Information Security
Domain 3 tests the control-level knowledge behind CSF Protect, Detect, and Respond, and how those controls are sourced from NIST SP 800-53 Rev. 5.
Control families that matter
Access control (AC), identification and authentication (IA), audit and accountability (AU), configuration management (CM), incident response (IR), risk assessment (RA), system and communications protection (SC), system and information integrity (SI), and supply chain risk management (SR). Expect least privilege, phishing-resistant MFA (SP 800-63B), FIPS 140-3 validated cryptography, centralized logging with time synchronization and retention, vulnerability scanning, secure configuration baselines, and the SP 800-61 incident lifecycle. CSF subcategories are outcomes; 800-53 controls are the implementable statements.
Worked example
An internet-facing application stores PII at moderate impact. Select the 800-53 moderate baseline, then tailor: AC-2 account management, IA-2(1) MFA, SC-8 transmission confidentiality, SC-13 cryptographic protection, AU-2 and AU-6 logging and review, RA-5 vulnerability scanning, SI-2 flaw remediation, IR-4 incident handling. Document inherited controls from the cloud provider (e.g., physical security) and test the rest. Reasoning: baseline plus tailoring avoids both under-control and over-control.
Traps
Calling a CSF subcategory a control; assuming the cloud provider covers application logging; collecting logs without review or retention; treating SMS OTP as strong MFA; patching without an exception and risk-acceptance process; ignoring SR for third-party components.