NSPM-C cheat sheet

NIST CSF 2.0 (2024) has six Functions: Govern (GV), Identify (ID), Protect (PR), Detect (DE), Respond (RS), Recover (RC); Govern was added in 2.0 and is the only new Function.

CSF 2.0 Categories are the second tier: e.g., GV.OC (Organizational Context), GV.RM (Risk Management Strategy), GV.RR (Roles, Responsibilities, and Authorities), GV.PO (Policy), GV.OV (Oversight), GV.SC (Supply Chain Risk Management).

CSF Implementation Tiers (1 Partial, 2 Risk Informed, 3 Repeatable, 4 Adaptive) describe rigor of cybersecurity risk governance, not maturity of individual controls; Tier selection is a cost-benefit decision by leadership.

CSF Profiles (Current and Target) map business objectives and risk appetite to CSF outcomes; a Community Profile is a baseline Profile published for a sector or use case.

RMF (SP 800-37 Rev. 2) has seven steps: Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor; Prepare was added in Rev. 2 and runs at organization and system level.

FIPS 199 categorizes by the high-water mark of Confidentiality, Integrity, Availability impact (Low/Moderate/High); the system category equals the highest impact value across the three objectives.

SP 800-53 Rev. 5 organizes controls into 20 families with two-character identifiers (AC, AT, AU, CA, CM, CP, IA, IR, MA, MP, PE, PL, PM, PS, PT, RA, SA, SC, SI, SR); PT (PII Processing) and SR (Supply Chain) were added in Rev. 5.

SP 800-53A assessment procedures pair each control with Examine, Interview, and Test methods; SP 800-53B provides Low, Moderate, High, and Privacy baselines built from the same control catalog.

Authorization to Operate (ATO) is a senior official's time-bound acceptance of risk; alternatives are ATO with conditions, Interim ATO (IATO), and Denial of ATO (DATO); continuous monitoring supports ongoing authorization.

NIST RMF risk = function of likelihood of a threat event and its adverse impact; SP 800-30 Rev. 1 defines risk assessment as threat source, vulnerability, likelihood, impact, and risk determination steps.

Risk response options in SP 800-39 are Accept, Avoid, Transfer, and Mitigate (controls); Monitor is a continuous cross-cutting activity, not a fifth response option.

NIST Privacy Framework (2020) mirrors CSF structure with five Functions: Identify-P, Govern-P, Control-P, Communicate-P, Protect-P; Govern-P was added at release, unlike CSF where Govern came in 2.0.

Privacy Framework Profiles: Current, Target, and Community; the framework is voluntary and designed to be used alongside the CSF, sharing the same Core structure of Functions, Categories, and Subcategories.

SP 800-34 Rev. 1 defines the BIA, then contingency strategies; the seven-step contingency planning process ends with testing, training, and exercises (TT&E) and plan maintenance.

Recovery metrics: RTO is maximum tolerable downtime before unacceptable impact; RPO is maximum tolerable data loss measured in time; MTD is total time a mission can be unavailable; WRT is time to restore the system.

SP 800-137 continuous monitoring: define strategy, establish program, implement, analyze and report, respond, and review/update; ISCM outputs feed authorization decisions.

FAIR and OCTAVE are alternative risk methodologies; NIST does not mandate a single quantitative method, but SP 800-30 Appendix supports semi-quantitative assessment scales.

Privacy risk per NIST is the likelihood that an operation creates problems for individuals (embarrassment, discrimination, loss of autonomy), distinct from organizational risk.

SP 800-53 control baselines include control enhancements (e.g., AC-2(1)); tailoring removes or scopes controls, and supplementation adds controls from other sources; both are documented in the SSP.

Scoping considerations in SP 800-53B include shared services, common controls, system-specific controls, hybrid controls, and inheritance; inherited controls still appear in the SSP with the provider identified.

Security Assessment Plan (SAP) documents scope, methods, and schedule; Security Assessment Report (SAR) records findings; POA&M tracks weaknesses with milestones, resources, and scheduled completion dates.

SP 800-37 Rev. 2 uses control-based risk assessment plus an all-in-one assessment; assessors evaluate control effectiveness as Satisfied, Other than Satisfied, or Not Applicable.

SP 800-171 protects Controlled Unclassified Information in nonfederal systems with 110 requirements across 14 families; CMMC assesses implementation at Levels 1-3 (Foundational, Advanced, Expert).

SP 800-172 provides enhanced requirements for CUI at CMMC Level 3; SP 800-171A supplies assessment procedures for each 800-171 requirement.

FIPS 200 specifies minimum security requirements in 17 areas; SP 800-53 controls map to those requirement areas, and FIPS 199/200 apply to federal information systems.

Continuous diagnostics and mitigation (CDM) and vulnerability scanning (RA-5) generate data for ongoing authorization; significant changes trigger reauthorization or a new assessment.

Control effectiveness differs from compliance: a control can be implemented as written but ineffective; assessment must test design and operating effectiveness.

SP 800-61 Rev. 3 (2025) restructures incident response around the CSF 2.0 Functions: Govern, Identify, Protect, Detect, Respond, Recover; the older four-phase model (Preparation; Detection and Analysis; Containment, Eradication, Recovery; Post-Incident) is superseded.

Incident response lifecycle activities include triage, handling, and post-incident lessons learned; incident declaration criteria and escalation thresholds belong in the IR plan and are approved by leadership.

SP 800-161 Rev. 1 addresses C-SCRM across the acquisition lifecycle, integrating supply chain risk into RMF steps; SR family controls (SR-1 to SR-12) implement it in SP 800-53 Rev. 5.

SBOM (software bill of materials) formats include SPDX and CycloneDX; EO 14028 and OMB M-22-18/M-23-16 drive attestation of secure software development for federal suppliers.

Governance roles: Authorizing Official accepts risk; System Owner operates the system; ISSO supports the AO; CISO oversees the security program; Senior Agency Official for Privacy (SAOP) owns privacy risk.

SP 800-39 defines the three-tier risk management hierarchy: Tier 1 organization, Tier 2 mission/business process, Tier 3 information system; risk decisions flow down and risk information flows up.

Third-party risk: SP 800-161 requires supplier risk assessments, flow-down of requirements in contracts, and monitoring; common controls provided by a CSP must be documented and inherited formally.

Cyber threat intelligence sharing under CISA 2022 (formerly the Cybersecurity Information Sharing Act) is voluntary and protected; ISACs and ISAOs are sector information-sharing bodies.

Incident severity is determined by functional impact, information impact, and recoverability effort (SP 800-61); these three factors drive escalation and notification decisions.

Authorization package contents: SSP, SAR, POA&M, and the authorization decision document; the AO signs the decision and defines the authorization boundary and term.

SP 800-37 Rev. 2 integrates privacy risk into RMF; the SAOP or privacy officer reviews the PTA/PIA and advises the AO on privacy risk acceptance.

Continuous monitoring (SP 800-137) requires an ISCM strategy tied to organizational risk tolerance; automated feeds and dashboards support ongoing authorization.

Significant change examples: new interfaces, changes to categorization, new processing location, or changes affecting inherited controls; each can require reassessment before continued operation.

Conmon metrics and reporting frequency are defined in the ISCM strategy; the AO determines whether ongoing authorization remains valid based on reported risk.

SP 800-53A assessment methods: Examine (review, observe), Interview (discuss), Test (exercise); each control assessment procedure specifies objects and methods.

POA&M weaknesses are prioritized by risk; a POA&M does not by itself permit operation of a system with unacceptable risk without AO approval.

RMF Prepare step outputs include the organization-wide risk management strategy, the authorization boundary, and the roles and responsibilities needed for the remaining steps.

Reciprocity: an AO may accept another AO's assessment results, but must document acceptance and confirm the assessment scope matches the current system.

NIST Privacy Framework Core Functions: Identify-P, Govern-P, Control-P, Communicate-P, Protect-P; each has Categories and Subcategories analogous to CSF.

NISTIR 8062 privacy engineering objectives: predictability, manageability, and disassociability; these translate privacy risk into system design goals.

SP 800-53 Rev. 5 privacy controls live in the PT family and AR (Assessment, Authorization, and Monitoring) family; PT controls cover authority, purpose, notices, consent, and data quality.

SP 800-188 de-identification guidance: de-identification reduces but does not eliminate re-identification risk; NIST describes it as a risk management process, not a binary state.

PIA (Privacy Impact Assessment) evaluates how PII is collected, used, shared, and retained; a PTA (Privacy Threshold Analysis) determines whether a PIA is required.

Data minimization, purpose limitation, and retention limits are core privacy principles reflected in PT-02, PT-03, and PT-06; consent must be documented and revocable where required.

SP 800-122 defines PII confidentiality impact levels (Low, Moderate, High) based on identifiability, quantity, sensitivity, context, and access; High requires the strongest safeguards.

Privacy breach response requires notification per applicable law and policy; NIST guidance emphasizes assessing harm to individuals, not only organizational liability.

SP 800-160 Vol. 1 applies systems security engineering across the lifecycle; security requirements are derived early and traced through design, implementation, and verification.

SP 800-160 Vol. 2 addresses cyber resiliency: anticipate, withstand, recover from, and adapt to adverse conditions; design principles include diversity, redundancy, and segmentation.

Zero trust (SP 800-207) removes implicit trust based on network location; components include the Policy Decision Point (PDP), Policy Enforcement Point (PEP), and Policy Engine/Administrator.

SP 800-207 tenets include per-request authentication and authorization, least privilege, micro-segmentation, and continuous monitoring of assets and posture.

SP 800-125/125A cover virtualization security; SP 800-145 defines cloud essential characteristics, service models (IaaS, PaaS, SaaS), and deployment models (public, private, hybrid, community).

SP 800-144 and SP 800-146 address public cloud security and cloud computing synopsis; FedRAMP authorizes cloud services for federal use via a standardized assessment process.

Boundary protection (SC-7) and encryption (SC-8, SC-13, SC-28) are key architectural controls; FIPS 140-3 validates cryptographic modules.

Defense in depth layers people, process, and technology controls; a single control failure should not defeat the security posture, which is why compensating controls are documented.

NIST SP 800-50 establishes a security awareness and training program lifecycle: design, develop, implement, and maintain; role-based training is required for personnel with significant security responsibilities.

AT family controls (AT-1 to AT-6) cover policy, literacy training, role-based training, and training records; annual refresher is typical but the control requires defined frequency.

SP 800-16 defines role-based training for security professionals; SP 800-100 provides an information security handbook for managers covering the full program.

Workforce development uses NICE Framework work roles and task/knowledge/skill statements to define competencies and training needs.

SP 800-53 PM family covers program-level controls: PM-1 policy, PM-2 roles, PM-9 risk strategy, PM-14 testing/training/exercises, PM-30 supply chain risk management.

Training effectiveness is measured by completion, assessment results, and simulated exercise performance; phishing simulation metrics are common but not a NIST requirement.

Security awareness content must be updated when policies, threats, or systems change; training records retention follows organizational policy and applicable law.

SP 800-84 covers test, training, and exercise (TT&E) programs for contingency plans; exercise types include tabletop, functional, and full-scale.

Insider threat programs (NITTF guidance) coordinate with HR, legal, and security; monitoring must respect privacy controls and legal limits.

Publication types: FIPS are mandatory federal standards; SP 800-series are guidelines; NISTIR are internal or interim reports; SP 1800-series are practice guides; SP 1300-series cover interagency reports.

SP 800-53 Rev. 5 control structure: control statement, discussion, related controls, and control enhancements; enhancements are numbered parenthetically (e.g., IA-2(1)).

SP 800-53B baselines: Low (about 150 controls), Moderate (about 300), High (about 400) after removing nonapplicable controls; Privacy baseline overlays the others.

FIPS 199 impact levels combine to a system categorization (e.g., FIPS 199 Moderate); FIPS 200 sets minimum requirements, and SP 800-53B provides the baseline for that level.

Terms: threat source, vulnerability, risk, residual risk, and risk appetite; residual risk is what remains after controls and must be accepted by the AO.

NIST glossary (CSRC) is the authoritative source for definitions; use it to resolve conflicts between framework terminology (e.g., CSF outcome vs. RMF control).

SP 800-53 Rev. 5 removed the 800-53A assessment procedures to a separate publication and consolidated privacy controls, making the catalog usable by public and private sectors.

Revision currency matters: SP 800-61 Rev. 3 (2025), SP 800-53 Rev. 5 (2020), SP 800-37 Rev. 2 (2018), CSF 2.0 (2024); citing superseded revisions is a common exam error.

NIST does not certify or accredit organizations; conformance is self-attested or assessed by third parties such as FedRAMP 3PAOs.

FISMA requires federal agencies to implement FIPS 200 and SP 800-53, undergo annual assessments, and report to OMB; NIST develops the standards, not the enforcement.

Privacy Act of 1974 governs federal agency records on individuals; systems of records require a SORN published in the Federal Register.

OMB Circular A-130 assigns responsibilities for managing federal information as a strategic resource and requires privacy and security programs.

FedRAMP uses NIST SP 800-53 baselines (Low, Moderate, High, and LI-SaaS) with a standardized authorization package and continuous monitoring requirements.

Crosswalk documents map CSF, RMF, ISO/IEC 27001, and CIS Controls; mappings show correspondence but do not prove equivalence of controls.

CMMC 2.0 aligns with SP 800-171 (Level 2) and SP 800-172 (Level 3); Level 1 is self-assessed against FAR 52.204-21 basic safeguarding requirements.

GDPR and state privacy laws impose obligations beyond NIST guidance; NIST frameworks are voluntary unless incorporated into law, regulation, or contract.

Executive Order 14028 and OMB memoranda (M-22-09 zero trust, M-23-16 software attestation) direct federal cybersecurity actions using NIST standards.

Records retention and legal hold requirements interact with privacy retention limits; legal obligations override default deletion schedules.

FedRAMP authorization requires a 3PAO assessment, an SSP, a SAR, a POA&M, and continuous monitoring; agencies can reuse an existing ATO via reciprocity.

Cloud shared responsibility: the CSP secures the underlying infrastructure; the customer secures data, identities, and configuration; the split varies by service model (IaaS, PaaS, SaaS).

C-SCRM per SP 800-161 Rev. 1 spans Tier 1 (organization), Tier 2 (mission/process), and Tier 3 (system) risk, and requires supplier due diligence and contract flow-down.

Counterfeit and tampered components are supply chain threats; mitigation includes provenance verification, trusted foundries, and acceptance testing.

IoT and OT risk guidance (SP 800-183, NISTIR 8259) emphasizes device identity, configuration management, and network segmentation.

AI risk management (AI RMF 1.0, 2023) uses four Functions: Govern, Map, Measure, Manage; it is voluntary and intended to be used with the CSF and Privacy Framework.

Post-quantum cryptography migration (NIST IR 8547 draft) plans deprecation of RSA/ECC by 2030 and disallowance by 2035; NIST selected ML-KEM, ML-DSA, and SLH-DSA standards in 2024.

Secure software development (SP 800-218, SSDF) defines practices for producers; EO 14028 attestation requires suppliers to confirm SSDF conformance.

Threat modeling (e.g., STRIDE) identifies threats early; NIST does not prescribe a single method but expects risk assessment to inform control selection.

Audit logging (AU family) requires defined event types, content, retention, and protection; AU-9 protects audit information from unauthorized access and modification.

Time synchronization (AU-8) is required for reliable log correlation; NTP sources must be authenticated where feasible.

Metrics should be SMART and tied to risk; examples include mean time to detect, patch latency, and percentage of controls assessed.

SP 800-55 Rev. 1 provides a process for developing, selecting, and implementing security measurement programs aligned to goals.

Independent assessment (CA-2) and internal assessment (CA-2(1)) differ in assessor independence; the AO relies on assessment results for authorization decisions.

Findings must be tracked to closure in a POA&M with owners and dates; repeat findings indicate a process failure, not just a technical gap.

Lessons learned from incidents and exercises feed back into policy, training, and control selection, closing the continuous improvement loop.

Dashboards for leadership should show risk trends and residual risk against appetite, not raw control counts.

Benchmarking against peers is optional; NIST does not publish maturity scores for organizations, only frameworks and assessment methods.

Security requirements are defined during requirements analysis and traced through design, build, test, and deployment; late-added controls increase cost and risk.

SP 800-64 Rev. 2 (superseded by SP 800-160 Vol. 1) addressed security in the SDLC; current guidance integrates RMF steps with lifecycle phases.

Acquisition documents (SOW, contract) must include security and privacy requirements, assessment rights, and reporting obligations for suppliers.

Configuration management (CM family) establishes baselines; CM-2 baseline configuration, CM-3 change control, and CM-6 configuration settings are core.

Secure coding and testing: SA-11 requires developer testing, SA-15 requires a documented development process, and SA-8 requires security engineering principles.

DevSecOps embeds security testing in CI/CD pipelines; automated scanning and SBOM generation support continuous assessment.

Test data must be protected; production data in test environments requires masking or de-identification to limit privacy risk.

Disposal and decommissioning (MP-6, SA-22) require sanitization per SP 800-88 Rev. 1 (Clear, Purge, Destroy) before media reuse or release.

Legacy system risk: unsupported components require compensating controls and a documented migration plan approved by the AO.

PE family controls cover physical access authorization, monitoring, and environmental controls (power, fire, temperature, water); PE-3 defines physical access control mechanisms.

Personnel security (PS family) includes position risk designation, screening, termination procedures, and transfer procedures; PS-3 screening must occur before access is granted.

Separation of duties (AC-5) and least privilege (AC-6) limit insider risk; privileged access requires additional controls such as AC-6(5) and AU-14 session auditing.

Visitor control requires escorts and logs; physical access records retention aligns with audit retention policy.

Environmental threats include power failure, fire, flood, and HVAC failure; redundancy and alternate sites mitigate availability risk.

Media protection (MP family) covers access, marking, storage, transport, and sanitization; MP-6 sanitization must follow SP 800-88.

Insider threat mitigation combines monitoring, access reviews, and behavioral indicators; monitoring must comply with privacy and employment law.

Facility security plans should align with the system boundary and FIPS 199 availability impact; a High availability impact requires stronger environmental safeguards.

Mobile device and telework security (SP 800-114, SP 800-124) extend the boundary; device management and encryption are required for remote access.

FIPS 140-3 validates cryptographic modules at security levels 1-4; FIPS 140-2 certificates are being retired, and new acquisitions should require 140-3 validated modules.

FIPS 186-5 defines digital signature algorithms (RSA, ECDSA, EdDSA); SP 800-57 Part 1 defines key management lifecycle and cryptoperiods.

SP 800-63B addresses authenticator assurance levels (AAL1, AAL2, AAL3); AAL3 requires hardware-based authenticators and verifier impersonation resistance.

NIST deprecated SMS out-of-band authentication for AAL2/3 due to interception risk; phishing-resistant authenticators (FIDO/WebAuthn) are preferred.

Password guidance (SP 800-63B) recommends length over complexity, screening against breached lists, and no forced periodic rotation absent evidence of compromise.

Identity federation uses assertions (SAML, OIDC); SP 800-63C defines federation assurance levels (FAL1-3) based on assertion protection and holder-of-key binding.

Key management: keys must be generated, distributed, stored, and destroyed per policy; split knowledge and dual control apply to high-value keys.

Crypto agility allows replacement of algorithms without redesign; it is essential for post-quantum migration and for responding to algorithm deprecation.

Digital signatures provide integrity, authentication, and non-repudiation; encryption alone does not provide non-repudiation.

SC-7 boundary protection requires monitoring and control of communications at external and internal boundaries; DMZ architecture separates public-facing services from internal networks.

Firewall rule sets should follow deny-by-default and least privilege; rules must be reviewed and recertified periodically.

SP 800-41 Rev. 1 covers firewall and firewall policy; SP 800-94 covers intrusion detection and prevention systems (IDPS).

Remote access (AC-17) requires encryption, authentication, and authorization; VPN and zero trust network access are common implementations.

Wireless security (SP 800-153) requires strong encryption (WPA2/WPA3-Enterprise), rogue access point detection, and guest network isolation.

Network segmentation limits lateral movement; micro-segmentation enforces policy at workload level per SP 800-207 zero trust principles.

DNS security (SP 800-81 Rev. 3) includes DNSSEC, response policy zones, and protection against cache poisoning.

TLS configuration should follow SP 800-52 Rev. 2; TLS 1.0/1.1 are deprecated and should be disabled.

Egress filtering and data loss prevention reduce exfiltration risk; monitoring outbound traffic is part of boundary protection.

RA-5 requires vulnerability scanning at defined frequency and before new deployments; scan results must be analyzed and remediated or accepted.

Patch management (SI-2) requires identifying, testing, and deploying patches within defined timeframes based on severity; exceptions require documented approval.

CVSS base score measures severity, not organizational risk; environmental and temporal metrics adjust the score for context.

Flaw remediation (SI-2) and malicious code protection (SI-3) are distinct controls; anti-malware must be updated and monitored.

Penetration testing (CA-8) is periodic and scoped; it differs from vulnerability scanning in depth and exploit validation.

Threat intelligence feeds inform prioritization; CISA Known Exploited Vulnerabilities (KEV) catalog is used to prioritize remediation.

Vulnerability disclosure programs and bug bounties supplement internal testing; NIST SP 800-216 covers vulnerability disclosure.

Software composition analysis identifies vulnerable third-party components; SBOM data supports this analysis.

Risk-based prioritization considers exploitability, exposure, and business impact, not just CVSS score.

Contingency planning (CP family) includes the BIA, recovery strategy, plan development, testing, and maintenance; CP-2 requires a documented contingency plan.

Alternate site types: hot site (fully operational), warm site (partially equipped), cold site (space and power only); mobile and mirrored sites are alternatives.

Backup (CP-9) requires defined frequency, retention, and testing; backups must be protected with encryption and access controls.

Recovery testing (CP-4) includes tabletop, functional, and full-scale exercises; results must update the plan.

MTD is the total time a mission can tolerate unavailability; RTO must be less than or equal to MTD minus the time needed to recover.

Crisis communications (CP-2(5)) and alternate communications paths must be documented and tested.

Reconstitution (CP-10) covers restoring the system after a disruption, including validation and return to normal operations.

Capacity planning and redundancy mitigate availability risk; FIPS 199 High availability systems require stronger contingency measures.

Supply chain disruptions are a continuity risk; alternate suppliers and components should be identified in advance.

Data governance assigns ownership, stewardship, and classification responsibilities; classification drives control selection.

CUI (Controlled Unclassified Information) is governed by 32 CFR Part 2002 and the NARA CUI Registry; handling requirements come from the applicable category.

Data classification levels vary by organization; federal examples include Public, CUI, and Classified, with handling rules at each level.

Data retention schedules derive from records management law and policy; deletion must be verifiable and consistent with legal hold.

Data quality (PT-06, DI-1) requires accuracy, relevance, timeliness, and completeness of PII used in decisions about individuals.

Data sharing agreements must specify purpose, safeguards, retention, and breach notification obligations.

Metadata protection matters: aggregation and inference can reveal sensitive information even when individual fields are protected.

Data loss prevention and egress monitoring enforce handling rules at the boundary.

Privacy and security controls overlap on data protection but differ in objective: privacy protects individuals, security protects the organization and its information.

Policy hierarchy: laws and regulations, then organizational policy, then standards, then procedures and guidelines; each level must trace upward.

PM-1 requires a system security plan policy; PL-1 requires a security planning policy; policies must be reviewed and updated at defined intervals.

Roles and responsibilities must be documented and communicated; the AO is accountable for risk acceptance, not the ISSO.

Third-party oversight includes pre-acquisition due diligence, contract requirements, ongoing monitoring, and offboarding; SP 800-161 provides the framework.

Supply chain risk management (SR family) includes SR-3 (supply chain controls), SR-5 (acquisition strategies), and SR-6 (supplier assessments).

Audit rights and right-to-assess clauses must be in contracts to enable verification of supplier controls.

Incident notification obligations for suppliers must be defined with timeframes and escalation paths.

Concentration risk arises when many services depend on one supplier; diversification and exit strategies mitigate it.

Governance metrics should measure policy compliance, third-party risk, and remediation timeliness, and be reported to leadership.

SI-4 requires system monitoring, including intrusion detection and unauthorized access detection; monitoring scope and tools must be documented.

SOC operations include alert triage, escalation, and shift handover; playbooks define response for common scenarios.

Log management requires centralized collection, protection, and retention; SIEM correlation supports detection and investigation.

Alert tuning reduces false positives but must not suppress true positives; tuning changes should be documented and reviewed.

Endpoint detection and response (EDR) provides visibility and containment; it complements but does not replace network monitoring.

Security operations metrics include mean time to detect (MTTD) and mean time to respond (MTTR); both should trend downward.

Threat hunting is proactive hypothesis-driven search for undetected threats; it differs from alert-driven monitoring.

Monitoring must respect privacy controls; monitoring of employee activity requires legal review and notice where required.

Incident escalation thresholds should align with severity criteria and regulatory notification deadlines.

NIST guidance is voluntary unless adopted by law, regulation, or contract; exam answers should reflect the binding source, not the framework alone.

When a question asks for the FIRST step, prefer governance or planning steps (e.g., Prepare, categorize, define requirements) over technical fixes.

When a question asks for the BEST action, prefer risk-based, documented, and approved actions over ad hoc technical responses.

Distinguish roles: AO accepts risk, system owner operates, ISSO supports, SAOP owns privacy risk; answers assigning risk acceptance to the wrong role are wrong.

Distinguish assessment from authorization: assessment produces a SAR; authorization produces an ATO decision.

Distinguish policy from procedure: policy states what and why; procedures state how and by whom.

Superseded publications are common distractors; verify the current revision before selecting an answer.

NIST does not certify organizations; answers implying NIST certification or accreditation are incorrect.

Privacy risk is about harm to individuals; security risk is about harm to the organization; questions about PII impact require the privacy lens.

Continuous monitoring is ongoing, not a one-time assessment; answers treating conmon as a single event are incorrect.

Resilience per SP 800-160 Vol. 2 includes anticipation, withstanding, recovery, and adaptation; design for graceful degradation.

Recovery objectives must be validated through testing; untested plans are assumptions, not capabilities.

Post-incident activities include root cause analysis, lessons learned, and control updates; findings feed the POA&M.

Incident data must be preserved for investigation and legal purposes; chain of custody applies to evidence.

Recovery from ransomware requires validated, isolated backups; paying ransom is a business decision with legal and ethical implications.

Communication plans must include internal escalation, customer notification, and regulator notification where required.

Recovery testing should include partial and full failover; results should measure actual RTO and RPO against targets.

Resilience metrics include recovery time achieved, data loss incurred, and percentage of critical functions restored.

Continuous improvement requires tracking corrective actions to closure and verifying effectiveness through re-assessment.

Human risk is a component of organizational risk; awareness programs aim to change behavior, not just deliver content.

Phishing simulation results should be used to target training, not to punish individuals; punitive programs reduce reporting.

Reporting mechanisms must be easy and well-publicized; fast reporting reduces incident impact.

Role-based training is required for privileged users, incident responders, and developers; content must match responsibilities.

Training completion rates are lagging indicators; behavior metrics (reporting rate, click rate) are leading indicators.

Awareness content should reflect current threats and organizational policy changes; annual review is a minimum.

Remote work increases human risk; training should cover device security, Wi-Fi, and social engineering.

Contractors and third parties require training commensurate with their access; training records should be maintained.

Leadership behavior sets the tone; executive participation in exercises improves program credibility.

CSF 2.0 can be used as the organizing structure for a security program, with RMF providing the control-level detail for federal systems.

Mapping CSF Subcategories to SP 800-53 controls creates traceability from outcomes to controls; crosswalks assist but require validation.

Maturity models (e.g., CMMI, C2M2) assess program capability; NIST does not publish a maturity score, but C2M2 is a NIST-supported model for energy and other sectors.

Program maturity requires documented processes, measurement, and continuous improvement, not just tooling.

Integration reduces duplicate assessments; a single control assessment can satisfy CSF, RMF, and contractual requirements if scoped correctly.

Governance integration aligns security, privacy, and enterprise risk management under a single risk appetite.

Resource allocation should follow risk; high-risk areas warrant disproportionate investment.

Program reviews should occur at planned intervals and after significant changes; outputs update strategy and budgets.

Third-party assessments (e.g., FedRAMP 3PAO) provide independent validation but do not transfer the AO's accountability.

CSF 2.0 (2024) adds Govern and expands supply chain guidance; it applies to organizations of all sizes and sectors and is voluntary.

SP 800-61 Rev. 3 (2025) aligns incident response with CSF 2.0 and emphasizes governance and continuous improvement.

Post-quantum standards (FIPS 203 ML-KEM, FIPS 204 ML-DSA, FIPS 205 SLH-DSA) were finalized in 2024; migration planning should begin now.

AI RMF 1.0 (2023) and the Generative AI Profile (NIST AI 600-1, 2024) address AI-specific risks including hallucination, data leakage, and model misuse.

Software supply chain attestation (OMB M-22-18, M-23-16) requires supplier self-attestation of secure development practices.

Zero trust adoption is directed for federal agencies by OMB M-22-09, with milestones tied to SP 800-207.

Cyber resiliency and defense in depth remain relevant as cloud and remote work expand the boundary.

NIST guidance is updated through public comment; drafts should be identified as drafts, not final requirements.

Exam questions may reference current revisions; verify the publication number and year before answering.

Start with the FIPS 199 categorization, then select the matching SP 800-53B baseline, then tailor for scope and add overlays.

Tailoring decisions must be documented and justified; removing a control requires an alternative or acceptance of risk.

Overlays (e.g., privacy, cloud, OT) add or modify controls for specific contexts without replacing the baseline.

Common controls are inherited from providers; the SSP must identify the provider and the control, and the provider must assess it.

Compensating controls are alternatives that provide equivalent protection; they require AO approval and documentation.

Control selection should consider the threat environment and mission impact, not just the baseline label.

Assessment scope should match the authorization boundary; inherited controls may be assessed by the provider.

Baseline tailoring outputs feed the SSP and the assessment plan; changes must be reflected in both.

Periodic review of tailoring is needed as the system and threat environment change.

The SSP documents the control implementation, boundary, environment, and inheritance; it is the primary evidence for assessment.

The SAR documents assessment results, including findings and evidence examined; it supports the authorization decision.

The POA&M documents weaknesses, planned remediation, resources, milestones, and status; it is reviewed at defined intervals.

Evidence must be current, relevant, and sufficient; screenshots without context are weak evidence.

Configuration baselines and scan reports provide technical evidence; policies and procedures provide governance evidence.

Documentation must be version-controlled and approved; uncontrolled documents are not reliable evidence.

Assessment evidence should be retained per records policy and be available for audit.

Documentation gaps are findings even when the control operates effectively; both design and operating effectiveness must be evidenced.

Traceability from requirements to controls to evidence supports audit and continuous monitoring.

Risk reporting to leadership should be in business terms: likelihood, impact, and residual risk against appetite.

Reporting frequency and format should be defined in the governance framework; ad hoc reporting is insufficient for oversight.

Regulatory notification requirements (e.g., breach notification) have deadlines; the IR plan must include them.

Customer and partner communications during incidents require legal review and approved messaging.

Dashboards should show trends and exceptions, not raw data; decision-makers need actionable information.

Escalation paths must be documented and tested; unclear escalation delays response.

Communication with the AO during significant changes is required before continued operation.

Lessons learned should be shared across teams to prevent recurrence.

Transparency with regulators and customers builds trust but must be balanced with legal and security considerations.

CSF Functions vs. RMF steps: CSF describes outcomes; RMF describes a process with authorization decisions.

FIPS 199 categorizes impact; FIPS 200 sets minimum requirements; SP 800-53B provides baselines.

ATO is a decision; SAR is an assessment product; POA&M is a remediation plan.

Privacy risk is harm to individuals; security risk is harm to the organization.

Continuous monitoring is ongoing; assessment is periodic; authorization is a decision point.

NIST does not certify; FedRAMP authorizes cloud services; 3PAOs assess.

Current revisions: CSF 2.0, SP 800-53 Rev. 5, SP 800-37 Rev. 2, SP 800-61 Rev. 3.

Tailoring and overlays adjust baselines; compensating controls require approval.

Residual risk is accepted by the AO, not by the ISSO or system owner alone.