Framework overlap

Does NIST SP 800-171A cover ASIC Cyber Resilience Good Practices?

You hold NIST SP 800-171A and have been told to do ASIC Cyber Resilience Good Practices. Here is how much overlaps, control by control.

28% of ASIC Cyber Resilience Good Practices you already have

NIST SP 800-171A already covers about 28% of ASIC Cyber Resilience Good Practices, leaving 21 of 29 controls as genuinely new work.

Already covered 0 Likely covered 8 New work 21

No control in NIST SP 800-171A maps directly to one in ASIC Cyber Resilience Good Practices. Everything counted as covered is covered because both map to the same third standard, which is what a crosswalk is, but it is an inference rather than a lookup.

What is genuinely new work

Nothing in NIST SP 800-171A reaches these. This is the list to scope.

ASIC-CR-AM-1
Centralised asset management system
ASIC-CR-AT-1
Staff awareness and training
ASIC-CR-AT-3
Random staff testing
ASIC-CR-CO-1
Confidential information sharing
ASIC-CR-CO-2
Specialist threat-intelligence providers
ASIC-CR-DE-1
Continuous monitoring with SIEM
ASIC-CR-DE-2
Data analytics for threat integration
ASIC-CR-GOV-1
Board engagement and periodic review of cyber strategy
ASIC-CR-GOV-2
Treat cyber resilience as a management and investment tool
ASIC-CR-GOV-3
Board cyber fluency
ASIC-CR-GOV-4
End-to-end assurance processes
ASIC-CR-GOV-5
Responsive, event-driven governance
ASIC-CR-GOV-6
Align cyber governance with enterprise governance
ASIC-CR-PR-2
Security Development Lifecycle
ASIC-CR-PR-5
Restricted removable media / USB access
ASIC-CR-RM-1
Intelligence-led cyber risk management
ASIC-CR-RM-2
Fusion centres for real-time monitoring
ASIC-CR-RM-3
Third-party and supply chain risk management
ASIC-CR-RR-3
Proactive board reporting during incidents
ASIC-CR-RR-4
Customer and breach notification
ASIC-CR-RR-5
Stakeholder communication plan
Show the 8 you already have
ASIC-CR-AM-2
Configuration management
ASIC-CR-AT-2
Continuous development
ASIC-CR-DE-3
Red teaming
ASIC-CR-PR-1
Implement the ASD Essential Eight
ASIC-CR-PR-3
Encryption of data at rest and in transit
ASIC-CR-PR-4
Outbound email filtering and monitoring
ASIC-CR-RR-1
Scenario planning and response exercising
ASIC-CR-RR-2
War gaming

How this is calculated

Already covered means a mapping runs from a control in NIST SP 800-171A to that control. Likely covered means no direct mapping exists but both frameworks map to the same control in a third standard. New work means neither. We keep those separate rather than adding them into one friendlier number, because blending them would present a two-hop inference as a verified fact.

Coverage is not symmetric. Run it the other way and you will get a different number; both are correct.

From 332,959 cross-framework control mappings across 723 frameworks, 531 of them verified against their source documents. It does not tell you that you are compliant: a mapped control means the two standards ask for the same thing, not that you have done it.

Try another pair ยท Today's edition