NIST Resources

The National Institute of Standards and Technology (NIST) provides comprehensive frameworks, standards, and guidelines for cybersecurity, risk management, and software development. These resources are essential for organizations seeking to implement robust security practices.

NIST Cybersecurity Framework (CSF)

The NIST Cybersecurity Framework provides a structure for organizations to manage and reduce cybersecurity risk.

Framework Core Functions

┌─────────────────────────────────────────────────────────────────────────────┐
│                    NIST CYBERSECURITY FRAMEWORK                              │
└─────────────────────────────────────────────────────────────────────────────┘

┌─────────┐   ┌─────────┐   ┌─────────┐   ┌─────────┐   ┌─────────┐
│ IDENTIFY│──▶│ PROTECT │──▶│ DETECT  │──▶│ RESPOND │──▶│ RECOVER │
└─────────┘   └─────────┘   └─────────┘   └─────────┘   └─────────┘
     │             │             │             │             │
     ▼             ▼             ▼             ▼             ▼
  Asset        Access        Security      Incident      Recovery
  Management   Control       Monitoring    Response      Planning
  Risk Mgmt    Awareness     Detection     Analysis      Improvements
  Governance   Data Sec      Anomalies     Mitigation    Comms

Function Categories

Implementation Tiers

NIST 800-53 Security Controls

NIST Special Publication 800-53 provides a catalog of security and privacy controls for federal information systems.

Control Families

Control Baselines

NIST Risk Management Framework (RMF)

The RMF provides a structured process for managing security and privacy risk.

RMF Steps

┌─────────────────────────────────────────────────────────────────────────────┐
│                    RISK MANAGEMENT FRAMEWORK                                 │
└─────────────────────────────────────────────────────────────────────────────┘

    ┌───────────┐
    │ PREPARE   │  Establish context, priorities, resources
    └─────┬─────┘
          │
          ▼
    ┌───────────┐
    │CATEGORIZE │  Categorize system based on impact
    └─────┬─────┘
          │
          ▼
    ┌───────────┐
    │  SELECT   │  Select appropriate security controls
    └─────┬─────┘
          │
          ▼
    ┌───────────┐
    │ IMPLEMENT │  Implement and document controls
    └─────┬─────┘
          │
          ▼
    ┌───────────┐
    │  ASSESS   │  Assess control effectiveness
    └─────┬─────┘
          │
          ▼
    ┌───────────┐
    │ AUTHORIZE │  Authorize system operation
    └─────┬─────┘
          │
          ▼
    ┌───────────┐
    │  MONITOR  │  Continuously monitor controls
    └───────────┘

NIST 800-Series Publications

Key Publications

Software Development Publications

Secure Software Development Framework (SSDF)

NIST SP 800-218 defines practices for secure software development.

SSDF Practice Groups

Key Practices

SSDF_Practices:
  Prepare:
    - PO.1: Define security requirements
    - PO.2: Implement roles and responsibilities
    - PO.3: Implement supporting toolchains
    - PO.4: Define criteria for software security checks
    - PO.5: Implement and maintain secure environments

  Protect_Software:
    - PS.1: Protect all forms of code
    - PS.2: Provide software integrity verification
    - PS.3: Archive and protect release data

  Produce_Well_Secured:
    - PW.1: Design to meet security requirements
    - PW.2: Review software design
    - PW.4: Reuse secure software
    - PW.5: Create source code adhering to standards
    - PW.6: Configure compilation to secure code
    - PW.7: Review and analyze human-readable code
    - PW.8: Test executable code
    - PW.9: Configure software to have secure settings

  Respond_Vulnerabilities:
    - RV.1: Identify and confirm vulnerabilities
    - RV.2: Assess vulnerabilities
    - RV.3: Remediate vulnerabilities

Using NIST Resources in NUP

Mapping to NUP Phases

Integration Points

• Requirements: Map to NIST control requirements
• Design: Apply 800-160 security engineering
• Implementation: Follow SSDF practices
• Testing: Use 800-115 testing guidance
• Deployment: Complete RMF authorization
• Operations: Implement continuous monitoring

Related Resources

• Security
• FedRAMP Guidelines
• Security Checklists
• NIST Cybersecurity Framework
• NIST 800-53 Controls
• Risk Management Framework
• SSDF (800-218)
• NIST Computer Security Resource Center

Compliance

This section fulfills ISO 13485 requirements for regulatory requirements (4.1.1) and risk management (7.1), and ISO 27001 requirements for information security policies (A.5.1), compliance with legal requirements (A.5.31), and risk management (6.1).

View full compliance matrix