Control crosswalk
Enter an SP 800-53 control (AC-2, SC-7(5)), a CSF 2.0 subcategory (PR.AA-01) or an SP 800-171 Rev. 3 requirement (03.01.01). Every link shown comes from NIST's published data; nothing here is our mapping.
CSF 2.0 subcategories and their NIST references
All 106 active subcategories with the SP 800-53 Rev. 5.2.0 and SP 800-171 Rev. 3 informative references from the NIST CSF 2.0 Reference Tool. A reference shows a relationship, not proof of compliance.
Govern (GV)
| Subcategory | SP 800-53 | SP 800-171 r3 |
|---|---|---|
| GV.OC-01 The organizational mission is understood and informs cybersecurity risk management | PM-11 | |
| GV.OC-02 Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered | PM-9 PM-18 PM-30 SR-3 SR-5 SR-6 SR-8 | 03.11.01 03.17.02 03.17.03 |
| GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed | AC-1 AT-1 AU-1 CA-1 CM-1 CP-1 IA-1 IR-1 MA-1 MP-1 PE-1 PL-1 PM-1 PS-1 PT-1 RA-1 SA-1 SC-1 SI-1 SR-1 PM-28 (families: PT) | 03.15.01 |
| GV.OC-04 Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated | PM-8 PM-11 CP-2(8) PM-30(1) RA-9 | |
| GV.OC-05 Outcomes, capabilities, and services that the organization depends on are understood and communicated | PM-11 PM-30 RA-7 SA-9 SR-5 | 03.11.04 03.16.03 03.17.02 |
| GV.OV-01 Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction | AC-1 AT-1 AU-1 CA-1 CM-1 CP-1 IA-1 IR-1 MA-1 MP-1 PE-1 PL-1 PM-1 PS-1 PT-1 RA-1 SA-1 SC-1 SI-1 SR-1 PM-9 PM-18 PM-30 PM-31 RA-7 SR-6 | 03.11.01 03.11.04 03.15.01 |
| GV.OV-02 The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks | PM-9 PM-19 PM-30 PM-31 RA-7 SR-6 | 03.11.01 03.11.04 |
| GV.OV-03 Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed | PM-4 PM-6 RA-7 SR-6 | 03.11.01 03.11.04 |
| GV.PO-01 Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced | AC-1 AT-1 AU-1 CA-1 CM-1 CP-1 IA-1 IR-1 MA-1 MP-1 PE-1 PL-1 PM-1 PS-1 PT-1 RA-1 SA-1 SC-1 SI-1 SR-1 | 03.15.01 |
| GV.PO-02 Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission | AC-1 AT-1 AU-1 CA-1 CM-1 CP-1 IA-1 IR-1 MA-1 MP-1 PE-1 PL-1 PM-1 PS-1 PT-1 RA-1 SA-1 SC-1 SI-1 SR-1 | 03.15.01 |
| GV.RM-01 Risk management objectives are established and agreed to by organizational stakeholders | PM-9 RA-7 SR-2 | 03.11.04 03.17.01 |
| GV.RM-02 Risk appetite and risk tolerance statements are established, communicated, and maintained | PM-9 | |
| GV.RM-03 Cybersecurity risk management activities and outcomes are included in enterprise risk management processes | PM-3 PM-9 PM-30 RA-7 SA-24 SR-2 | 03.11.04 03.17.01 |
| GV.RM-04 Strategic direction that describes appropriate risk response options is established and communicated | PM-9 PM-28 PM-30 SR-2 | 03.17.01 |
| GV.RM-05 Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties | PM-9 PM-30 | |
| GV.RM-06 A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated | PM-9 PM-18 PM-28 PM-30 RA-3 | 03.11.01 |
| GV.RM-07 Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions | PM-9 PM-18 PM-28 PM-30 RA-3 | 03.11.01 |
| GV.RR-01 Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving | PM-2 PM-19 PM-23 PM-24 PM-29 | |
| GV.RR-02 Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced | PM-2 PM-13 PM-19 PM-23 PM-24 PM-29 | |
| GV.RR-03 Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies | PM-3 | |
| GV.RR-04 Cybersecurity is included in human resources practices | PM-13 PS-1 PS-7 PS-9 | 03.15.01 |
| GV.SC-01 A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders | PM-30 SR-2 SR-3 | 03.17.01 03.17.03 |
| GV.SC-02 Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally | SR-2 SR-3 SR-5 | 03.17.02 03.17.03 |
| GV.SC-03 Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes | AC-1 AT-1 AU-1 CA-1 CM-1 CP-1 IA-1 IR-1 MA-1 MP-1 PE-1 PL-1 PM-1 PS-1 PT-1 RA-1 SA-1 SC-1 SI-1 SR-1 PM-9 PM-18 PM-30 PM-31 SR-2 SR-3 RA-3 RA-7 | 03.11.01 03.11.04 03.15.01 03.17.01 03.17.03 |
| GV.SC-04 Suppliers are known and prioritized by criticality | RA-9 SA-9 SR-6 | 03.11.01 03.16.03 |
| GV.SC-05 Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties | SA-4 SA-9 SR-3 SR-5 SR-6 SR-10 | 03.11.01 03.16.03 03.17.02 03.17.03 |
| GV.SC-06 Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships | SA-4 SA-9 SR-5 SR-6 | 03.11.01 03.16.03 03.17.02 |
| GV.SC-07 The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship | RA-9 SA-4 SA-9 SR-3 SR-6 | 03.11.01 03.16.03 03.17.03 |
| GV.SC-08 Relevant suppliers and other third parties are included in incident planning, response, and recovery activities | SA-4 SA-9 SR-2 SR-3 SR-8 CP-1 IR-1 | 03.06.01 03.06.02 03.06.05 03.15.01 03.16.03 03.17.01 03.17.03 |
| GV.SC-09 Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle | PM-9 PM-19 PM-28 PM-30 PM-31 RA-3 RA-7 SA-4 SA-9 SR-2 SR-3 SR-5 SR-6 | 03.11.01 03.11.04 03.16.03 03.17.01 03.17.02 03.17.03 |
| GV.SC-10 Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement | PM-31 RA-3 RA-5 RA-7 SA-4 SA-9 SR-2 SR-3 SR-5 SR-6 | 03.11.01 03.11.02 03.11.04 03.14.08 03.16.03 03.17.01 03.17.02 03.17.03 |
Identify (ID)
| Subcategory | SP 800-53 | SP 800-171 r3 |
|---|---|---|
| ID.AM-01 Inventories of hardware managed by the organization are maintained | CM-8 PM-5 | |
| ID.AM-02 Inventories of software, services, and systems managed by the organization are maintained | AC-20 CM-8 PM-5 SA-5 SA-9 | 03.04.10 03.16.03 |
| ID.AM-03 Representations of the organization's authorized network communication and internal and external network data flows are maintained | AC-4 CA-3 CA-9 PL-2 PL-8 PM-7 | 03.12.05 03.15.02 |
| ID.AM-04 Inventories of services provided by suppliers are maintained | AC-20 SA-9 SR-2 | 03.16.03 03.17.01 |
| ID.AM-05 Assets are prioritized based on classification, criticality, resources, and impact on the mission | RA-3 RA-9 RA-2 | |
| ID.AM-07 Inventories of data and corresponding metadata for designated data types are maintained | CM-12 CM-13 SI-12 | 03.14.08 |
| ID.AM-08 Systems, hardware, software, services, and data are managed throughout their life cycles | CM-9 CM-13 MA-2 MA-6 PL-2 PM-22 PM-23 SA-3 SA-4 SA-8 SA-22 SI-12 SI-18 SR-5 SR-12 | 03.14.08 03.15.02 03.16.01 03.16.02 03.17.02 |
| ID.IM-01 Improvements are identified from evaluations | AC-1 AT-1 AU-1 CA-1 CM-1 CP-1 IA-1 IR-1 MA-1 MP-1 PE-1 PL-1 PM-1 PS-1 PT-1 RA-1 SA-1 SC-1 SI-1 SR-1 CA-2 CA-5 CA-7 CA-8 CP-2 IR-4 IR-8 PL-2 RA-3 RA-5 RA-7 SA-8 SA-11 SA-17(6) SI-2 SI-4 SR-5 | 03.06.01 03.06.05 03.11.01 03.11.02 03.11.04 03.12.01 03.12.02 03.12.03 03.14.01 03.14.06 03.15.01 03.15.02 03.16.01 03.17.02 |
| ID.IM-02 Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties | AC-1 AT-1 AU-1 CA-1 CM-1 CP-1 IA-1 IR-1 MA-1 MP-1 PE-1 PL-1 PM-1 PS-1 PT-1 RA-1 SA-1 SC-1 SI-1 SR-1 CA-2 CA-5 CA-7 CA-8 CP-2 CP-4 IR-3 IR-4 IR-8 PL-2 PM-4 PM-31 RA-3 RA-5 RA-7 SA-8 SA-11 SI-2 SI-4 SR-5 | 03.06.01 03.06.03 03.06.05 03.11.01 03.11.02 03.11.04 03.12.01 03.12.02 03.12.03 03.14.01 03.14.06 03.15.01 03.15.02 03.16.01 03.17.02 |
| ID.IM-03 Improvements are identified from execution of operational processes, procedures, and activities | AC-1 AT-1 AU-1 CA-1 CM-1 CP-1 IA-1 IR-1 MA-1 MP-1 PE-1 PL-1 PM-1 PS-1 PT-1 RA-1 SA-1 SC-1 SI-1 SR-1 CA-2 CA-5 CA-7 CA-8 CP-2 IR-4 IR-8 PL-2 PM-4 PM-31 RA-3 RA-5 RA-7 SA-4 SA-8 SA-11 SI-2 SI-4 SR-5 | 03.06.01 03.06.05 03.11.01 03.11.02 03.11.04 03.12.01 03.12.02 03.12.03 03.14.01 03.14.06 03.15.01 03.15.02 03.16.01 03.17.02 |
| ID.IM-04 Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved | CP-2 IR-8 PL-2 SR-2 | 03.06.05 03.15.02 03.17.01 |
| ID.RA-01 Vulnerabilities in assets are identified, validated, and recorded | CA-2 CA-7 CA-8 RA-3 RA-5 SA-11(2) SA-15(7) SA-15(8) SI-4 SI-5 | 03.11.01 03.11.02 03.12.01 03.12.03 03.14.03 03.14.06 |
| ID.RA-02 Cyber threat intelligence is received from information sharing forums and sources | SI-5 PM-15 PM-16 | 03.11.01 |
| ID.RA-03 Internal and external threats to the organization are identified and recorded | PM-12 PM-16 RA-3 SI-5 | 03.11.01 03.14.03 |
| ID.RA-04 Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded | PM-9 PM-11 RA-2 RA-3 RA-8 RA-9 | 03.11.01 |
| ID.RA-05 Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization | PM-16 RA-2 RA-3 RA-7 | 03.11.01 03.11.04 |
| ID.RA-06 Risk responses are chosen, prioritized, planned, tracked, and communicated | PM-9 PM-18 PM-30 RA-7 | 03.11.04 |
| ID.RA-07 Changes and exceptions are managed, assessed for risk impact, recorded, and tracked | CA-7 CM-3 CM-4 | 03.04.03 03.04.04 |
| ID.RA-08 Processes for receiving, analyzing, and responding to vulnerability disclosures are established | RA-5 | 03.11.02 |
| ID.RA-09 The authenticity and integrity of hardware and software are assessed prior to acquisition and use | SA-4 SA-5 SA-10 SA-11 SA-15 SA-17 SI-7 SR-5 SR-6 SR-10 SR-11 | 03.11.01 03.17.02 |
| ID.RA-10 Critical suppliers are assessed prior to acquisition | SR-6 | 03.11.01 |
Protect (PR)
| Subcategory | SP 800-53 | SP 800-171 r3 |
|---|---|---|
| PR.AA-01 Identities and credentials for authorized users, services, and hardware are managed by the organization | AC-1 AC-2 AC-14 IA-1 IA-2 IA-3 IA-4 IA-5 IA-6 IA-7 IA-8 IA-9 IA-10 IA-11 | 03.01.01 03.05.01 03.05.02 03.05.03 03.05.04 03.05.05 03.05.07 03.05.11 03.05.12 03.15.01 |
| PR.AA-02 Identities are proofed and bound to credentials based on the context of interactions | IA-12 | |
| PR.AA-03 Users, services, and hardware are authenticated | AC-7 AC-12 IA-2 IA-3 IA-5 IA-7 IA-8 IA-9 IA-10 IA-11 | 03.01.11 03.05.01 03.05.02 03.05.03 03.05.04 03.05.07 03.05.12 |
| PR.AA-04 Identity assertions are protected, conveyed, and verified | IA-13 | |
| PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties | AC-1 AC-2 AC-3 AC-5 AC-6 AC-10 AC-16 AC-17 AC-18 AC-19 AC-24 IA-13 | 03.01.01 03.01.02 03.01.04 03.01.05 03.01.06 03.01.07 03.01.12 03.01.16 03.01.18 03.13.08 03.15.01 |
| PR.AA-06 Physical access to assets is managed, monitored, and enforced commensurate with risk | PE-2 PE-3 PE-4 PE-5 PE-6 PE-8 PE-18 PE-19 PE-20 | 03.10.01 03.10.02 03.10.07 03.10.08 |
| PR.AT-01 Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind | AT-2 AT-3 | 03.02.02 |
| PR.AT-02 Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind | AT-3 | 03.02.02 |
| PR.DS-01 The confidentiality, integrity, and availability of data-at-rest are protected | CA-3 CP-9 MP-8 SC-4 SC-7 SC-12 SC-13 SC-28 SC-32 SC-39 SC-43 SI-3 SI-4 SI-7 | 03.08.09 03.12.05 03.13.01 03.13.04 03.13.06 03.13.08 03.13.10 03.13.11 03.14.02 03.14.06 |
| PR.DS-02 The confidentiality, integrity, and availability of data-in-transit are protected | AU-16 CA-3 SC-4 SC-7 SC-8 SC-11 SC-12 SC-13 SC-16 SC-40 SC-43 SI-3 SI-4 SI-7 | 03.12.05 03.13.01 03.13.04 03.13.06 03.13.08 03.13.10 03.13.11 03.14.02 03.14.06 |
| PR.DS-10 The confidentiality, integrity, and availability of data-in-use are protected | AC-2 AC-3 AC-4 AU-9 AU-13 CA-3 CP-9 SA-8 SC-4 SC-7 SC-11 SC-13 SC-24 SC-32 SC-39 SC-40 SC-43 SI-3 SI-4 SI-7 SI-10 SI-16 | 03.01.01 03.01.02 03.01.03 03.03.08 03.08.09 03.12.05 03.13.01 03.13.04 03.13.06 03.13.11 03.14.02 03.14.06 03.16.01 |
| PR.DS-11 Backups of data are created, protected, maintained, and tested | CP-6 CP-9 | 03.08.09 |
| PR.IR-01 Networks and environments are protected from unauthorized logical access and usage | AC-3 AC-4 SC-4 SC-5 SC-7 | 03.01.02 03.01.03 03.13.01 03.13.04 03.13.06 |
| PR.IR-02 The organization's technology assets are protected from environmental threats | CP-2 PE-9 PE-10 PE-11 PE-12 PE-13 PE-14 PE-15 PE-18 PE-23 | |
| PR.IR-03 Mechanisms are implemented to achieve resilience requirements in normal and adverse situations | SA-8 SA-24 SC-6 SC-24 SC-36 SC-39 SI-13 (families: CP, IR) | 03.16.01 |
| PR.IR-04 Adequate resource capacity to ensure availability is maintained | CP-6 CP-7 CP-8 PM-3 PM-9 | |
| PR.PS-01 Configuration management practices are established and applied | CM-1 CM-2 CM-3 CM-4 CM-5 CM-6 CM-7 CM-8 CM-9 CM-10 CM-11 | 03.04.01 03.04.02 03.04.03 03.04.04 03.04.05 03.04.06 03.04.08 03.04.10 03.04.12 03.15.01 |
| PR.PS-02 Software is maintained, replaced, and removed commensurate with risk | CM-11 MA-3(6) SA-10(1) SI-2 SI-7 | 03.14.01 |
| PR.PS-03 Hardware is maintained, replaced, and removed commensurate with risk | CM-7(9) SA-10(3) SC-3(1) SC-39(1) SC-49 SC-51 | |
| PR.PS-04 Log records are generated and made available for continuous monitoring | AU-2 AU-3 AU-6 AU-7 AU-11 AU-12 SA-15(13) | 03.03.02 03.03.03 03.03.05 03.03.06 |
| PR.PS-05 Installation and execution of unauthorized software are prevented | CM-7(2) CM-7(4) CM-7(5) SC-34 | |
| PR.PS-06 Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle | SA-3 SA-8 SA-10 SA-11 SA-15 SA-15(13) SA-17 SA-24 | 03.16.01 |
Detect (DE)
| Subcategory | SP 800-53 | SP 800-171 r3 |
|---|---|---|
| DE.AE-02 Potentially adverse events are analyzed to better understand associated activities | AU-6 CA-7 IR-4 SI-4 | 03.03.05 03.06.01 03.12.03 03.14.06 |
| DE.AE-03 Information is correlated from multiple sources | AU-6 CA-7 PM-16 IR-4 IR-5 IR-8 SI-4 | 03.03.05 03.06.01 03.06.02 03.06.05 03.12.03 03.14.06 |
| DE.AE-04 The estimated impact and scope of adverse events are understood | PM-9 PM-11 PM-18 PM-28 PM-30 | |
| DE.AE-06 Information on adverse events is provided to authorized staff and tools | IR-4 PM-15 PM-16 RA-4 RA-10 | 03.06.01 |
| DE.AE-07 Cyber threat intelligence and other contextual information are integrated into the analysis | PM-16 RA-3 RA-10 | 03.11.01 |
| DE.AE-08 Incidents are declared when adverse events meet the defined incident criteria | IR-4 IR-8 | 03.06.05 |
| DE.CM-01 Networks and network services are monitored to find potentially adverse events | AC-2 AU-12 CA-7 CM-3 SC-5 SC-7 SI-4 | 03.01.01 03.03.03 03.04.03 03.12.03 03.13.01 03.13.06 03.14.06 |
| DE.CM-02 The physical environment is monitored to find potentially adverse events | CA-7 PE-3 PE-6 PE-20 | 03.10.02 03.10.07 03.12.03 |
| DE.CM-03 Personnel activity and technology usage are monitored to find potentially adverse events | AC-2 AU-12 AU-13 CA-7 CM-10 CM-11 | 03.01.01 03.03.03 03.12.03 |
| DE.CM-06 External service provider activities and services are monitored to find potentially adverse events | CA-7 PS-7 SA-4 SA-9 SI-4 | 03.12.03 03.14.06 03.16.03 |
| DE.CM-09 Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events | AC-4 AC-9 AU-12 CA-7 CM-3 CM-6 CM-10 CM-11 SC-34 SC-35 SI-4 SI-7 | 03.01.03 03.03.03 03.04.02 03.04.03 03.12.03 03.14.06 |
Respond (RS)
| Subcategory | SP 800-53 | SP 800-171 r3 |
|---|---|---|
| RS.AN-03 Analysis is performed to establish what has taken place during an incident and the root cause of the incident | AU-7 IR-4 SI-2(7) | 03.03.06 03.06.01 |
| RS.AN-06 Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved | AU-7 IR-4 IR-6 | 03.03.06 03.06.01 03.06.02 |
| RS.AN-07 Incident data and metadata are collected, and their integrity and provenance are preserved | AU-7 IR-4 IR-6 | 03.03.06 03.06.01 03.06.02 |
| RS.AN-08 An incident's magnitude is estimated and validated | IR-4 IR-8 RA-3 RA-7 | 03.06.01 03.06.05 03.11.01 03.11.04 |
| RS.CO-02 Internal and external stakeholders are notified of incidents | IR-4 IR-6 IR-7 SR-3 SR-8 | 03.06.01 03.06.02 03.17.03 |
| RS.CO-03 Information is shared with designated internal and external stakeholders | IR-4 IR-6 IR-7 SR-3 SR-8 | 03.06.01 03.06.02 03.17.03 |
| RS.MA-01 The incident response plan is executed in coordination with relevant third parties once an incident is declared | IR-6 IR-7 IR-8 SR-3 SR-8 | 03.06.02 03.06.05 03.17.03 |
| RS.MA-02 Incident reports are triaged and validated | IR-4 IR-5 IR-6 | 03.06.01 03.06.02 |
| RS.MA-03 Incidents are categorized and prioritized | IR-4 IR-5 IR-6 | 03.06.01 03.06.02 |
| RS.MA-04 Incidents are escalated or elevated as needed | IR-4 IR-5 IR-6 IR-7 | 03.06.01 03.06.02 |
| RS.MA-05 The criteria for initiating incident recovery are applied | IR-4 IR-8 | 03.06.01 03.06.05 |
| RS.MI-01 Incidents are contained | IR-4 | 03.06.01 |
| RS.MI-02 Incidents are eradicated | IR-4 | 03.06.01 |
Recover (RC)
| Subcategory | SP 800-53 | SP 800-171 r3 |
|---|---|---|
| RC.CO-03 Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders | IR-4 IR-6 SR-8 | 03.06.01 03.06.02 |
| RC.CO-04 Public updates on incident recovery are shared using approved methods and messaging | CP-2 IR-4 | 03.06.01 |
| RC.RP-01 The recovery portion of the incident response plan is executed once initiated from the incident response process | CP-10 IR-4 IR-8 | 03.06.01 03.06.05 |
| RC.RP-02 Recovery actions are selected, scoped, prioritized, and performed | CP-10 IR-4 IR-8 | 03.06.01 03.06.05 |
| RC.RP-03 The integrity of backups and other restoration assets is verified before using them for restoration | CP-2 CP-4 CP-9 | 03.08.09 |
| RC.RP-04 Critical mission functions and cybersecurity risk management are considered to establish post-incident operational norms | PM-8 PM-9 PM-11 IR-1 IR-8 | 03.06.05 03.15.01 |
| RC.RP-05 The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed | CP-10 | |
| RC.RP-06 The end of incident recovery is declared based on criteria, and incident-related documentation is completed | IR-4 IR-8 | 03.06.01 03.06.05 |
About this data
- SP 800-53 Rev. 5 controls, statements and baselines: NIST OSCAL release 5.2.0, last modified 10/22/2026.
- SP 800-171 Rev. 3 requirements and source-control links: NIST OSCAL 1.1.0.
- CSF 2.0 references: NIST CSF 2.0 Reference Tool export. Only NIST-authored references are shown; references to third-party standards are excluded.
- NIST data is a U.S. government work; NIST's OSCAL content is dedicated to the public domain (CC0 1.0). Checked 11/04/2026.