800-53 · PM Program Management
PM-16
Threat Awareness Program
frameworkNIST SP 800-53 Rev 5.2
sectionPM Program Management
csf 2.0DE.AE-03 DE.AE-06 DE.AE-07 ID.RA-02 ID.RA-03 ID.RA-05
topicsThreat Intelligence
frameworks4 2 1
Official textImplement a threat awareness program that includes a cross-organization information-sharing capability for threat intelligence.NIST SP 800-53 Rev 5.2 control statement (public domain)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | DE.AE-07ID.RA-02ID.RA-03 | Cyber threat intelligence and other contextual information are integrated into the analysis; Cyber threat intelligence is received from information sharing forums and sources… | Crosswalk | Same topic: Threat Intelligence3 loosely related (not mappings)DE.AE-03 Information is correlated from multiple sources Only shares CSF DE.AE-03: related, not a mapping DE.AE-06 Information on adverse events is provided to authorized staff and tools Only shares CSF DE.AE-06: related, not a mapping ID.RA-05 Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization Only shares CSF ID.RA-05: related, not a mapping |
| ISO 27001 | A.5.7 | Threat intelligence | Crosswalk | Same topic: Threat Intelligence7 loosely related (not mappings)A.5.22 Monitoring, review and change management of supplier services Only shares CSF ID.RA-02, ID.RA-03: related, not a mapping Clause 6.1.2 Information security risk assessment Only shares CSF ID.RA-03, ID.RA-05: related, not a mapping Clause 6.1.3 Information security risk treatment Only shares CSF ID.RA-03, ID.RA-05: related, not a mapping |
| CIS v8.1 | CIS 8.9CIS 13.1CIS 13.11CIS 3.14 | Centralize Audit Logs; Centralize Security Event Alerting… | No mapping. Only shares CSF DE.AE-03, DE.AE-06: related, not a mapping+8 more loosely related (not mappings)CIS 8.1 Establish and Maintain an Audit Log Management Process Only shares CSF DE.AE-03: related, not a mapping …and 4 more in the downloads | |
| SOC 2 | CC3.2CC3.3CC3.4CC7.3 | Risk identification and analysis; Considering the potential for fraud… | No mapping. Only shares CSF ID.RA-03, ID.RA-05, DE.AE-03, DE.AE-06: related, not a mapping+1 more loosely related (not mappings) | |
| PCI DSS | 6.3.1 | Vulnerabilities identified and risk-ranked | Crosswalk | Same topic: Threat Intelligence14 loosely related (not mappings)10.3.3 Logs promptly backed up to a central server Only shares CSF DE.AE-03, DE.AE-06: related, not a mapping 12.3.1 Targeted risk analysis for flexible-frequency requirements Only shares CSF ID.RA-03, ID.RA-05: related, not a mapping 12.5.1 Inventory of in-scope system components Only shares CSF DE.AE-03, DE.AE-07: related, not a mapping 1.2.4 Accurate account-data flow diagram maintained Only shares CSF DE.AE-03: related, not a mapping 6.4.3 Payment page scripts authorised and integrity-checked Only shares CSF DE.AE-07: related, not a mapping …and 6 more in the downloads |
| CMMC | SI.L2-3.14.3 | Security Alerts & Advisories | Crosswalk | Same topic: Threat Intelligence9 loosely related (not mappings)RA.L2-3.11.1 Risk Assessments Only shares CSF DE.AE-07, ID.RA-02, ID.RA-03, ID.RA-05: related, not a mapping …and 1 more in the downloads |
| HIPAA | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.316(a)§164.308(a)(6) | Risk Analysis; Risk Management… | No mapping. Only shares CSF DE.AE-07, ID.RA-03, ID.RA-05, DE.AE-03…: related, not a mapping+6 more loosely related (not mappings)§164.308(a)(6)(ii) Response and Reporting Only shares CSF DE.AE-03, DE.AE-06: related, not a mapping §164.308(a)(1)(ii)(D) Information System Activity Review Only shares CSF DE.AE-03: related, not a mapping §164.308(a)(7)(ii)(E) Applications and Data Criticality Analysis Only shares CSF ID.RA-05: related, not a mapping …and 2 more in the downloads | |
| GDPR | Art.35(1)Art.35(7) | Data protection impact assessment; Data protection impact assessment | No mapping. Only shares CSF ID.RA-03, ID.RA-05: related, not a mapping | |
| NIS2 | 2.14.36.10 | Risk management framework; Crisis management… | No mapping. Only shares CSF ID.RA-02, ID.RA-03, ID.RA-05, DE.AE-03…: related, not a mapping | |
| Essential Eight | ISM-1228ISM-1906ISM-0109ISM-1509 | Cyber security events are analysed in a timely manner to identify cyber security incidents; Event logs from internet-facing servers are analysed in a timely manner to detect cyber…… | No mapping. Only shares CSF DE.AE-03, DE.AE-06: related, not a mapping+5 more loosely related (not mappings)ISM-1623 PowerShell module logging, script block logging and transcription events are centrally… Only shares CSF DE.AE-03: related, not a mapping ISM-1660 Allowed and blocked application control events are centrally logged Only shares CSF DE.AE-03: related, not a mapping ISM-1683 Successful and unsuccessful multi-factor authentication events are centrally logged Only shares CSF DE.AE-03: related, not a mapping ISM-1815 Event logs are protected from unauthorised modification and deletion Only shares CSF DE.AE-03: related, not a mapping …and 1 more in the downloads | |
| DORA | Art.8(2)Art.13(1)Art.45(1) | Identification; Learning and evolving… | Editorial | Same topic: Threat Intelligence (editorial pick)4 loosely related (not mappings) |
| CPS 234 | Para 17 | Keep capability current as threats and vulnerabilities change | Editorial | Same topic: Threat Intelligence (editorial pick)1 loosely related (not mappings)Para 21 Timely controls commensurate with risk and asset life-cycle Only shares CSF ID.RA-03, ID.RA-05: related, not a mapping |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.