800-53 · PM Program Management
PM-15
Security and Privacy Groups and Associations
frameworkNIST SP 800-53 Rev 5.2
sectionPM Program Management
csf 2.0DE.AE-06 ID.RA-02
topicsThreat Intelligence
frameworks4 2 2
Official textEstablish and institutionalize contact with selected groups and associations within the security and privacy communities:
a. To facilitate ongoing security and privacy education and training for organizational personnel;
b. To maintain currency with recommended security and privacy practices, techniques, and technologies; and
c. To share current security and privacy information, including threats, vulnerabilities, and incidents.NIST SP 800-53 Rev 5.2 control statement (public domain)
a. To facilitate ongoing security and privacy education and training for organizational personnel;
b. To maintain currency with recommended security and privacy practices, techniques, and technologies; and
c. To share current security and privacy information, including threats, vulnerabilities, and incidents.NIST SP 800-53 Rev 5.2 control statement (public domain)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | DE.AE-07ID.RA-02ID.RA-03 | Cyber threat intelligence and other contextual information are integrated into the analysis; Cyber threat intelligence is received from information sharing forums and sources… | Crosswalk | Same topic: Threat Intelligence1 loosely related (not mappings)DE.AE-06 Information on adverse events is provided to authorized staff and tools Only shares CSF DE.AE-06: related, not a mapping |
| ISO 27001 | A.5.7A.5.6Clause 7.4 | Threat intelligence; Contact with special interest groups… | Crosswalk | Same topic: Threat Intelligence NIST SP 800-53 → ISO 27001 mapping 3 loosely related (not mappings)A.5.22 Monitoring, review and change management of supplier services Only shares CSF ID.RA-02: related, not a mapping |
| CIS v8.1 | CIS 8.9CIS 13.1CIS 13.11 | Centralize Audit Logs; Centralize Security Event Alerting… | No mapping. Only shares CSF DE.AE-06: related, not a mapping | |
| SOC 2 | CC7.3 | Evaluating security events to determine if they are incidents | No mapping. Only shares CSF DE.AE-06: related, not a mapping | |
| PCI DSS | 6.3.1 | Vulnerabilities identified and risk-ranked | Crosswalk | Same topic: Threat Intelligence4 loosely related (not mappings)12.10.3 Incident response staff available around the clock Only shares CSF DE.AE-06: related, not a mapping |
| CMMC | SI.L2-3.14.3 | Security Alerts & Advisories | Crosswalk | Same topic: Threat Intelligence2 loosely related (not mappings) |
| HIPAA | §164.308(a)(6)§164.308(a)(6)(ii) | Security Incident Procedures; Response and Reporting | No mapping. Only shares CSF DE.AE-06: related, not a mapping | |
| GDPR | — | No requirement | No mapping in our data | No mapping in our data (only GDPR's security articles are mapped, editorially). |
| NIS2 | 2.14.36.10 | Risk management framework; Crisis management… | No mapping. Only shares CSF ID.RA-02, DE.AE-06: related, not a mapping | |
| Essential Eight | ISM-1228ISM-1906 | Cyber security events are analysed in a timely manner to identify cyber security incidents; Event logs from internet-facing servers are analysed in a timely manner to detect cyber… | No mapping. Only shares CSF DE.AE-06: related, not a mapping | |
| DORA | Art.8(2)Art.13(1)Art.45(1) | Identification; Learning and evolving… | Editorial | Same topic: Threat Intelligence (editorial pick) |
| CPS 234 | Para 17 | Keep capability current as threats and vulnerabilities change | Editorial | Same topic: Threat Intelligence (editorial pick) |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.