating systems of… | Editorial | CA-8RA-5 | Same topic: Vulnerability Mgmt (editorial pick) |
| ISM-1877 | ML1, ML2, ML3 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within 48 hours… | Editorial | SI-2 | Same topic: Patch Management (editorial pick) |
| Multi-factor authentication · 7 | ||||
| ISM-0974 | ML2, ML3 Multi-factor authentication is used to authenticate unprivileged human users of systems | Editorial | IA-2(1)IA-2(2) | Same topic: Multi-Factor Auth (editorial pick) |
| ISM-1173 | ML2, ML3 Multi-factor authentication is used to authenticate privileged human users of systems | Editorial | IA-2(1)IA-2(2) | Same topic: Multi-Factor Auth (editorial pick) |
| ISM-1401 | ML1, ML2, ML3 Multi-factor authentication uses either: something people have and something people… | Editorial | IA-2(1)IA-2(2) | Same topic: Multi-Factor Auth (editorial pick) |
| ISM-1504 | ML1, ML2, ML3 Multi-factor authentication is used to authenticate human users to their organisation’s online services that process… | Editorial | IA-2(1)IA-2(2) | Same topic: Multi-Factor Auth (editorial pick) |
| ISM-1679 | ML1, ML2, ML3 Multi-factor authentication is used to authenticate human users to third-party online services that process, store or… | Editorial | IA-2(1)IA-2(2) | Same topic: Multi-Factor Auth (editorial pick) |
| ISM-1683 | ML2, ML3 Successful and unsuccessful multi-factor authentication events are centrally logged | Editorial | AU-2AU-3AU-11+1 | Same topic: Logging & Audit (editorial pick) |
| ISM-1872 | ML2, ML3 Multi-factor authentication used for authenticating human users of online services is… | Editorial | IA-2(1)IA-2(2) | Same topic: Multi-Factor Auth (editorial pick) |
| Restrict administrative privileges · 9 | ||||
| ISM-0445 | ML1, ML2, ML3 Privileged human users are assigned a dedicated privileged user account to be used… | Editorial | AC-2(7)AC-6(5) | Same topic: Privileged Access (editorial pick) |
| ISM-1175 | ML1, ML2, ML3 Privileged user accounts (excluding those explicitly authorised to access online… | Editorial | AC-2(7)AC-6(5) | Same topic: Privileged Access (editorial pick) |
| ISM-1380 | ML1, ML2, ML3 Privileged human users use separate privileged and unprivileged operating environments | Editorial | AC-2(7)AC-6(5) | Same topic: Privileged Access (editorial pick) |
| ISM-1387 | ML2, ML3 Administrative activities are conducted through jump servers | Editorial | AC-2(7)AC-6(5) | Same topic: Privileged Access (editorial pick) |
| ISM-1507 | ML1, ML2, ML3 Requests for privileged access to systems and their resources are validated when first… | Editorial | AC-2(7)AC-6(5) | Same topic: Privileged Access (editorial pick) |
| ISM-1508 | ML3 Privileged access to systems and their resources is limited to only what is required… | Editorial | AC-2(7)AC-6(5) | Same topic: Privileged Access (editorial pick) |
| ISM-1509 | ML2, ML3 Privileged access events are centrally logged | Editorial | AU-2AU-3AU-11+1 | Same topic: Logging & Audit (editorial pick) |
| ISM-1647 | ML2, ML3 Privileged access to systems and their resources are disabled after 12 months unless… | Editorial | AC-2(7)AC-6(5) | Same topic: Privileged Access (editorial pick) |
| ISM-1648 | ML2, ML3 Privileged access to systems and their resources are disabled after 45 days of inactivity | Editorial | AC-2(7)AC-6(5) | Same topic: Privileged Access (editorial pick) |
| Application control · 6 | ||||
| ISM-0843 | ML1, ML2, ML3 Application control is implemented on workstations | Editorial | CM-7(5)SI-3SI-4 | Same topic: Endpoint Protection (editorial pick) |
| ISM-1490 | ML2, ML3 Application control is implemented on internet-facing servers | Editorial | CM-7(5)SI-3SI-4 | Same topic: Endpoint Protection (editorial pick) |
| ISM-1544 | ML2, ML3 Microsoft’s recommended application blocklist is implemented | Editorial | CM-7(5)SI-3SI-4 | Same topic: Endpoint Protection (editorial pick) |
| ISM-1657 | ML1, ML2, ML3 Application control restricts the execution of executables, libraries, scripts… | Editorial | CM-7(5)SI-3SI-4 | Same topic: Endpoint Protection (editorial pick) |
| ISM-1660 | ML2, ML3 Allowed and blocked application control events are centrally logged | Editorial | AU-2AU-3AU-11+1 | Same topic: Logging & Audit (editorial pick) |
| ISM-1870 | ML1, ML2, ML3 Application control is applied to user profiles and temporary folders used by operating… | Editorial | CM-7(5)SI-3SI-4 | Same topic: Endpoint Protection (editorial pick) |
| Restrict Microsoft Office macros · 1 | ||||
| ISM-1488 | ML1, ML2, ML3 Microsoft Office macros in files originating from the internet are blocked | Editorial | CM-7(5)SI-3SI-4+1 | Same topic: Endpoint Protection, Email Security (editorial pick) |
| User application hardening · 7 | ||||
| ISM-1412 | ML2, ML3 Web browsers are hardened using ASD and vendor hardening guidance, with the most… | Editorial | CM-2CM-6CM-7 | Same topic: Secure Config (editorial pick) |
| ISM-1585 | ML1, ML2, ML3 Web browser security settings cannot be changed by human users | Editorial | CM-2CM-6CM-7 | Same topic: Secure Config (editorial pick) |
| ISM-1621 | ML3 Windows PowerShell 2.0 is disabled or removed | Editorial | CM-2CM-6CM-7 | Same topic: Secure Config (editorial pick) |
| ISM-1623 | ML2, ML3 PowerShell module logging, script block logging and transcription events are centrally… | Editorial | AU-2AU-3AU-11+1 | Same topic: Logging & Audit (editorial pick) |
| ISM-1654 | ML1, ML2, ML3 Internet Explorer 11 is disabled or removed | Editorial | CM-2CM-6CM-7 | Same topic: Secure Config (editorial pick) |
| ISM-1859 | ML2, ML3 Office productivity suites are hardened using ASD and vendor hardening guidance, with… | Editorial | CM-2CM-6CM-7 | Same topic: Secure Config (editorial pick) |
| ISM-1860 | ML2, ML3 PDF applications are hardened using ASD and vendor hardening guidance, with the most… | Editorial | CM-2CM-6CM-7 | Same topic: Secure Config (editorial pick) |
| Regular backups · 6 | ||||
| ISM-1511 | ML1, ML2, ML3 Backups of data, applications and settings are performed and retained in accordance… | Editorial | CP-6CP-9 | Same topic: Backup & Recovery (editorial pick) |
| ISM-1515 | ML1, ML2, ML3 Restoration of data, applications and settings from backups to a common point in time… | Editorial | CP-6CP-7CP-9+1 | Same topic: Backup & Recovery, Disaster Recovery (editorial pick) |
| ISM-1707 | ML2, ML3 Privileged user accounts (excluding backup administrator accounts) are prevented from… | Editorial | CP-6CP-9 | Same topic: Backup & Recovery (editorial pick) |
| ISM-1810 | ML1, ML2, ML3 Backups of data, applications and settings are synchronised to enable restoration to a… | Editorial | CP-6CP-9 | Same topic: Backup & Recovery (editorial pick) |
| ISM-1811 | ML1, ML2, ML3 Backups of data, applications and settings are retained in a secure and resilient manner | Editorial | CP-6CP-9 | Same topic: Backup & Recovery (editorial pick) |
| ISM-1814 | ML1, ML2, ML3 Unprivileged user accounts are prevented from modifying and deleting backups | Editorial | CP-6CP-9 | Same topic: Backup & Recovery (editorial pick) |
| Logging and incident response (all strategies) · 8 | ||||
| ISM-0109 | ML3 Event logs from workstations are analysed in a timely manner to detect cyber security… | Editorial | CA-7SI-4 | Same topic: Cont. Monitoring (editorial pick) |
| ISM-0123 | ML2, ML3 Cyber security incidents are reported to the chief information security officer, or one… | Editorial | IR-6 | Same topic: Reporting (editorial pick) |
| ISM-0140 | ML2, ML3 Cyber security incidents are reported to ASD as soon as possible after they occur or… | Editorial | IR-6 | Same topic: Reporting (editorial pick) |
| ISM-1228 | ML2, ML3 Cyber security events are analysed in a timely manner to identify cyber security incidents | Editorial | AU-6AU-6(3)IR-5+1 | Same topic: Anomaly Detection, SIEM / SOC (editorial pick) |
| ISM-1815 | ML2, ML3 Event logs are protected from unauthorised modification and deletion | Editorial | AU-2AU-3AU-11+1 | Same topic: Logging & Audit (editorial pick) |
| ISM-1819 | ML2, ML3 Following the identification of a cyber security incident, the cyber security incident… | Editorial | IR-2IR-3IR-4+1 | Same topic: Incident Response (editorial pick) |
| ISM-1906 | ML2, ML3 Event logs from internet-facing servers are analysed in a timely manner to detect cyber… | Editorial | AU-6AU-6(3)CA-7+2 | Same topic: SIEM / SOC, Cont. Monitoring (editorial pick) |
| ISM-1907 | ML3 Event logs from non-internet-facing servers are analysed in a timely manner to detect… | Editorial | CA-7SI-4 | Same topic: Cont. Monitoring (editorial pick) |
Of 300 NIST SP 800-53 Rev 5.2 requirements, 27 map to something in Essential Eight, 98 are only loosely related, and 175 have no mapping in our data.
Likely new work: 800-53 requirements with no mapping to Essential Eight (175)
| 800-53 | Requirement | Match | Essential Eight | Evidence |
|---|---|---|---|---|
| AC Access Control · 8 | ||||
| AC-1 | Policy and Procedures | No mapping in our data | — | No mapping to Essential Eight in our data. |
| AC-8 | System Use Notification | No mapping in our data | — | No mapping to Essential Eight in our data. |
| AC-11 | Device Lock | No mapping in our data | — | No mapping to Essential Eight in our data. |
| AC-14 | Permitted Actions Without Identification or Authentication | No mapping in our data | — | No mapping to Essential Eight in our data. |
| AC-21 | Information Sharing | No mapping in our data | — | No mapping to Essential Eight in our data. |
| AC-22 | Publicly Accessible Content | No mapping in our data | — | No mapping to Essential Eight in our data. |
| AC-23 | Data Mining Protection | No mapping in our data | — | No mapping to Essential Eight in our data. |
| AC-25 | Reference Monitor | No mapping in our data | — | No mapping to Essential Eight in our data. |
| AT Awareness and Training · 5 | ||||
| AT-1 | Policy and Procedures | No mapping in our data | — | No mapping to Essential Eight in our data. |
| AT-2 | Literacy Training and Awareness | No mapping in our data | — | No mapping to Essential Eight in our data. |
| AT-3 | Role-based Training | No mapping in our data | — | No mapping to Essential Eight in our data. |
| AT-4 | Training Records | No mapping in our data | — | No mapping to Essential Eight in our data. |
| AT-6 | Training Feedback | No mapping in our data | — | No mapping to Essential Eight in our data. |
| AU Audit and Accountability · 7 | ||||
| AU-1 | Policy and Procedures | No mapping in our data | — | No mapping to Essential Eight in our data. |
| AU-4 | Audit Log Storage Capacity | No mapping in our data | — | No mapping to Essential Eight in our data. |
| AU-5 | Response to Audit Logging Process Failures | No mapping in our data | — | No mapping to Essential Eight in our data. |
| AU-8 | Time Stamps | No mapping in our data | — | No mapping to Essential Eight in our data. |
| AU-9 | Protection of Audit Information | No mapping in our data | — | No mapping to Essential Eight in our data. |
| AU-10 | Non-repudiation | No mapping in our data | — | No mapping to Essential Eight in our data. |
| AU-14 | Session Audit | No mapping in our data | — | No mapping to Essential Eight in our data. |
| CA Assessment, Authorization and Monitoring · 4 | ||||
| CA-1 | Policy and Procedures | No mapping in our data | — | No mapping to Essential Eight in our data. |
| CA-5 | Plan of Action and Milestones | No mapping in our data | — | No mapping to Essential Eight in our data. |
| CA-6 | Authorization | No mapping in our data | — | No mapping to Essential Eight in our data. |
| CA-9 | Internal System Connections | No mapping in our data | — | No mapping to Essential Eight in our data. |
| CM Configuration Management · 3 | ||||
| CM-1 | Policy and Procedures | No mapping in our data | — | No mapping to Essential Eight in our data. |
| CM-12 | Information Location | No mapping in our data | — | No mapping to Essential Eight in our data. |
| CM-14 | Signed Components | No mapping in our data | — | No mapping to Essential Eight in our data. |
| CP Contingency Planning · 6 | ||||
| CP-1 | Policy and Procedures | No mapping in our data | — | No mapping to Essential Eight in our data. |
| CP-3 | Contingency Training | No mapping in our data | — | No mapping to Essential Eight in our data. |
| CP-8 | Telecommunications Services | No mapping in our data | — | No mapping to Essential Eight in our data. |
| CP-11 | Alternate Communications Protocols | No mapping in our data | — | No mapping to Essential Eight in our data. |
| CP-12 | Safe Mode | No mapping in our data | — | No mapping to Essential Eight in our data. |
| CP-13 | Alternative Security Mechanisms | No mapping in our data | — | No mapping to Essential Eight in our data. |
| IA Identification and Authentication · 4 | ||||
| IA-1 | Policy and Procedures | No mapping in our data | — | No mapping to Essential Eight in our data. |
| IA-4 | Identifier Management | No mapping in our data | — | No mapping to Essential Eight in our data. |
| IA-6 | Authentication Feedback | No mapping in our data | — | No mapping to Essential Eight in our data. |
| IA-12 | Identity Proofing | No mapping in our data | — | No mapping to Essential Eight in our data. |
| IR Incident Response · 2 | ||||
| IR-1 | Policy and Procedures | No mapping in our data | — | No mapping to Essential Eight in our data. |
| IR-9 | Information Spillage Response | No mapping in our data | — | No mapping to Essential Eight in our data. |
| MA Maintenance · 4 | ||||
| MA-1 | Policy and Procedures | No mapping in our data | — | No mapping to Essential Eight in our data. |
| MA-4 | Nonlocal Maintenance | No mapping in our data | — | No mapping to Essential Eight in our data. |
| MA-5 | Maintenance Personnel | No mapping in our data | — | No mapping to Essential Eight in our data. |
| MA-7 | Field Maintenance | No mapping in our data | — | No mapping to Essential Eight in our data. |
| MP Media Protection · 8 | ||||
| MP-1 | Policy and Procedures | No mapping in our data | — | No mapping to Essential Eight in our data. |
| MP-2 | Media Access | No mapping in our data | — | No mapping to Essential Eight in our data. |
| MP-3 | Media Marking | No mapping in our data | — | No mapping to Essential Eight in our data. |
| MP-4 | Media Storage | No mapping in our data | — | No mapping to Essential Eight in our data. |
| MP-5 | Media Transport | No mapping in our data | — | No mapping to Essential Eight in our data. |
| MP-6 | Media Sanitization | No mapping in our data | — | No mapping to Essential Eight in our data. |
| MP-7 | Media Use | No mapping in our data | — | No mapping to Essential Eight in our data. |
| MP-8 | Media Downgrading | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PE Physical and Environmental Protection · 22 | ||||
| PE-1 | Policy and Procedures | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PE-2 | Physical Access Authorizations | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PE-3 | Physical Access Control | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PE-4 | Access Control for Transmission | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PE-5 | Access Control for Output Devices | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PE-6 | Monitoring Physical Access | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PE-8 | Visitor Access Records | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PE-9 | Power Equipment and Cabling | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PE-10 | Emergency Shutoff | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PE-11 | Emergency Power | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PE-12 | Emergency Lighting | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PE-13 | Fire Protection | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PE-14 | Environmental Controls | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PE-15 | Water Damage Protection | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PE-16 | Delivery and Removal | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PE-17 | Alternate Work Site | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PE-18 | Location of System Components | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PE-19 | Information Leakage | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PE-20 | Asset Monitoring and Tracking | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PE-21 | Electromagnetic Pulse Protection | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PE-22 | Component Marking | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PE-23 | Facility Location | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PL Planning · 7 | ||||
| PL-1 | Policy and Procedures | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PL-4 | Rules of Behavior | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PL-7 | Concept of Operations | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PL-8 | Security and Privacy Architectures | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PL-9 | Central Management | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PL-10 | Baseline Selection | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PL-11 | Baseline Tailoring | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PM Program Management · 21 | ||||
| PM-1 | Information Security Program Plan | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PM-2 | Information Security Program Leadership Role | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PM-3 | Information Security and Privacy Resources | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PM-4 | Plan of Action and Milestones Process | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PM-6 | Measures of Performance | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PM-7 | Enterprise Architecture | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PM-8 | Critical Infrastructure Plan | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PM-10 | Authorization Process | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PM-13 | Security and Privacy Workforce | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PM-14 | Testing, Training, and Monitoring | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PM-17 | Protecting Controlled Unclassified Information on External Systems | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PM-19 | Privacy Program Leadership Role | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PM-20 | Dissemination of Privacy Program Information | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PM-21 | Accounting of Disclosures | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PM-24 | Data Integrity Board | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PM-25 | Minimization of Personally Identifiable Information Used in Testing, Training, and Research | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PM-26 | Complaint Management | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PM-27 | Privacy Reporting | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PM-29 | Risk Management Program Leadership Roles | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PM-31 | Continuous Monitoring Strategy | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PM-32 | Purposing | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PS Personnel Security · 9 | ||||
| PS-1 | Policy and Procedures | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PS-2 | Position Risk Designation | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PS-3 | Personnel Screening | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PS-4 | Personnel Termination | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PS-5 | Personnel Transfer | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PS-6 | Access Agreements | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PS-7 | External Personnel Security | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PS-8 | Personnel Sanctions | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PS-9 | Position Descriptions | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PT PII Processing and Transparency · 8 | ||||
| PT-1 | Policy and Procedures | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PT-2 | Authority to Process Personally Identifiable Information | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PT-3 | Personally Identifiable Information Processing Purposes | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PT-4 | Consent | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PT-5 | Privacy Notice | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PT-6 | System of Records Notice | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PT-7 | Specific Categories of Personally Identifiable Information | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PT-8 | Computer Matching Requirements | No mapping in our data | — | No mapping to Essential Eight in our data. |
| RA Risk Assessment · 6 | ||||
| RA-1 | Policy and Procedures | No mapping in our data | — | No mapping to Essential Eight in our data. |
| RA-2 | Security Categorization | No mapping in our data | — | No mapping to Essential Eight in our data. |
| RA-6 | Technical Surveillance Countermeasures Survey | No mapping in our data | — | No mapping to Essential Eight in our data. |
| RA-7 | Risk Response | No mapping in our data | — | No mapping to Essential Eight in our data. |
| RA-8 | Privacy Impact Assessments | No mapping in our data | — | No mapping to Essential Eight in our data. |
| RA-9 | Criticality Analysis | No mapping in our data | — | No mapping to Essential Eight in our data. |
| SA System and Services Acquisition · 7 | ||||
| SA-1 | Policy and Procedures | No mapping in our data | — | No mapping to Essential Eight in our data. |
| SA-2 | Allocation of Resources | No mapping in our data | — | No mapping to Essential Eight in our data. |
| SA-16 | Developer-provided Training | No mapping in our data | — | No mapping to Essential Eight in our data. |
| SA-17 | Developer Security and Privacy Architecture and Design | No mapping in our data | — | No mapping to Essential Eight in our data. |
| SA-20 | Customized Development of Critical Components | No mapping in our data | — | No mapping to Essential Eight in our data. |
| SA-21 | Developer Screening | No mapping in our data | — | No mapping to Essential Eight in our data. |
| SA-23 | Specialization | No mapping in our data | — | No mapping to Essential Eight in our data. |
| SC System and Communications Protection · 25 | ||||
| SC-1 | Policy and Procedures | No mapping in our data | — | No mapping to Essential Eight in our data. |
| SC-2 | Separation of System and User Functionality | No mapping in our data | — | No mapping to Essential Eight in our data. |
| SC-10 | Network Disconnect | No mapping in our data | — | No mapping to Essential Eight in our data. |
| SC-15 | Collaborative Computing Devices and Applications | No mapping in our data | — | No mapping to Essential Eight in our data. |
| SC-17 | Public Key Infrastructure Certificates | No mapping in our data | — | No mapping to Essential Eight in our data. |
| SC-18 | Mobile Code | No mapping in our data | — | No mapping to Essential Eight in our data. |
| SC-23 | Session Authenticity | No mapping in our data | — | No mapping to Essential Eight in our data. |
| SC-25 | Thin Nodes | No mapping in our data | — | No mapping to Essential Eight in our data. |
| SC-26 | Decoys | No mapping in our data | — | No mapping to Essential Eight in our data. |
| SC-27 | Platform-independent Applications | No mapping in our data | — | No mapping to Essential Eight in our data. |
| SC-28 | Protection of Information at Rest | No mapping in our data | — | No mapping to Essential Eight in our data. |
| SC-29 | Heterogeneity | No mapping in our data | — | No mapping to Essential Eight in our data. |
| SC-30 | Concealment and Misdirection | No mapping in our data | — | No mapping to Essential Eight in our data. |
| SC-31 | Covert Channel Analysis | No mapping in our data | — | No mapping to Essential Eight in our data. |
| SC-32 | System Partitioning | No mapping in our data | — | No mapping to Essential Eight in our data. |
| SC-37 | Out-of-band Channels | No mapping in our data | — | No mapping to Essential Eight in our data. |
| SC-38 | Operations Security | No mapping in our data | — | No mapping to Essential Eight in our data. |
| SC-41 | Port and I/O Device Access | No mapping in our data | — | No mapping to Essential Eight in our data. |
| SC-42 | Sensor Capability and Data | No mapping in our data | — | No mapping to Essential Eight in our data. |
| SC-44 | Detonation Chambers | No mapping in our data | — | No mapping to Essential Eight in our data. |
| SC-45 | System Time Synchronization | No mapping in our data | — | No mapping to Essential Eight in our data. |
| SC-46 | Cross Domain Policy Enforcement | No mapping in our data | — | No mapping to Essential Eight in our data. |
| SC-47 | Alternate Communications Paths | No mapping in our data | — | No mapping to Essential Eight in our data. |
| SC-48 | Sensor Relocation | No mapping in our data | — | No mapping to Essential Eight in our data. |
| SC-50 | Software-enforced Separation and Policy Enforcement | No mapping in our data | — | No mapping to Essential Eight in our data. |
| SI System and Information Integrity · 12 | ||||
| SI-1 | Policy and Procedures | No mapping in our data | — | No mapping to Essential Eight in our data. |
| SI-6 | Security and Privacy Function Verification | No mapping in our data | — | No mapping to Essential Eight in our data. |
| SI-11 | Error Handling | No mapping in our data | — | No mapping to Essential Eight in our data. |
| SI-14 | Non-persistence | No mapping in our data | — | No mapping to Essential Eight in our data. |
| SI-15 | Information Output Filtering | No mapping in our data | — | No mapping to Essential Eight in our data. |
| SI-16 | Memory Protection | No mapping in our data | — | No mapping to Essential Eight in our data. |
| SI-17 | Fail-safe Procedures | No mapping in our data | — | No mapping to Essential Eight in our data. |
| SI-19 | De-identification | No mapping in our data | — | No mapping to Essential Eight in our data. |
| SI-20 | Tainting | No mapping in our data | — | No mapping to Essential Eight in our data. |
| SI-21 | Information Refresh | No mapping in our data | — | No mapping to Essential Eight in our data. |
| SI-22 | Information Diversity | No mapping in our data | — | No mapping to Essential Eight in our data. |
| SI-23 | Information Fragmentation | No mapping in our data | — | No mapping to Essential Eight in our data. |
| SR Supply Chain Risk Management · 7 | ||||
| SR-1 | Policy and Procedures | No mapping in our data | — | No mapping to Essential Eight in our data. |
| SR-4 | Provenance | No mapping in our data | — | No mapping to Essential Eight in our data. |
| SR-6 | Supplier Assessments and Reviews | No mapping in our data | — | No mapping to Essential Eight in our data. |
| SR-7 | Supply Chain Operations Security | No mapping in our data | — | No mapping to Essential Eight in our data. |
| SR-9 | Tamper Resistance and Detection | No mapping in our data | — | No mapping to Essential Eight in our data. |
| SR-10 | Inspection of Systems or Components | No mapping in our data | — | No mapping to Essential Eight in our data. |
| SR-11 | Component Authenticity | No mapping in our data | — | No mapping to Essential Eight in our data. |
Check these: only loosely related (a shared CSF outcome, not a mapping) (98)
| 800-53 | Requirement | Match | Essential Eight | Evidence |
|---|---|---|---|---|
| AC Access Control · 15 | ||||
| AC-2 | Account Management | ISM-0109ISM-1906ISM-1907+5 | Only shares CSF DE.CM-01, DE.CM-03: related, not a mapping | |
| AC-3 | Access Enforcement | ISM-0445ISM-1175ISM-1380+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| AC-4 | Information Flow Enforcement | ISM-0109ISM-0843ISM-1228+5 | Only shares CSF DE.CM-09: related, not a mapping | |
| AC-5 | Separation of Duties | ISM-0445ISM-1175ISM-1380+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| AC-6 | Least Privilege | ISM-0445ISM-1175ISM-1380+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| AC-7 | Unsuccessful Logon Attempts | ISM-0974ISM-1173ISM-1401+5 | Only shares CSF PR.AA-03: related, not a mapping | |
| AC-9 | Previous Logon Notification | ISM-0109ISM-0843ISM-1228+5 | Only shares CSF DE.CM-09: related, not a mapping | |
| AC-10 | Concurrent Session Control | ISM-0445ISM-1175ISM-1380+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| AC-12 | Session Termination | ISM-0974ISM-1173ISM-1401+5 | Only shares CSF PR.AA-03: related, not a mapping | |
| AC-16 | Security and Privacy Attributes | ISM-0445ISM-1175ISM-1380+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| AC-17 | Remote Access | ISM-0445ISM-1175ISM-1380+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| AC-18 | Wireless Access | ISM-0445ISM-1175ISM-1380+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| AC-19 | Access Control for Mobile Devices | ISM-0445ISM-1175ISM-1380+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| AC-20 | Use of External Systems | ISM-1807 | Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping | |
| AC-24 | Access Control Decisions | ISM-0445ISM-1175ISM-1380+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| AU Audit and Accountability · 3 | ||||
| AU-7 | Audit Record Reduction and Report Generation | ISM-1509ISM-1623ISM-1660+2 | Only shares CSF PR.PS-04: related, not a mapping | |
| AU-13 | Monitoring for Information Disclosure | ISM-0109ISM-1906ISM-1907 | Only shares CSF DE.CM-03: related, not a mapping | |
| AU-16 | Cross-organizational Audit Logging | ISM-1488 | Only shares CSF PR.DS-02: related, not a mapping | |
| CA Assessment, Authorization and Monitoring · 2 | ||||
| CA-2 | Control Assessments | ISM-0304ISM-1407ISM-1501+5 | Only shares CSF ID.RA-01: related, not a mapping | |
| CA-3 | Information Exchange | ISM-1488 | Only shares CSF PR.DS-02: related, not a mapping | |
| CM Configuration Management · 7 | ||||
| CM-3 | Configuration Change Control | ISM-0109ISM-1488ISM-1906+5 | Only shares CSF DE.CM-01, DE.CM-09, PR.PS-01: related, not a mapping | |
| CM-4 | Impact Analyses | ISM-1412ISM-1485ISM-1486+5 | Only shares CSF PR.PS-01: related, not a mapping | |
| CM-5 | Access Restrictions for Change | ISM-1412ISM-1485ISM-1486+5 | Only shares CSF PR.PS-01: related, not a mapping | |
| CM-9 | Configuration Management Plan | ISM-1412ISM-1485ISM-1486+5 | Only shares CSF PR.PS-01: related, not a mapping | |
| CM-10 | Software Usage Restrictions | ISM-0109ISM-1488ISM-1906+5 | Only shares CSF DE.CM-03, DE.CM-09, PR.PS-01: related, not a mapping | |
| CM-11 | User-installed Software | ISM-0109ISM-1488ISM-1906+5 | Only shares CSF DE.CM-03, DE.CM-09, PR.PS-01: related, not a mapping | |
| CM-13 | Data Action Mapping | ISM-1807 | Only shares CSF ID.AM-08: related, not a mapping | |
| CP Contingency Planning · 2 | ||||
| CP-2 | Contingency Plan | ISM-1511ISM-1515ISM-1705+5 | Only shares CSF RC.RP-03: related, not a mapping | |
| CP-4 | Contingency Plan Testing | ISM-1511ISM-1515ISM-1705+5 | Only shares CSF RC.RP-03: related, not a mapping | |
| IA Identification and Authentication · 9 | ||||
| IA-2 | Identification and Authentication (Organizational Users) | ISM-0974ISM-1173ISM-1401+5 | Only shares CSF PR.AA-03: related, not a mapping | |
| IA-3 | Device Identification and Authentication | ISM-0974ISM-1173ISM-1401+5 | Only shares CSF PR.AA-03: related, not a mapping | |
| IA-5 | Authenticator Management | ISM-0974ISM-1173ISM-1401+5 | Only shares CSF PR.AA-03: related, not a mapping | |
| IA-7 | Cryptographic Module Authentication | ISM-0974ISM-1173ISM-1401+5 | Only shares CSF PR.AA-03: related, not a mapping | |
| IA-8 | Identification and Authentication (Non-organizational Users) | ISM-0974ISM-1173ISM-1401+5 | Only shares CSF PR.AA-03: related, not a mapping | |
| IA-9 | Service Identification and Authentication | ISM-0974ISM-1173ISM-1401+5 | Only shares CSF PR.AA-03: related, not a mapping | |
| IA-10 | Adaptive Authentication | ISM-0974ISM-1173ISM-1401+5 | Only shares CSF PR.AA-03: related, not a mapping | |
| IA-11 | Re-authentication | ISM-0974ISM-1173ISM-1401+5 | Only shares CSF PR.AA-03: related, not a mapping | |
| IA-13 | Identity Providers and Authorization Servers | ISM-0445ISM-1175ISM-1380+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| IR Incident Response · 1 | ||||
| IR-7 | Incident Response Assistance | ISM-1819ISM-0123ISM-0140 | Only shares CSF RS.MA-01, RS.MA-04, RS.CO-02: related, not a mapping | |
| MA Maintenance · 3 | ||||
| MA-2 | Controlled Maintenance | ISM-1807 | Only shares CSF ID.AM-08: related, not a mapping | |
| MA-3 | Maintenance Tools | ISM-0304ISM-1407ISM-1501+5 | Only shares CSF PR.PS-02: related, not a mapping | |
| MA-6 | Timely Maintenance | ISM-1807 | Only shares CSF ID.AM-08: related, not a mapping | |
| PL Planning · 1 | ||||
| PL-2 | System Security and Privacy Plans | ISM-1807 | Only shares CSF ID.AM-08: related, not a mapping | |
| PM Program Management · 10 | ||||
| PM-9 | Risk Management Strategy | ISM-1228 | Only shares CSF DE.AE-04: related, not a mapping | |
| PM-11 | Mission and Business Process Definition | ISM-1228 | Only shares CSF DE.AE-04: related, not a mapping | |
| PM-12 | Insider Threat Program | ISM-0109ISM-1906ISM-1907 | Only shares CSF DE.CM-03: related, not a mapping | |
| PM-15 | Security and Privacy Groups and Associations | ISM-1228ISM-1906 | Only shares CSF DE.AE-06: related, not a mapping | |
| PM-16 | Threat Awareness Program | ISM-1228ISM-1906ISM-0109+5 | Only shares CSF DE.AE-03, DE.AE-06: related, not a mapping | |
| PM-18 | Privacy Program Plan | ISM-1228 | Only shares CSF DE.AE-04: related, not a mapping | |
| PM-22 | Personally Identifiable Information Quality Management | ISM-1807 | Only shares CSF ID.AM-08: related, not a mapping | |
| PM-23 | Data Governance Body | ISM-1807 | Only shares CSF ID.AM-08: related, not a mapping | |
| PM-28 | Risk Framing | ISM-1228 | Only shares CSF DE.AE-04: related, not a mapping | |
| PM-30 | Supply Chain Risk Management Strategy | ISM-1228 | Only shares CSF DE.AE-04: related, not a mapping | |
| RA Risk Assessment · 2 | ||||
| RA-3 | Risk Assessment | ISM-0304ISM-1407ISM-1501+5 | Only shares CSF ID.RA-01: related, not a mapping | |
| RA-10 | Threat Hunting | ISM-1228ISM-1906 | Only shares CSF DE.AE-06: related, not a mapping | |
| SA System and Services Acquisition · 10 | ||||
| SA-3 | System Development Life Cycle | ISM-1807 | Only shares CSF ID.AM-08: related, not a mapping | |
| SA-4 | Acquisition Process | ISM-1807 | Only shares CSF ID.AM-08: related, not a mapping | |
| SA-5 | System Documentation | ISM-1807 | Only shares CSF ID.AM-02: related, not a mapping | |
| SA-8 | Security and Privacy Engineering Principles | ISM-1515ISM-1807 | Only shares CSF PR.IR-03, ID.AM-08: related, not a mapping | |
| SA-9 | External System Services | ISM-1807 | Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping | |
| SA-10 | Developer Configuration Management | ISM-1407ISM-1501ISM-1694+5 | Only shares CSF PR.PS-02, PR.PS-03: related, not a mapping | |
| SA-11 | Developer Testing and Evaluation | ISM-0304ISM-1407ISM-1501+5 | Only shares CSF ID.RA-01: related, not a mapping | |
| SA-15 | Development Process, Standards, and Tools | ISM-0304ISM-1407ISM-1501+5 | Only shares CSF ID.RA-01: related, not a mapping | |
| SA-22 | Unsupported System Components | ISM-1807 | Only shares CSF ID.AM-08: related, not a mapping | |
| SA-24 | Design For Cyber Resiliency | ISM-1515 | Only shares CSF PR.IR-03: related, not a mapping | |
| SC System and Communications Protection · 22 | ||||
| SC-3 | Security Function Isolation | ISM-1407ISM-1501ISM-1694+5 | Only shares CSF PR.PS-03: related, not a mapping | |
| SC-4 | Information in Shared System Resources | ISM-1488 | Only shares CSF PR.DS-02: related, not a mapping | |
| SC-5 | Denial-of-service Protection | ISM-0109ISM-1906ISM-1907 | Only shares CSF DE.CM-01: related, not a mapping | |
| SC-6 | Resource Availability | ISM-1515 | Only shares CSF PR.IR-03: related, not a mapping | |
| SC-7 | Boundary Protection | ISM-0109ISM-1488ISM-1906+1 | Only shares CSF DE.CM-01, PR.DS-02: related, not a mapping | |
| SC-8 | Transmission Confidentiality and Integrity | ISM-1488 | Only shares CSF PR.DS-02: related, not a mapping | |
| SC-11 | Trusted Path | ISM-1488 | Only shares CSF PR.DS-02: related, not a mapping | |
| SC-12 | Cryptographic Key Establishment and Management | ISM-1488 | Only shares CSF PR.DS-02: related, not a mapping | |
| SC-13 | Cryptographic Protection | ISM-1488 | Only shares CSF PR.DS-02: related, not a mapping | |
| SC-16 | Transmission of Security and Privacy Attributes | ISM-1488 | Only shares CSF PR.DS-02: related, not a mapping | |
| SC-20 | Secure Name/Address Resolution Service (Authoritative Source) | ISM-0109ISM-1906ISM-1907 | Only shares CSF DE.CM-01: related, not a mapping | |
| SC-21 | Secure Name/Address Resolution Service (Recursive or Caching Resolver) | ISM-0109ISM-1906ISM-1907 | Only shares CSF DE.CM-01: related, not a mapping | |
| SC-22 | Architecture and Provisioning for Name/Address Resolution Service | ISM-0109ISM-1906ISM-1907 | Only shares CSF DE.CM-01: related, not a mapping | |
| SC-24 | Fail in Known State | ISM-1515 | Only shares CSF PR.IR-03: related, not a mapping | |
| SC-34 | Non-modifiable Executable Programs | ISM-0843ISM-1488ISM-1490+5 | Only shares CSF DE.CM-09, PR.PS-05: related, not a mapping | |
| SC-35 | External Malicious Code Identification | ISM-0109ISM-0843ISM-1228+5 | Only shares CSF DE.CM-09: related, not a mapping | |
| SC-36 | Distributed Processing and Storage | ISM-1515 | Only shares CSF PR.IR-03: related, not a mapping | |
| SC-39 | Process Isolation | ISM-1407ISM-1501ISM-1515+5 | Only shares CSF PR.PS-03, PR.IR-03: related, not a mapping | |
| SC-40 | Wireless Link Protection | ISM-1488 | Only shares CSF PR.DS-02: related, not a mapping | |
| SC-43 | Usage Restrictions | ISM-1488 | Only shares CSF PR.DS-02: related, not a mapping | |
| SC-49 | Hardware-enforced Separation and Policy Enforcement | ISM-1407ISM-1501ISM-1694+5 | Only shares CSF PR.PS-03: related, not a mapping | |
| SC-51 | Hardware-based Protection | ISM-1407ISM-1501ISM-1694+5 | Only shares CSF PR.PS-03: related, not a mapping | |
| SI System and Information Integrity · 6 | ||||
| SI-5 | Security Alerts, Advisories, and Directives | ISM-0304ISM-1407ISM-1501+5 | Only shares CSF ID.RA-01: related, not a mapping | |
| SI-7 | Software, Firmware, and Information Integrity | ISM-1488ISM-0109ISM-0304+5 | Only shares CSF DE.CM-09, PR.DS-02, PR.PS-02: related, not a mapping | |
| SI-10 | Information Input Validation | ISM-0974ISM-1173ISM-1401+5 | Only shares CSF PR.AA-03: related, not a mapping | |
| SI-12 | Information Management and Retention | ISM-1807 | Only shares CSF ID.AM-08: related, not a mapping | |
| SI-13 | Predictable Failure Prevention | ISM-1515 | Only shares CSF PR.IR-03: related, not a mapping | |
| SI-18 | Personally Identifiable Information Quality Operations | ISM-1807 | Only shares CSF ID.AM-08: related, not a mapping | |
| SR Supply Chain Risk Management · 5 | ||||
| SR-2 | Supply Chain Risk Management Plan | ISM-1807 | Only shares CSF ID.AM-04: related, not a mapping | |
| SR-3 | Supply Chain Controls and Processes | ISM-0123ISM-0140ISM-1819 | Only shares CSF RS.CO-02, RS.MA-01: related, not a mapping | |
| SR-5 | Acquisition Strategies, Tools, and Methods | ISM-1807 | Only shares CSF ID.AM-08: related, not a mapping | |
| SR-8 | Notification Agreements | ISM-0123ISM-0140ISM-1819 | Only shares CSF RS.CO-02, RS.MA-01: related, not a mapping | |
| SR-12 | Component Disposal | ISM-1807 | Only shares CSF ID.AM-08: related, not a mapping | |
Mapped (27)
| 800-53 | Requirement | Match | Essential Eight | Evidence |
|---|---|---|---|---|
| AU Audit and Accountability · 5 | ||||
| AU-2 | Event Logging | Editorial | ISM-1509ISM-1623ISM-1660+2 | Same topic: Logging & Audit (editorial pick) |
| AU-3 | Content of Audit Records | Editorial | ISM-1509ISM-1623ISM-1660+2 | Same topic: Logging & Audit (editorial pick) |
| AU-6 | Audit Record Review, Analysis, and Reporting | Editorial | ISM-1228ISM-1906 | Same topic: Anomaly Detection, SIEM / SOC (editorial pick) |
| AU-11 | Audit Record Retention | Editorial | ISM-1509ISM-1623ISM-1660+2 | Same topic: Logging & Audit (editorial pick) |
| AU-12 | Audit Record Generation | Editorial | ISM-1509ISM-1623ISM-1660+2 | Same topic: Logging & Audit (editorial pick) |
| CA Assessment, Authorization and Monitoring · 2 | ||||
| CA-7 | Continuous Monitoring | Editorial | ISM-0109ISM-1906ISM-1907 | Same topic: Cont. Monitoring (editorial pick) |
| CA-8 | Penetration Testing | Editorial | ISM-1698ISM-1699ISM-1701+3 | Same topic: Vulnerability Mgmt (editorial pick) |
| CM Configuration Management · 4 | ||||
| CM-2 | Baseline Configuration | Editorial | ISM-1412ISM-1585ISM-1621+3 | Same topic: Secure Config (editorial pick) |
| CM-6 | Configuration Settings | Editorial | ISM-1412ISM-1585ISM-1621+3 | Same topic: Secure Config (editorial pick) |
| CM-7 | Least Functionality | Editorial | ISM-1412ISM-1585ISM-1621+3 | Same topic: Secure Config (editorial pick) |
| CM-8 | System Component Inventory | Editorial | ISM-1807 | Same topic: Asset Management (editorial pick) |
| CP Contingency Planning · 4 | ||||
| CP-6 | Alternate Storage Site | Editorial | ISM-1511ISM-1515ISM-1707+3 | Same topic: Backup & Recovery (editorial pick) |
| CP-7 | Alternate Processing Site | Editorial | ISM-1515 | Same topic: Disaster Recovery (editorial pick) |
| CP-9 | System Backup | Editorial | ISM-1511ISM-1515ISM-1707+3 | Same topic: Backup & Recovery (editorial pick) |
| CP-10 | System Recovery and Reconstitution | Editorial | ISM-1515 | Same topic: Disaster Recovery (editorial pick) |
| IR Incident Response · 6 | ||||
| IR-2 | Incident Response Training | Editorial | ISM-1819 | Same topic: Incident Response (editorial pick) |
| IR-3 | Incident Response Testing | Editorial | ISM-1819 | Same topic: Incident Response (editorial pick) |
| IR-4 | Incident Handling | Editorial | ISM-1819 | Same topic: Incident Response (editorial pick) |
| IR-5 | Incident Monitoring | Editorial | ISM-1228ISM-1906 | Same topic: SIEM / SOC (editorial pick) |
| IR-6 | Incident Reporting | Editorial | ISM-0123ISM-0140 | Same topic: Reporting (editorial pick) |
| IR-8 | Incident Response Plan | Editorial | ISM-1819 | Same topic: Incident Response (editorial pick) |
| PM Program Management · 1 | ||||
| PM-5 | System Inventory | Editorial | ISM-1807 | Same topic: Asset Management (editorial pick) |
| RA Risk Assessment · 1 | ||||
| RA-5 | Vulnerability Monitoring and Scanning | Editorial | ISM-1698ISM-1699ISM-1701+3 | Same topic: Vulnerability Mgmt (editorial pick) |
| SI System and Information Integrity · 4 | ||||
| SI-2 | Flaw Remediation | Editorial | ISM-1501ISM-1691ISM-1693+4 | Same topic: Patch Management (editorial pick) |
| SI-3 | Malicious Code Protection | Editorial | ISM-0843ISM-1488ISM-1490+3 | Same topic: Endpoint Protection, Email Security (editorial pick) |
| SI-4 | System Monitoring | Editorial | ISM-0109ISM-0843ISM-1228+7 | Same topic: Cont. Monitoring, Endpoint Protection, Anomaly Detection (editorial pick) |
| SI-8 | Spam Protection | Editorial | ISM-1488 | Same topic: Email Security (editorial pick) |
By topic
Both cover (16):
Asset ManagementVulnerability MgmtMulti-Factor AuthBackup & RecoveryPrivileged AccessEndpoint ProtectionPatch ManagementSecure ConfigEmail SecurityCont. MonitoringLogging & AuditAnomaly DetectionSIEM / SOCIncident ResponseReportingDisaster Recovery
Only 800-53 (34):
Governance PolicyAwareness & TrainingRisk ManagementSupply Chain RiskRoles & ResponsibilitiesComplianceRisk AssessmentBusiness EnvironmentData ClassificationThreat IntelligenceAccess ControlEncryptionData ProtectionFirewall / Net SegSecure DevelopmentWeb SecurityZero TrustMobile SecurityCloud SecurityDNS SecurityWAFDLPIntrusion DetectionForensicsCommunicationMitigationRecovery PlanningBusiness ContinuityLessons LearnedComms & RestoreAPI SecurityInsider ThreatVendor Risk MgmtPhysical Security
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Mapped = curated together in a ControlMapping topic, or linked directly. Crosswalks don't prove compliance. Methodology · Download the data · Report a mistake.