Comparison
800-53 vs NIS2
NIST SP 800-53 Rev 5.2 · NIS2 Implementing Regulation (EU) 2024/2690 · data 2026-10-27
Requirement-level comparison of NIST SP 800-53 Rev 5.2 and NIS2 Implementing Regulation (EU) 2024/2690, in both directions, derived from published crosswalks and ControlMapping's curated topics.
Of 49 NIS2 Implementing Regulation (EU) 2024/2690 requirements, 45 map to something in 800-53, 3 are only loosely related, and 1 have no mapping in our data.
NIS2 here is the technical measures of Implementing Regulation (EU) 2024/2690, which applies directly to digital-infrastructure and ICT-service providers; other NIS2 entities follow their country's transposition of Article 21. Incident reporting deadlines (Article 23) are not in scope. ENISA's mapping is non-binding.
Likely new work: NIS2 requirements with no mapping to 800-53 (1)
| NIS2 | Requirement | Match | 800-53 | Evidence |
|---|---|---|---|---|
| 12. Asset management · 1 | ||||
| 12.5 | Deposit, return or deletion of assets upon termination of employment | No mapping in our data | — | No mapping to 800-53 in our data. |
Check these: only loosely related (a shared CSF outcome, not a mapping) (3)
| NIS2 | Requirement | Match | 800-53 | Evidence |
|---|---|---|---|---|
| 6. Security in acquisition, development and maintenance · 1 | ||||
| 6.4 | Change management, repairs and maintenance | CA-7CM-3CM-4 | Only shares CSF ID.RA-07: related, not a mapping | |
| 10. Human resources security · 2 | ||||
| 10.1 | Human resources security | AT-3PM-13PS-7+3 | Only shares CSF PR.AT-02, GV.RR-04: related, not a mapping | |
| 10.3 | Termination or change of employment procedures | PM-13PS-7PS-9+2 | Only shares CSF GV.RR-04: related, not a mapping | |
Mapped (45)
| NIS2 | Requirement | Match | 800-53 | Evidence |
|---|---|---|---|---|
| 1. Policy on the security of network and information systems · 2 | ||||
| 1.1 | Policy on the security of network and information systems | Crosswalk | PL-1PM-1 | Same topic: Governance Policy |
| 1.2 | Roles, responsibilities and authorities | Crosswalk | PM-2PM-29PS-9 | Same topic: Roles & Responsibilities |
| 2. Risk management policy · 3 | ||||
| 2.1 | Risk management framework | Crosswalk | PM-9PM-28RA-3+1 | Same topic: Risk Management, Risk Assessment |
| 2.2 | Compliance monitoring | Crosswalk | PM-4PM-6CA-2 | Same topic: Compliance |
| 2.3 | Independent review of information and network security | Editorial | CA-2PM-4PM-6 | Same topic: Compliance (editorial pick) |
| 3. Incident handling · 6 | ||||
| 3.1 | Incident handling policy | Crosswalk | IR-4IR-8IR-2+1 | Same topic: Incident Response |
| 3.2 | Monitoring and logging | Crosswalk | AU-2AU-3AU-6+6 | Same topic: Logging & Audit, SIEM / SOC |
| 3.3 | Event reporting | Crosswalk | IR-6 | Same topic: Reporting |
| 3.4 | Event assessment and classification | Crosswalk | AU-6AU-6(3)IR-5+1 | Same topic: Anomaly Detection, SIEM / SOC |
| 3.5 | Incident response | Crosswalk | AU-7IR-4IR-8+3 | Same topic: Forensics, Incident Response, Mitigation |
| 3.6 | Post-incident reviews | Crosswalk | IR-4 | Same topic: Lessons Learned |
| 4. Business continuity and crisis management · 3 | ||||
| 4.1 | Business continuity and disaster recovery plan | Crosswalk | CP-2CP-2(8)CP-10+1 | Same topic: Recovery Planning, Business Continuity, Disaster Recovery |
| 4.2 | Backup management | Crosswalk | CP-6CP-9CP-10+1 | Same topic: Backup & Recovery, Disaster Recovery |
| 4.3 | Crisis management | Crosswalk | CP-2(8)CP-10IR-6+2 | Same topic: Business Continuity, Comms & Restore |
| 5. Supply chain security · 2 | ||||
| 5.1 | Supply chain security policy | Crosswalk | PM-30SA-4SA-9+4 | Same topic: Supply Chain Risk, Vendor Risk Mgmt |
| 5.2 | Directory of suppliers and service providers | Crosswalk | SA-4SA-9SR-6 | Same topic: Vendor Risk Mgmt |
| 6. Security in acquisition, development and maintenance · 9 | ||||
| 6.1 | Security in acquisition of ICT services, ICT systems or ICT products | Crosswalk | AC-20PM-30SA-4+5 | Same topic: Cloud Security, Supply Chain Risk, Vendor Risk Mgmt |
| 6.2 | Secure development life cycle | Crosswalk | SA-3SA-8SA-11+1 | Same topic: Secure Development |
| 6.3 | Configuration management | Crosswalk | CM-2CM-6CM-7 | Same topic: Secure Config |
| 6.5 | Security testing | Crosswalk | CA-8RA-5 | Same topic: Vulnerability Mgmt |
| 6.6 | Security patch management | Crosswalk | SI-2 | Same topic: Patch Management |
| 6.7 | Network security | Crosswalk | AC-4SC-7 | Same topic: Firewall / Net Seg |
| 6.8 | Network segmentation | Crosswalk | AC-3AC-4AC-6+2 | Same topic: Zero Trust, Firewall / Net Seg |
| 6.9 | Protection against malicious and unauthorised software | Crosswalk | CM-7(5)SI-3SI-4+1 | Same topic: Endpoint Protection, Email Security |
| 6.10 | Vulnerability handling and disclosure | Crosswalk | CA-8RA-5 | Same topic: Vulnerability Mgmt |
| 7. Assessing the effectiveness of cybersecurity risk-management measures · 1 | ||||
| 7.1 | Policies and procedures to assess the effectiveness of cybersecurity risk-management measures | Crosswalk | PM-9PM-28RA-7 | Same topic: Risk Management |
| 8. Basic cyber hygiene practices and security training · 2 | ||||
| 8.1 | Awareness raising and basic cyber hygiene practices | Crosswalk | AT-2AT-3 | Same topic: Awareness & Training |
| 8.2 | Security training | Crosswalk | AT-2AT-3 | Same topic: Awareness & Training |
| 9. Cryptography · 1 | ||||
| 9.1 | Cryptography | Crosswalk | SC-8SC-12SC-13+1 | Same topic: Encryption |
| 10. Human resources security · 2 | ||||
| 10.2 | Verification of Background | Crosswalk | AC-2(12)AU-13PM-12 | Same topic: Insider Threat |
| 10.4 | Disciplinary process | Crosswalk | AC-2(12)AU-13PM-12 | Same topic: Insider Threat |
| 11. Access control · 7 | ||||
| 11.1 | Access control policy | Crosswalk | AC-2AC-3AC-4+2 | Same topic: Access Control, Zero Trust |
| 11.2 | Management of access rights | Crosswalk | AC-2AC-3 | Same topic: Access Control |
| 11.3 | Privileged accounts and system administration accounts | Crosswalk | AC-2(7)AC-6(5) | Same topic: Privileged Access |
| 11.4 | Administration systems | Crosswalk | AC-2(7)AC-6(5) | Same topic: Privileged Access |
| 11.5 | Identification | Crosswalk | AC-2AC-3 | Same topic: Access Control |
| 11.6 | Authentication | Crosswalk | AC-3AC-4AC-6+3 | Same topic: Zero Trust |
| 11.7 | Multi-factor authentication | Crosswalk | IA-2(1)IA-2(2) | Same topic: Multi-Factor Auth |
| 12. Asset management · 4 | ||||
| 12.1 | Asset classification | Crosswalk | RA-2 | Same topic: Data Classification |
| 12.2 | Handling of assets | Crosswalk | SC-8SC-28SI-7 | Same topic: Data Protection |
| 12.3 | Removable media policy | Crosswalk | AC-4SC-7(10)SC-8+2 | Same topic: DLP, Data Protection |
| 12.4 | Asset inventory | Crosswalk | CM-8PM-5 | Same topic: Asset Management |
| 13. Environmental and physical security · 3 | ||||
| 13.1 | Supporting utilities | Crosswalk | PE-2PE-3PE-6+3 | Same topic: Physical Security |
| 13.2 | Protection against physical and environmental threats | Crosswalk | PE-2PE-3PE-6+3 | Same topic: Physical Security |
| 13.3 | Perimeter and physical access control | Crosswalk | PE-2PE-3PE-6+3 | Same topic: Physical Security |
Of 300 NIST SP 800-53 Rev 5.2 requirements, 76 map to something in NIS2, 117 are only loosely related, and 107 have no mapping in our data.
Likely new work: 800-53 requirements with no mapping to NIS2 (107)
| 800-53 | Requirement | Match | NIS2 | Evidence |
|---|---|---|---|---|
| AC Access Control · 6 | ||||
| AC-8 | System Use Notification | No mapping in our data | — | No mapping to NIS2 in our data. |
| AC-11 | Device Lock | No mapping in our data | — | No mapping to NIS2 in our data. |
| AC-21 | Information Sharing | No mapping in our data | — | No mapping to NIS2 in our data. |
| AC-22 | Publicly Accessible Content | No mapping in our data | — | No mapping to NIS2 in our data. |
| AC-23 | Data Mining Protection | No mapping in our data | — | No mapping to NIS2 in our data. |
| AC-25 | Reference Monitor | No mapping in our data | — | No mapping to NIS2 in our data. |
| AT Awareness and Training · 2 | ||||
| AT-4 | Training Records | No mapping in our data | — | No mapping to NIS2 in our data. |
| AT-6 | Training Feedback | No mapping in our data | — | No mapping to NIS2 in our data. |
| AU Audit and Accountability · 6 | ||||
| AU-4 | Audit Log Storage Capacity | No mapping in our data | — | No mapping to NIS2 in our data. |
| AU-5 | Response to Audit Logging Process Failures | No mapping in our data | — | No mapping to NIS2 in our data. |
| AU-8 | Time Stamps | No mapping in our data | — | No mapping to NIS2 in our data. |
| AU-9 | Protection of Audit Information | No mapping in our data | — | No mapping to NIS2 in our data. |
| AU-10 | Non-repudiation | No mapping in our data | — | No mapping to NIS2 in our data. |
| AU-14 | Session Audit | No mapping in our data | — | No mapping to NIS2 in our data. |
| CA Assessment, Authorization and Monitoring · 2 | ||||
| CA-5 | Plan of Action and Milestones | No mapping in our data | — | No mapping to NIS2 in our data. |
| CA-6 | Authorization | No mapping in our data | — | No mapping to NIS2 in our data. |
| CM Configuration Management · 1 | ||||
| CM-14 | Signed Components | No mapping in our data | — | No mapping to NIS2 in our data. |
| CP Contingency Planning · 6 | ||||
| CP-3 | Contingency Training | No mapping in our data | — | No mapping to NIS2 in our data. |
| CP-4 | Contingency Plan Testing | No mapping in our data | — | No mapping to NIS2 in our data. |
| CP-8 | Telecommunications Services | No mapping in our data | — | No mapping to NIS2 in our data. |
| CP-11 | Alternate Communications Protocols | No mapping in our data | — | No mapping to NIS2 in our data. |
| CP-12 | Safe Mode | No mapping in our data | — | No mapping to NIS2 in our data. |
| CP-13 | Alternative Security Mechanisms | No mapping in our data | — | No mapping to NIS2 in our data. |
| IA Identification and Authentication · 1 | ||||
| IA-12 | Identity Proofing | No mapping in our data | — | No mapping to NIS2 in our data. |
| IR Incident Response · 1 | ||||
| IR-9 | Information Spillage Response | No mapping in our data | — | No mapping to NIS2 in our data. |
| MA Maintenance · 3 | ||||
| MA-4 | Nonlocal Maintenance | No mapping in our data | — | No mapping to NIS2 in our data. |
| MA-5 | Maintenance Personnel | No mapping in our data | — | No mapping to NIS2 in our data. |
| MA-7 | Field Maintenance | No mapping in our data | — | No mapping to NIS2 in our data. |
| MP Media Protection · 6 | ||||
| MP-2 | Media Access | No mapping in our data | — | No mapping to NIS2 in our data. |
| MP-3 | Media Marking | No mapping in our data | — | No mapping to NIS2 in our data. |
| MP-4 | Media Storage | No mapping in our data | — | No mapping to NIS2 in our data. |
| MP-5 | Media Transport | No mapping in our data | — | No mapping to NIS2 in our data. |
| MP-6 | Media Sanitization | No mapping in our data | — | No mapping to NIS2 in our data. |
| MP-7 | Media Use | No mapping in our data | — | No mapping to NIS2 in our data. |
| PE Physical and Environmental Protection · 4 | ||||
| PE-16 | Delivery and Removal | No mapping in our data | — | No mapping to NIS2 in our data. |
| PE-17 | Alternate Work Site | No mapping in our data | — | No mapping to NIS2 in our data. |
| PE-21 | Electromagnetic Pulse Protection | No mapping in our data | — | No mapping to NIS2 in our data. |
| PE-22 | Component Marking | No mapping in our data | — | No mapping to NIS2 in our data. |
| PL Planning · 5 | ||||
| PL-4 | Rules of Behavior | No mapping in our data | — | No mapping to NIS2 in our data. |
| PL-7 | Concept of Operations | No mapping in our data | — | No mapping to NIS2 in our data. |
| PL-9 | Central Management | No mapping in our data | — | No mapping to NIS2 in our data. |
| PL-10 | Baseline Selection | No mapping in our data | — | No mapping to NIS2 in our data. |
| PL-11 | Baseline Tailoring | No mapping in our data | — | No mapping to NIS2 in our data. |
| PM Program Management · 9 | ||||
| PM-10 | Authorization Process | No mapping in our data | — | No mapping to NIS2 in our data. |
| PM-14 | Testing, Training, and Monitoring | No mapping in our data | — | No mapping to NIS2 in our data. |
| PM-17 | Protecting Controlled Unclassified Information on External Systems | No mapping in our data | — | No mapping to NIS2 in our data. |
| PM-20 | Dissemination of Privacy Program Information | No mapping in our data | — | No mapping to NIS2 in our data. |
| PM-21 | Accounting of Disclosures | No mapping in our data | — | No mapping to NIS2 in our data. |
| PM-25 | Minimization of Personally Identifiable Information Used in Testing, Training, and Research | No mapping in our data | — | No mapping to NIS2 in our data. |
| PM-26 | Complaint Management | No mapping in our data | — | No mapping to NIS2 in our data. |
| PM-27 | Privacy Reporting | No mapping in our data | — | No mapping to NIS2 in our data. |
| PM-32 | Purposing | No mapping in our data | — | No mapping to NIS2 in our data. |
| PS Personnel Security · 6 | ||||
| PS-2 | Position Risk Designation | No mapping in our data | — | No mapping to NIS2 in our data. |
| PS-3 | Personnel Screening | No mapping in our data | — | No mapping to NIS2 in our data. |
| PS-4 | Personnel Termination | No mapping in our data | — | No mapping to NIS2 in our data. |
| PS-5 | Personnel Transfer | No mapping in our data | — | No mapping to NIS2 in our data. |
| PS-6 | Access Agreements | No mapping in our data | — | No mapping to NIS2 in our data. |
| PS-8 | Personnel Sanctions | No mapping in our data | — | No mapping to NIS2 in our data. |
| PT PII Processing and Transparency · 7 | ||||
| PT-2 | Authority to Process Personally Identifiable Information | No mapping in our data | — | No mapping to NIS2 in our data. |
| PT-3 | Personally Identifiable Information Processing Purposes | No mapping in our data | — | No mapping to NIS2 in our data. |
| PT-4 | Consent | No mapping in our data | — | No mapping to NIS2 in our data. |
| PT-5 | Privacy Notice | No mapping in our data | — | No mapping to NIS2 in our data. |
| PT-6 | System of Records Notice | No mapping in our data | — | No mapping to NIS2 in our data. |
| PT-7 | Specific Categories of Personally Identifiable Information | No mapping in our data | — | No mapping to NIS2 in our data. |
| PT-8 | Computer Matching Requirements | No mapping in our data | — | No mapping to NIS2 in our data. |
| RA Risk Assessment · 1 | ||||
| RA-6 | Technical Surveillance Countermeasures Survey | No mapping in our data | — | No mapping to NIS2 in our data. |
| SA System and Services Acquisition · 5 | ||||
| SA-2 | Allocation of Resources | No mapping in our data | — | No mapping to NIS2 in our data. |
| SA-16 | Developer-provided Training | No mapping in our data | — | No mapping to NIS2 in our data. |
| SA-20 | Customized Development of Critical Components | No mapping in our data | — | No mapping to NIS2 in our data. |
| SA-21 | Developer Screening | No mapping in our data | — | No mapping to NIS2 in our data. |
| SA-23 | Specialization | No mapping in our data | — | No mapping to NIS2 in our data. |
| SC System and Communications Protection · 22 | ||||
| SC-2 | Separation of System and User Functionality | No mapping in our data | — | No mapping to NIS2 in our data. |
| SC-10 | Network Disconnect | No mapping in our data | — | No mapping to NIS2 in our data. |
| SC-15 | Collaborative Computing Devices and Applications | No mapping in our data | — | No mapping to NIS2 in our data. |
| SC-17 | Public Key Infrastructure Certificates | No mapping in our data | — | No mapping to NIS2 in our data. |
| SC-18 | Mobile Code | No mapping in our data | — | No mapping to NIS2 in our data. |
| SC-23 | Session Authenticity | No mapping in our data | — | No mapping to NIS2 in our data. |
| SC-25 | Thin Nodes | No mapping in our data | — | No mapping to NIS2 in our data. |
| SC-26 | Decoys | No mapping in our data | — | No mapping to NIS2 in our data. |
| SC-27 | Platform-independent Applications | No mapping in our data | — | No mapping to NIS2 in our data. |
| SC-29 | Heterogeneity | No mapping in our data | — | No mapping to NIS2 in our data. |
| SC-30 | Concealment and Misdirection | No mapping in our data | — | No mapping to NIS2 in our data. |
| SC-31 | Covert Channel Analysis | No mapping in our data | — | No mapping to NIS2 in our data. |
| SC-37 | Out-of-band Channels | No mapping in our data | — | No mapping to NIS2 in our data. |
| SC-38 | Operations Security | No mapping in our data | — | No mapping to NIS2 in our data. |
| SC-41 | Port and I/O Device Access | No mapping in our data | — | No mapping to NIS2 in our data. |
| SC-42 | Sensor Capability and Data | No mapping in our data | — | No mapping to NIS2 in our data. |
| SC-44 | Detonation Chambers | No mapping in our data | — | No mapping to NIS2 in our data. |
| SC-45 | System Time Synchronization | No mapping in our data | — | No mapping to NIS2 in our data. |
| SC-46 | Cross Domain Policy Enforcement | No mapping in our data | — | No mapping to NIS2 in our data. |
| SC-47 | Alternate Communications Paths | No mapping in our data | — | No mapping to NIS2 in our data. |
| SC-48 | Sensor Relocation | No mapping in our data | — | No mapping to NIS2 in our data. |
| SC-50 | Software-enforced Separation and Policy Enforcement | No mapping in our data | — | No mapping to NIS2 in our data. |
| SI System and Information Integrity · 11 | ||||
| SI-6 | Security and Privacy Function Verification | No mapping in our data | — | No mapping to NIS2 in our data. |
| SI-11 | Error Handling | No mapping in our data | — | No mapping to NIS2 in our data. |
| SI-14 | Non-persistence | No mapping in our data | — | No mapping to NIS2 in our data. |
| SI-15 | Information Output Filtering | No mapping in our data | — | No mapping to NIS2 in our data. |
| SI-16 | Memory Protection | No mapping in our data | — | No mapping to NIS2 in our data. |
| SI-17 | Fail-safe Procedures | No mapping in our data | — | No mapping to NIS2 in our data. |
| SI-19 | De-identification | No mapping in our data | — | No mapping to NIS2 in our data. |
| SI-20 | Tainting | No mapping in our data | — | No mapping to NIS2 in our data. |
| SI-21 | Information Refresh | No mapping in our data | — | No mapping to NIS2 in our data. |
| SI-22 | Information Diversity | No mapping in our data | — | No mapping to NIS2 in our data. |
| SI-23 | Information Fragmentation | No mapping in our data | — | No mapping to NIS2 in our data. |
| SR Supply Chain Risk Management · 3 | ||||
| SR-4 | Provenance | No mapping in our data | — | No mapping to NIS2 in our data. |
| SR-7 | Supply Chain Operations Security | No mapping in our data | — | No mapping to NIS2 in our data. |
| SR-9 | Tamper Resistance and Detection | No mapping in our data | — | No mapping to NIS2 in our data. |
Check these: only loosely related (a shared CSF outcome, not a mapping) (117)
| 800-53 | Requirement | Match | NIS2 | Evidence |
|---|---|---|---|---|
| AC Access Control · 12 | ||||
| AC-1 | Policy and Procedures | 1.16.1 | Only shares CSF GV.OC-03, GV.PO-01, GV.PO-02: related, not a mapping | |
| AC-5 | Separation of Duties | 11.111.211.5+2 | Only shares CSF PR.AA-05: related, not a mapping | |
| AC-7 | Unsuccessful Logon Attempts | 11.611.7 | Only shares CSF PR.AA-03: related, not a mapping | |
| AC-9 | Previous Logon Notification | 6.66.9 | Only shares CSF DE.CM-09: related, not a mapping | |
| AC-10 | Concurrent Session Control | 11.111.211.5+2 | Only shares CSF PR.AA-05: related, not a mapping | |
| AC-12 | Session Termination | 11.611.7 | Only shares CSF PR.AA-03: related, not a mapping | |
| AC-14 | Permitted Actions Without Identification or Authentication | 11.5 | Only shares CSF PR.AA-01: related, not a mapping | |
| AC-16 | Security and Privacy Attributes | 11.111.211.5+2 | Only shares CSF PR.AA-05: related, not a mapping | |
| AC-17 | Remote Access | 11.111.211.5+2 | Only shares CSF PR.AA-05: related, not a mapping | |
| AC-18 | Wireless Access | 11.111.211.5+2 | Only shares CSF PR.AA-05: related, not a mapping | |
| AC-19 | Access Control for Mobile Devices | 11.111.211.5+2 | Only shares CSF PR.AA-05: related, not a mapping | |
| AC-24 | Access Control Decisions | 11.111.211.5+2 | Only shares CSF PR.AA-05: related, not a mapping | |
| AT Awareness and Training · 1 | ||||
| AT-1 | Policy and Procedures | 1.16.1 | Only shares CSF GV.OC-03, GV.PO-01, GV.PO-02: related, not a mapping | |
| AU Audit and Accountability · 2 | ||||
| AU-1 | Policy and Procedures | 1.16.1 | Only shares CSF GV.OC-03, GV.PO-01, GV.PO-02: related, not a mapping | |
| AU-16 | Cross-organizational Audit Logging | 9.1 | Only shares CSF PR.DS-02: related, not a mapping | |
| CA Assessment, Authorization and Monitoring · 3 | ||||
| CA-1 | Policy and Procedures | 1.16.1 | Only shares CSF GV.OC-03, GV.PO-01, GV.PO-02: related, not a mapping | |
| CA-3 | Information Exchange | 9.14.312.3+1 | Only shares CSF PR.DS-01, PR.DS-02, ID.AM-03: related, not a mapping | |
| CA-9 | Internal System Connections | 4.312.4 | Only shares CSF ID.AM-03: related, not a mapping | |
| CM Configuration Management · 9 | ||||
| CM-1 | Policy and Procedures | 1.16.1 | Only shares CSF GV.OC-03, GV.PO-01, GV.PO-02: related, not a mapping | |
| CM-3 | Configuration Change Control | 6.94.36.3+3 | Only shares CSF DE.CM-01, DE.CM-09, PR.PS-01: related, not a mapping | |
| CM-4 | Impact Analyses | 6.36.4 | Only shares CSF PR.PS-01, ID.RA-07: related, not a mapping | |
| CM-5 | Access Restrictions for Change | 6.3 | Only shares CSF PR.PS-01: related, not a mapping | |
| CM-9 | Configuration Management Plan | 6.26.312.4 | Only shares CSF ID.AM-08, PR.PS-01: related, not a mapping | |
| CM-10 | Software Usage Restrictions | 6.36.66.9 | Only shares CSF PR.PS-01, DE.CM-09: related, not a mapping | |
| CM-11 | User-installed Software | 6.66.36.9+1 | Only shares CSF DE.CM-09, PR.PS-02, PR.PS-01: related, not a mapping | |
| CM-12 | Information Location | 12.4 | Only shares CSF ID.AM-07: related, not a mapping | |
| CM-13 | Data Action Mapping | 12.46.2 | Only shares CSF ID.AM-07, ID.AM-08: related, not a mapping | |
| CP Contingency Planning · 1 | ||||
| CP-1 | Policy and Procedures | 1.16.1 | Only shares CSF GV.OC-03, GV.PO-01, GV.PO-02: related, not a mapping | |
| IA Identification and Authentication · 11 | ||||
| IA-1 | Policy and Procedures | 1.16.1 | Only shares CSF GV.OC-03, GV.PO-01, GV.PO-02: related, not a mapping | |
| IA-3 | Device Identification and Authentication | 11.511.611.7 | Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping | |
| IA-4 | Identifier Management | 11.5 | Only shares CSF PR.AA-01: related, not a mapping | |
| IA-5 | Authenticator Management | 11.511.611.7 | Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping | |
| IA-6 | Authentication Feedback | 11.5 | Only shares CSF PR.AA-01: related, not a mapping | |
| IA-7 | Cryptographic Module Authentication | 11.511.611.7 | Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping | |
| IA-8 | Identification and Authentication (Non-organizational Users) | 11.511.611.7 | Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping | |
| IA-9 | Service Identification and Authentication | 11.511.611.7 | Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping | |
| IA-10 | Adaptive Authentication | 11.511.611.7 | Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping | |
| IA-11 | Re-authentication | 11.511.611.7 | Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping | |
| IA-13 | Identity Providers and Authorization Servers | 11.111.211.5+2 | Only shares CSF PR.AA-05: related, not a mapping | |
| IR Incident Response · 1 | ||||
| IR-1 | Policy and Procedures | 1.16.1 | Only shares CSF GV.OC-03, GV.PO-01, GV.PO-02: related, not a mapping | |
| MA Maintenance · 4 | ||||
| MA-1 | Policy and Procedures | 1.16.1 | Only shares CSF GV.OC-03, GV.PO-01, GV.PO-02: related, not a mapping | |
| MA-2 | Controlled Maintenance | 6.212.4 | Only shares CSF ID.AM-08: related, not a mapping | |
| MA-3 | Maintenance Tools | 6.66.10 | Only shares CSF PR.PS-02: related, not a mapping | |
| MA-6 | Timely Maintenance | 6.212.4 | Only shares CSF ID.AM-08: related, not a mapping | |
| MP Media Protection · 2 | ||||
| MP-1 | Policy and Procedures | 1.16.1 | Only shares CSF GV.OC-03, GV.PO-01, GV.PO-02: related, not a mapping | |
| MP-8 | Media Downgrading | 9.112.3 | Only shares CSF PR.DS-01: related, not a mapping | |
| PE Physical and Environmental Protection · 12 | ||||
| PE-1 | Policy and Procedures | 1.16.1 | Only shares CSF GV.OC-03, GV.PO-01, GV.PO-02: related, not a mapping | |
| PE-4 | Access Control for Transmission | 11.513.3 | Only shares CSF PR.AA-06: related, not a mapping | |
| PE-5 | Access Control for Output Devices | 11.513.3 | Only shares CSF PR.AA-06: related, not a mapping | |
| PE-9 | Power Equipment and Cabling | 13.2 | Only shares CSF PR.IR-02: related, not a mapping | |
| PE-10 | Emergency Shutoff | 13.2 | Only shares CSF PR.IR-02: related, not a mapping | |
| PE-11 | Emergency Power | 13.2 | Only shares CSF PR.IR-02: related, not a mapping | |
| PE-12 | Emergency Lighting | 13.2 | Only shares CSF PR.IR-02: related, not a mapping | |
| PE-15 | Water Damage Protection | 13.2 | Only shares CSF PR.IR-02: related, not a mapping | |
| PE-18 | Location of System Components | 11.513.213.3 | Only shares CSF PR.AA-06, PR.IR-02: related, not a mapping | |
| PE-19 | Information Leakage | 11.513.3 | Only shares CSF PR.AA-06: related, not a mapping | |
| PE-20 | Asset Monitoring and Tracking | 13.311.513.1 | Only shares CSF DE.CM-02, PR.AA-06: related, not a mapping | |
| PE-23 | Facility Location | 13.2 | Only shares CSF PR.IR-02: related, not a mapping | |
| PL Planning · 2 | ||||
| PL-2 | System Security and Privacy Plans | 12.44.36.2 | Only shares CSF ID.AM-03, ID.AM-08: related, not a mapping | |
| PL-8 | Security and Privacy Architectures | 4.312.4 | Only shares CSF ID.AM-03: related, not a mapping | |
| PM Program Management · 13 | ||||
| PM-3 | Information Security and Privacy Resources | 2.11.1 | Only shares CSF GV.RM-03, GV.RR-03: related, not a mapping | |
| PM-7 | Enterprise Architecture | 4.312.4 | Only shares CSF ID.AM-03: related, not a mapping | |
| PM-8 | Critical Infrastructure Plan | 4.1 | Only shares CSF GV.OC-04: related, not a mapping | |
| PM-11 | Mission and Business Process Definition | 2.13.44.1+5 | Only shares CSF ID.RA-04, DE.AE-04, GV.OC-04: related, not a mapping | |
| PM-13 | Security and Privacy Workforce | 1.210.110.2+1 | Only shares CSF GV.RR-02, GV.RR-04: related, not a mapping | |
| PM-15 | Security and Privacy Groups and Associations | 2.14.36.10 | Only shares CSF ID.RA-02, DE.AE-06: related, not a mapping | |
| PM-16 | Threat Awareness Program | 2.14.36.10 | Only shares CSF ID.RA-02, ID.RA-03, ID.RA-05, DE.AE-03…: related, not a mapping | |
| PM-18 | Privacy Program Plan | 2.11.13.4+3 | Only shares CSF GV.RM-06, ID.RA-06, GV.OC-02, DE.AE-04: related, not a mapping | |
| PM-19 | Privacy Program Leadership Role | 1.22.22.3+1 | Only shares CSF GV.RR-02, GV.OV-02: related, not a mapping | |
| PM-22 | Personally Identifiable Information Quality Management | 6.212.4 | Only shares CSF ID.AM-08: related, not a mapping | |
| PM-23 | Data Governance Body | 1.26.212.4 | Only shares CSF GV.RR-02, ID.AM-08: related, not a mapping | |
| PM-24 | Data Integrity Board | 1.2 | Only shares CSF GV.RR-02: related, not a mapping | |
| PM-31 | Continuous Monitoring Strategy | 5.12.22.3 | Only shares CSF GV.SC-09, GV.SC-10, GV.OV-02: related, not a mapping | |
| PS Personnel Security · 2 | ||||
| PS-1 | Policy and Procedures | 1.16.1 | Only shares CSF GV.OC-03, GV.PO-01, GV.PO-02: related, not a mapping | |
| PS-7 | External Personnel Security | 10.110.210.3+1 | Only shares CSF GV.RR-04: related, not a mapping | |
| PT PII Processing and Transparency · 1 | ||||
| PT-1 | Policy and Procedures | 1.16.1 | Only shares CSF GV.OC-03, GV.PO-01, GV.PO-02: related, not a mapping | |
| RA Risk Assessment · 4 | ||||
| RA-1 | Policy and Procedures | 1.16.1 | Only shares CSF GV.OC-03, GV.PO-01, GV.PO-02: related, not a mapping | |
| RA-8 | Privacy Impact Assessments | 2.16.10 | Only shares CSF ID.RA-04: related, not a mapping | |
| RA-9 | Criticality Analysis | 5.12.14.1+3 | Only shares CSF GV.SC-04, GV.SC-07, ID.RA-04, GV.OC-04: related, not a mapping | |
| RA-10 | Threat Hunting | 4.3 | Only shares CSF DE.AE-06, DE.AE-07: related, not a mapping | |
| SA System and Services Acquisition · 6 | ||||
| SA-1 | Policy and Procedures | 1.16.1 | Only shares CSF GV.OC-03, GV.PO-01, GV.PO-02: related, not a mapping | |
| SA-5 | System Documentation | 6.112.4 | Only shares CSF ID.RA-09, ID.AM-02: related, not a mapping | |
| SA-10 | Developer Configuration Management | 6.106.16.2+1 | Only shares CSF PR.PS-02, PR.PS-03, ID.RA-09, PR.PS-06: related, not a mapping | |
| SA-17 | Developer Security and Privacy Architecture and Design | 6.16.2 | Only shares CSF ID.RA-09, PR.PS-06: related, not a mapping | |
| SA-22 | Unsupported System Components | 6.212.4 | Only shares CSF ID.AM-08: related, not a mapping | |
| SA-24 | Design For Cyber Resiliency | 1.12.14.3+1 | Only shares CSF GV.RM-03, PR.IR-03: related, not a mapping | |
| SC System and Communications Protection · 20 | ||||
| SC-1 | Policy and Procedures | 1.16.1 | Only shares CSF GV.OC-03, GV.PO-01, GV.PO-02: related, not a mapping | |
| SC-3 | Security Function Isolation | 6.10 | Only shares CSF PR.PS-03: related, not a mapping | |
| SC-4 | Information in Shared System Resources | 9.16.76.8+1 | Only shares CSF PR.DS-01, PR.DS-02, PR.IR-01: related, not a mapping | |
| SC-5 | Denial-of-service Protection | 6.74.36.8+1 | Only shares CSF DE.CM-01, PR.IR-01: related, not a mapping | |
| SC-6 | Resource Availability | 4.3 | Only shares CSF PR.IR-03: related, not a mapping | |
| SC-11 | Trusted Path | 9.1 | Only shares CSF PR.DS-02: related, not a mapping | |
| SC-16 | Transmission of Security and Privacy Attributes | 9.1 | Only shares CSF PR.DS-02: related, not a mapping | |
| SC-20 | Secure Name/Address Resolution Service (Authoritative Source) | 6.74.36.8+1 | Only shares CSF DE.CM-01, PR.IR-01: related, not a mapping | |
| SC-21 | Secure Name/Address Resolution Service (Recursive or Caching Resolver) | 6.74.36.8+1 | Only shares CSF DE.CM-01, PR.IR-01: related, not a mapping | |
| SC-22 | Architecture and Provisioning for Name/Address Resolution Service | 6.74.36.8+1 | Only shares CSF DE.CM-01, PR.IR-01: related, not a mapping | |
| SC-24 | Fail in Known State | 4.3 | Only shares CSF PR.IR-03: related, not a mapping | |
| SC-32 | System Partitioning | 9.112.3 | Only shares CSF PR.DS-01: related, not a mapping | |
| SC-34 | Non-modifiable Executable Programs | 6.96.66.7 | Only shares CSF DE.CM-09, PR.PS-05: related, not a mapping | |
| SC-35 | External Malicious Code Identification | 6.66.9 | Only shares CSF DE.CM-09: related, not a mapping | |
| SC-36 | Distributed Processing and Storage | 4.3 | Only shares CSF PR.IR-03: related, not a mapping | |
| SC-39 | Process Isolation | 4.36.109.1+1 | Only shares CSF PR.IR-03, PR.PS-03, PR.DS-01: related, not a mapping | |
| SC-40 | Wireless Link Protection | 9.1 | Only shares CSF PR.DS-02: related, not a mapping | |
| SC-43 | Usage Restrictions | 9.112.3 | Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping | |
| SC-49 | Hardware-enforced Separation and Policy Enforcement | 6.10 | Only shares CSF PR.PS-03: related, not a mapping | |
| SC-51 | Hardware-based Protection | 6.10 | Only shares CSF PR.PS-03: related, not a mapping | |
| SI System and Information Integrity · 6 | ||||
| SI-1 | Policy and Procedures | 1.16.1 | Only shares CSF GV.OC-03, GV.PO-01, GV.PO-02: related, not a mapping | |
| SI-5 | Security Alerts, Advisories, and Directives | 2.16.106.5 | Only shares CSF ID.RA-01, ID.RA-02, ID.RA-03: related, not a mapping | |
| SI-10 | Information Input Validation | 6.26.76.8+2 | Only shares CSF PR.PS-06, PR.IR-01: related, not a mapping | |
| SI-12 | Information Management and Retention | 12.46.2 | Only shares CSF ID.AM-07, ID.AM-08: related, not a mapping | |
| SI-13 | Predictable Failure Prevention | 4.3 | Only shares CSF PR.IR-03: related, not a mapping | |
| SI-18 | Personally Identifiable Information Quality Operations | 6.212.4 | Only shares CSF ID.AM-08: related, not a mapping | |
| SR Supply Chain Risk Management · 5 | ||||
| SR-1 | Policy and Procedures | 1.16.1 | Only shares CSF GV.OC-03, GV.PO-01, GV.PO-02: related, not a mapping | |
| SR-5 | Acquisition Strategies, Tools, and Methods | 5.16.11.1+5 | Only shares CSF GV.OC-05, GV.SC-05, GV.SC-06, GV.SC-09…: related, not a mapping | |
| SR-8 | Notification Agreements | 3.53.14.3+3 | Only shares CSF RC.CO-03, RS.CO-02, RS.CO-03, RS.MA-01…: related, not a mapping | |
| SR-10 | Inspection of Systems or Components | 5.16.1 | Only shares CSF GV.SC-05, ID.RA-09: related, not a mapping | |
| SR-12 | Component Disposal | 6.212.4 | Only shares CSF ID.AM-08: related, not a mapping | |
Mapped (76)
| 800-53 | Requirement | Match | NIS2 | Evidence |
|---|---|---|---|---|
| AC Access Control · 5 | ||||
| AC-2 | Account Management | Crosswalk | 11.111.211.5 | Same topic: Access Control |
| AC-3 | Access Enforcement | Crosswalk | 6.811.111.2+2 | Same topic: Zero Trust, Access Control |
| AC-4 | Information Flow Enforcement | Crosswalk | 6.76.811.1+2 | Same topic: Firewall / Net Seg, Zero Trust |
| AC-6 | Least Privilege | Crosswalk | 6.811.111.6 | Same topic: Zero Trust |
| AC-20 | Use of External Systems | Crosswalk | 6.1 | Same topic: Cloud Security |
| AT Awareness and Training · 2 | ||||
| AT-2 | Literacy Training and Awareness | Crosswalk | 8.18.2 | Same topic: Awareness & Training |
| AT-3 | Role-based Training | Crosswalk | 8.18.2 | Same topic: Awareness & Training |
| AU Audit and Accountability · 7 | ||||
| AU-2 | Event Logging | Crosswalk | 3.2 | Same topic: Logging & Audit |
| AU-3 | Content of Audit Records | Crosswalk | 3.2 | Same topic: Logging & Audit |
| AU-6 | Audit Record Review, Analysis, and Reporting | Crosswalk | 3.23.4 | Same topic: SIEM / SOC, Anomaly Detection |
| AU-7 | Audit Record Reduction and Report Generation | Crosswalk | 3.5 | Same topic: Forensics |
| AU-11 | Audit Record Retention | Crosswalk | 3.2 | Same topic: Logging & Audit |
| AU-12 | Audit Record Generation | Crosswalk | 3.2 | Same topic: Logging & Audit |
| AU-13 | Monitoring for Information Disclosure | Crosswalk | 10.210.4 | Same topic: Insider Threat |
| CA Assessment, Authorization and Monitoring · 3 | ||||
| CA-2 | Control Assessments | Editorial | 2.22.3 | Same topic: Compliance (editorial pick) |
| CA-7 | Continuous Monitoring | Crosswalk | 3.2 | Same topic: Cont. Monitoring |
| CA-8 | Penetration Testing | Crosswalk | 6.56.10 | Same topic: Vulnerability Mgmt |
| CM Configuration Management · 4 | ||||
| CM-2 | Baseline Configuration | Crosswalk | 6.3 | Same topic: Secure Config |
| CM-6 | Configuration Settings | Crosswalk | 6.3 | Same topic: Secure Config |
| CM-7 | Least Functionality | Crosswalk | 6.3 | Same topic: Secure Config |
| CM-8 | System Component Inventory | Crosswalk | 12.4 | Same topic: Asset Management |
| CP Contingency Planning · 5 | ||||
| CP-2 | Contingency Plan | Crosswalk | 4.1 | Same topic: Recovery Planning |
| CP-6 | Alternate Storage Site | Crosswalk | 4.2 | Same topic: Backup & Recovery |
| CP-7 | Alternate Processing Site | Editorial | 4.14.24.3 | Same topic: Business Continuity, Disaster Recovery (editorial pick) |
| CP-9 | System Backup | Crosswalk | 4.2 | Same topic: Backup & Recovery |
| CP-10 | System Recovery and Reconstitution | Crosswalk | 4.14.24.3 | Same topic: Recovery Planning, Disaster Recovery, Comms & Restore |
| IA Identification and Authentication · 1 | ||||
| IA-2 | Identification and Authentication (Organizational Users) | Crosswalk | 6.811.111.6 | Same topic: Zero Trust |
| IR Incident Response · 7 | ||||
| IR-2 | Incident Response Training | Editorial | 3.13.5 | Same topic: Incident Response (editorial pick) |
| IR-3 | Incident Response Testing | Editorial | 3.13.5 | Same topic: Incident Response (editorial pick) |
| IR-4 | Incident Handling | Crosswalk | 3.13.53.6 | Same topic: Incident Response, Mitigation, Lessons Learned |
| IR-5 | Incident Monitoring | Crosswalk | 3.23.4 | Same topic: SIEM / SOC |
| IR-6 | Incident Reporting | Crosswalk | 3.34.3 | Same topic: Reporting, Comms & Restore |
| IR-7 | Incident Response Assistance | Crosswalk | 4.3 | Same topic: Communication |
| IR-8 | Incident Response Plan | Crosswalk | 3.13.5 | Same topic: Incident Response |
| PE Physical and Environmental Protection · 6 | ||||
| PE-2 | Physical Access Authorizations | Crosswalk | 13.113.213.3 | Same topic: Physical Security |
| PE-3 | Physical Access Control | Crosswalk | 13.113.213.3 | Same topic: Physical Security |
| PE-6 | Monitoring Physical Access | Crosswalk | 13.113.213.3 | Same topic: Physical Security |
| PE-8 | Visitor Access Records | Crosswalk | 13.113.213.3 | Same topic: Physical Security |
| PE-13 | Fire Protection | Crosswalk | 13.113.213.3 | Same topic: Physical Security |
| PE-14 | Environmental Controls | Crosswalk | 13.113.213.3 | Same topic: Physical Security |
| PL Planning · 1 | ||||
| PL-1 | Policy and Procedures | Crosswalk | 1.1 | Same topic: Governance Policy |
| PM Program Management · 10 | ||||
| PM-1 | Information Security Program Plan | Crosswalk | 1.1 | Same topic: Governance Policy |
| PM-2 | Information Security Program Leadership Role | Crosswalk | 1.2 | Same topic: Roles & Responsibilities |
| PM-4 | Plan of Action and Milestones Process | Crosswalk | 2.22.3 | Same topic: Compliance |
| PM-5 | System Inventory | Crosswalk | 12.4 | Same topic: Asset Management |
| PM-6 | Measures of Performance | Crosswalk | 2.22.3 | Same topic: Compliance |
| PM-9 | Risk Management Strategy | Crosswalk | 2.17.1 | Same topic: Risk Management |
| PM-12 | Insider Threat Program | Editorial | 10.210.4 | Same topic: Insider Threat (editorial pick) |
| PM-28 | Risk Framing | Crosswalk | 2.17.1 | Same topic: Risk Management |
| PM-29 | Risk Management Program Leadership Roles | Crosswalk | 1.2 | Same topic: Roles & Responsibilities |
| PM-30 | Supply Chain Risk Management Strategy | Crosswalk | 5.16.1 | Same topic: Supply Chain Risk |
| PS Personnel Security · 1 | ||||
| PS-9 | Position Descriptions | Editorial | 1.2 | Same topic: Roles & Responsibilities (editorial pick) |
| RA Risk Assessment · 4 | ||||
| RA-2 | Security Categorization | Crosswalk | 12.1 | Same topic: Data Classification |
| RA-3 | Risk Assessment | Crosswalk | 2.1 | Same topic: Risk Assessment |
| RA-5 | Vulnerability Monitoring and Scanning | Crosswalk | 6.56.10 | Same topic: Vulnerability Mgmt |
| RA-7 | Risk Response | Crosswalk | 2.17.1 | Same topic: Risk Management, Risk Assessment |
| SA System and Services Acquisition · 6 | ||||
| SA-3 | System Development Life Cycle | Crosswalk | 6.2 | Same topic: Secure Development |
| SA-4 | Acquisition Process | Crosswalk | 5.15.26.1 | Same topic: Vendor Risk Mgmt |
| SA-8 | Security and Privacy Engineering Principles | Crosswalk | 6.2 | Same topic: Secure Development |
| SA-9 | External System Services | Crosswalk | 5.15.26.1 | Same topic: Vendor Risk Mgmt, Cloud Security |
| SA-11 | Developer Testing and Evaluation | Crosswalk | 6.2 | Same topic: Secure Development |
| SA-15 | Development Process, Standards, and Tools | Crosswalk | 6.2 | Same topic: Secure Development |
| SC System and Communications Protection · 5 | ||||
| SC-7 | Boundary Protection | Crosswalk | 6.76.8 | Same topic: Firewall / Net Seg |
| SC-8 | Transmission Confidentiality and Integrity | Crosswalk | 9.112.212.3 | Same topic: Encryption, Data Protection |
| SC-12 | Cryptographic Key Establishment and Management | Crosswalk | 9.1 | Same topic: Encryption |
| SC-13 | Cryptographic Protection | Crosswalk | 9.1 | Same topic: Encryption |
| SC-28 | Protection of Information at Rest | Crosswalk | 9.112.212.3 | Same topic: Encryption, Data Protection |
| SI System and Information Integrity · 5 | ||||
| SI-2 | Flaw Remediation | Crosswalk | 6.6 | Same topic: Patch Management |
| SI-3 | Malicious Code Protection | Crosswalk | 6.9 | Same topic: Endpoint Protection, Email Security |
| SI-4 | System Monitoring | Crosswalk | 3.23.46.9 | Same topic: Cont. Monitoring, Intrusion Detection, Anomaly Detection, Endpoint Protection |
| SI-7 | Software, Firmware, and Information Integrity | Crosswalk | 12.212.3 | Same topic: Data Protection |
| SI-8 | Spam Protection | Editorial | 6.9 | Same topic: Email Security (editorial pick) |
| SR Supply Chain Risk Management · 4 | ||||
| SR-2 | Supply Chain Risk Management Plan | Crosswalk | 5.16.1 | Same topic: Supply Chain Risk |
| SR-3 | Supply Chain Controls and Processes | Crosswalk | 5.16.1 | Same topic: Supply Chain Risk |
| SR-6 | Supplier Assessments and Reviews | Crosswalk | 5.15.26.1 | Same topic: Vendor Risk Mgmt |
| SR-11 | Component Authenticity | Crosswalk | 5.16.1 | Same topic: Supply Chain Risk |
By topic
Both cover (43):
Governance PolicyAwareness & TrainingRisk ManagementSupply Chain RiskRoles & ResponsibilitiesComplianceAsset ManagementRisk AssessmentData ClassificationVulnerability MgmtAccess ControlMulti-Factor AuthEncryptionData ProtectionBackup & RecoveryPrivileged AccessFirewall / Net SegEndpoint ProtectionPatch ManagementSecure ConfigSecure DevelopmentEmail SecurityZero TrustCloud SecurityDLPCont. MonitoringLogging & AuditIntrusion DetectionAnomaly DetectionSIEM / SOCIncident ResponseForensicsCommunicationMitigationReportingRecovery PlanningBusiness ContinuityLessons LearnedComms & RestoreDisaster RecoveryInsider ThreatVendor Risk MgmtPhysical Security
Only 800-53 (7):
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Mapped = curated together in a ControlMapping topic, or linked directly. Crosswalks don't prove compliance. Methodology · Download the data · Report a mistake.