Framework overlap

Does NIST SP 800-53 Rev 5 cover ICAO Annex 17?

You hold NIST SP 800-53 Rev 5 and have been told to do ICAO Annex 17. Here is how much overlaps, control by control.

60% of ICAO Annex 17 you already have

NIST SP 800-53 Rev 5 already covers about 60% of ICAO Annex 17, leaving 4 of 10 controls as genuinely new work.

Already covered 2 Likely covered 4 New work 4

What is genuinely new work

Nothing in NIST SP 800-53 Rev 5 reaches these. This is the list to scope.

ICAO-ANX17-Chap2-GeneralPrinciples-Objectives-Cooperation-InfoProtection
ICAO Annex 17 Chapter 2 - General Principles + Aviation Security Objectives + International Cooperation + Information Protection
ICAO-ANX17-Chap3-Organisation-NCASP-AppropriateAuthority-NASC
ICAO Annex 17 Chapter 3 - Organisation + National Civil Aviation Security Programme (NCASP) + Appropriate Authority + National Aviation Security Committee + Operator Programmes
ICAO-ANX17-Chap4-PassengerScreening-CabinBaggage-HoldBaggage-100Percent-EDS
ICAO Annex 17 Chapter 4 - Passenger Screening + Cabin Baggage + Hold Baggage 100 Percent + Explosive Detection Systems (EDS)
ICAO-ANX17-Chap5-Contingency-Notification-Response-UnlawfulInterference
ICAO Annex 17 Chapter 5 - Contingency Plans + Notification + Response to Acts of Unlawful Interference + Investigation
Show the 6 you already have
ICAO-ANX17-Chap2-ThreatAssessment-RiskManagement-Cyber-GASeP
ICAO Annex 17 Chapter 2 - Threat Assessment + Risk Management + Cyber Threats to Critical Aviation Systems (Amendment 17/18)
ICAO-ANX17-Chap4-Cargo-Mail-Catering-Stores-Supplies-RegulatedAgent-KnownConsignor
ICAO Annex 17 Chapter 4 - Cargo + Mail + Catering + Stores + Supplies Security + Regulated Agent + Known Consignor + Supply Chain
ICAO-ANX17-Chap1-Definitions-Scope-Chicago-Convention-AVSEC
ICAO Annex 17 Chapter 1 - Definitions + Scope + Chicago Convention Article 37 + AVSEC Coverage
ICAO-ANX17-Chap3-QualityControl-Audits-Inspections-Tests-Certification-Training
ICAO Annex 17 Chapter 3 - National Quality Control Programme + Audits + Inspections + Tests + Surveys + Certification + Aviation Security Training Programme (ASTP)
ICAO-ANX17-Chap4-AccessControl-AirsideRestricted-Personnel-Background
ICAO Annex 17 Chapter 4 - Access Control + Airside + Security Restricted Area + Personnel Background Checks + Vetting
ICAO-ANX17-Chap4-SpecialCategories-Weapons-InFlightSecurity-CockpitDoor
ICAO Annex 17 Chapter 4 - Special Categories of Passengers + Weapons + In-Flight Security Officers + Flight Crew Compartment Door

How this is calculated

Already covered means a mapping runs from a control in NIST SP 800-53 Rev 5 to that control. Likely covered means no direct mapping exists but both frameworks map to the same control in a third standard. New work means neither. We keep those separate rather than adding them into one friendlier number, because blending them would present a two-hop inference as a verified fact.

Coverage is not symmetric. Run it the other way and you will get a different number; both are correct.

From 332,959 cross-framework control mappings across 723 frameworks, 531 of them verified against their source documents. It does not tell you that you are compliant: a mapped control means the two standards ask for the same thing, not that you have done it.

Try another pair ยท Today's edition