45% of NIST SP 800-181 you already have
NIST SP 800-53 Rev 5 already covers about 45% of NIST SP 800-181, leaving
21 of 38 controls as genuinely new work.
Already covered 17
Likely covered 0
New work 21
What is genuinely new work
Nothing in NIST SP 800-53 Rev 5 reaches these. This is the list to scope.
NICE.APP.EDUEducation and Training Alignment
NICE.APP.PLANWorkforce Planning Application
NICE.CAT.ANAnalyze Category Adoption
NICE.CAT.COCollect and Operate Category Adoption
NICE.CAT.INInvestigate Category Adoption
NICE.CAT.OMOperate and Maintain Category Adoption
NICE.CAT.OVOversee and Govern Category Adoption
NICE.CAT.PRProtect and Defend Category Adoption
NICE.CAT.SPSecurely Provision Category Adoption
NICE.KSA.KKnowledge Items Tracking
NICE.KSA.SSkill Items Tracking
NICE.TASKTask Statements Adoption
NICE.WR.CRMCyber Legal Advisor Work Role
NICE.WR.IRRCyber Defense Incident Responder Work Role
NICE.WR.ISOInformation Systems Security Manager Work Role
NICE.WR.PMECyber Workforce Developer and Manager Work Role
NICE.WR.SAASecurity Control Assessor Work Role
NICE.WR.SARSecurity Architect Work Role
NICE.WR.SDASystems Developer Work Role
NICE.WR.SOACyber Defense Analyst Work Role
NICE.WR.VAMVulnerability Assessment Analyst Work Role
Show the 17 you already have
NICE-CAT-ANCategory: Analyze (AN)
NICE-CAT-COCategory: Collect and Operate (CO)
NICE-CAT-INCategory: Investigate (IN)
NICE-CAT-OMCategory: Operate and Maintain (OM)
NICE-CAT-OVCategory: Oversee and Govern (OV)
NICE-CAT-PRCategory: Protect and Defend (PR)
NICE-CAT-SPCategory: Securely Provision (SP)
NICE-COMP-CATEGORIESComponent: Categories
NICE-COMP-KSAComponent: Knowledge, Skills, and Abilities (KSAs)
NICE-COMP-SPECIALTYComponent: Specialty Areas
NICE-COMP-TASKSComponent: Tasks
NICE-COMP-WORKROLESComponent: Work Roles
NICE-COMPETENCIESCompetencies
NICE-WM-EDUCATEWorkforce Management: Educate and Train
NICE-WM-IDENTIFYWorkforce Management: Identify Workforce Needs
NICE-WM-RECRUITWorkforce Management: Recruit and Hire Talent
NICE-WM-RETAINWorkforce Management: Retain and Develop
How this is calculated
Already covered means a mapping runs from a control in NIST SP 800-53 Rev 5 to that control. Likely
covered means no direct mapping exists but both frameworks map to the same control in a third
standard. New work means neither. We keep those separate rather than adding them into one
friendlier number, because blending them would present a two-hop inference as a verified
fact.
Coverage is not symmetric.
Run it the other way and you will get a
different number; both are correct.
From 332,959 cross-framework control
mappings across 723 frameworks, 531 of them verified against
their source documents. It does not tell you that you are compliant: a mapped control means
the two standards ask for the same thing, not that you have done it.
Try another pair ยท
Today's edition