Search results
26 sty 2021 · New and updated supplemental materials for NIST Special Publication (SP) 800-53, Revision 5, Security and Privacy Controls for Information Systems and Organizations, and NIST SP 800-53B, Control Baselines for Information Systems and Organizations, are available for download to support the December 10, 2020, errata release of SP 800-53 and SP ...
- Controls
Use these CSRC Topics to identify and learn more about...
- Controls
10 gru 2020 · This publication provides a catalog of security and privacy controls for information systems and organizations to protect organizational operations and assets, individuals, other organizations, and the Nation from a diverse set of threats and risks, including hostile attacks, human errors, natural... See full abstract.
10 gru 2020 · This publication provides a catalog of security and privacy controls for information systems and organizations to protect organizational operations and assets, individuals, other organizations, and the Nation from a diverse set of threats and risks, including hostile attacks, human errors, natural... See full abstract.
10 gru 2020 · There are three security control baselines (one for each system impact level—low-impact, moderate-impact, and high-impact), as well as a privacy baseline that is applied to systems irrespective of impact level.
10 gru 2020 · The controls are flexible and customizable and implemented as part of an organization-wide process to manage risk. The controls address diverse requirements derived from mission and business needs, laws, executive orders, directives, regulations, policies, standards, and guidelines.
This process includes the addition of new assets, changes to assets, and the elimination of assets. The purpose of configuration and change management is to “establish processes to ensure the integrity of assets, using change control and change control audits” (CRR).
Assessment results are used to support the determination of security control effectiveness over time. This document is a guide to the basic technical aspects of conducting information security assessments.