Choosing One Framework for CUI, ISO Certification, and Privacy
A defense contractor's new logistics system must satisfy DFARS 252.204-7012 (NIST SP 800-171), an ISO/IEC 27001 certification required by a commercial customer, and an internal privacy standard aligned to the NIST Privacy Framework. The system processes controlled unclassified information and personal data for 8,000 employees. The program manager proposes adopting ISO/IEC 27001 as the single framework because the company is already certified, then mapping 800-171 requirements to ISO Annex A to avoid duplicate work. The compliance lead notes that 800-171 contains 110 security requirements and that internal audit found 14 ISO controls with no supporting evidence. One customer contract requires audit logs retained for one year, while the company's ISMS standard says 90 days. The CISO must approve a framework and tailoring approach before the security assessment begins.
1. Assess the proposal to use ISO/IEC 27001 as the single framework and recommend an approach the CISO can approve.
Read the worked answer
ISO/IEC 27001 certifies a management system, not a control baseline. Its Annex A is a set of controls that must be selected and justified in a Statement of Applicability. It does not contain the 110 specific 800-171 requirements, the CUI scoping rules, or the assessment procedures used to test those requirements. Mapping 800-171 to Annex A can reduce duplicate evidence collection, but a mapping is an assertion of correspondence, not proof that a requirement is met. The 14 ISO controls with no supporting evidence show the danger: a certified ISMS can still lack operating evidence for individual controls.
I would approve a layered architecture:
- NIST SP 800-171 as the mandatory control baseline for the CUI system, because it is contractually incorporated through DFARS.
- ISO/IEC 27001 as the enterprise ISMS overlay supplying risk treatment, internal audit, management review, and corrective action.
- NIST Privacy Framework as the privacy overlay for the 8,000 employees' personal data.
One SSP should hold the 800-171 requirements, with crosswalk columns to Annex A and to privacy controls. The CISO should require the crosswalk to be validated by the assessor, not by the program manager, and should require evidence for each mapped control. Where ISO and 800-171 differ in specificity, the more specific requirement governs. This gives the commercial customer its certificate and the DoD its CUI controls without maintaining three separate assessment universes or pretending one framework satisfies all three obligations.
2. Resolve the audit-log retention conflict and explain how tailoring, overlays, and exceptions should be documented for the assessor.
Read the worked answer
The contract's one-year retention is a customer requirement and cannot be tailored away by the company's 90-day ISMS standard. Tailoring changes how a control is implemented; it does not erase a contractual obligation. The baseline should therefore be one year, implemented in tiers: at least 90 days immediately searchable online, the remainder in immutable archive, and a documented restore-and-test procedure so the assessor can verify retrievability. The ISMS standard should be revised to state that contractual, legal, or regulatory retention requirements override the default, with the rationale recorded.
Documentation belongs in three places: the SSP control description for audit log retention, the overlay statement, and the Statement of Applicability. I would record the conflict, the decision, the legal or contract basis, the retention architecture, and the review date. If a business unit wants a shorter period, that is an exception request, not tailoring. It needs a risk assessment, a privacy review because longer retention increases privacy exposure, and approval by the CISO and the contracting officer. For the assessment, the assessor should sample both a 100-day-old log and a 300-day-old log and verify that the archive is readable and complete. A policy statement alone is not evidence. This also prevents a common failure: labeling a control “tailored” when the organization has actually accepted a contract breach.