The National Institute of Standards and Technology (NIST) is a non-regulatory agency of the United States Department of Commerce. NIST’s main mission is to promote innovation and industrial competitiveness. In order to do this, NIST develops guidance and standards for Federal Information Security controls.
What is the guidance?
The guidance is the Federal Information Security Management Act (FISMA) and its accompanying regulations. FISMA establishes a comprehensive framework for managing information security risks to federal information and systems. The act provides a risk-based approach for setting and maintaining information security controls across the federal government.
What are the federal information security controls?
There are 18 federal information security controls that organizations must follow in order to keep their data safe. These controls are:
1. Access Control
2. Awareness and Training
3. Audit and Accountability
4. Configuration Management
5. Contingency Planning
6. Identification and Authentication
7. Incident Response
8. Maintenance
9. Media Protection
10. Physical and Environmental Protection
11. Planning
12. Personnel Security
13. Risk Assessment
14. Security Assessment and Authorization
15. System and Communications Protection
16. System and Information Integrity
17. Test and Evaluation
18. User Activity Monitoring
Why are these controls important?
The federal government has identified a set of information security controls that are critical for safeguarding sensitive information. These controls are important because they provide a framework for protecting information and ensure that agencies take the necessary steps to safeguard their data. By following these controls, agencies can help prevent data breaches and protect the confidential information of citizens.
The federal government has identified a set of information security controls that are important for safeguarding sensitive information. These controls help protect information from unauthorized access, use, disclosure, or destruction. They also ensure that information is properly managed and monitored.
The identification of these controls is important because it helps agencies to focus their resources on protecting the most critical information. It also provides a baseline for measuring the effectiveness of their security program. By adhering to these controls, agencies can provide greater assurance that their information is safe and secure.
How can you implement these controls?
There are 19 different families of controls identified by the National Institute of Standards and Technology (NIST) in their guidance for federal information security. They are organized into Basic, Foundational, and Organizational categories.
Basic Controls: The basic security controls are a set of security measures that should be implemented by all organizations regardless of size or mission. They provide a baseline for protecting information and systems from threats.
Foundational Controls: The foundational security controls build on the basic controls and are intended to be implemented by organizations based on their specific needs. These controls address more specific risks and can be tailored to the organization’s environment and business objectives.
Organizational Controls: The organizational security controls are those that should be implemented by all organizations in order to meet their specific security requirements. These controls address risks that are specific to the organization’s environment and business objectives.
Conclusion
The National Institute of Standards and Technology (NIST) is a federal agency that provides guidance on information security controls. This guidance includes the NIST 800-53, which is a comprehensive list of security controls for all U.S. federal agencies. The NIST 800-53 covers everything from physical security to incident response, and it is updated regularly to ensure that federal agencies are using the most up-to-date security controls.
There are many federal information security controls that businesses can implement to protect their data. However, it can be difficult to keep up with all of the different guidance documents. The National Institute of Standards and Technology (NIST) has created a consolidated guidance document that covers all of the major control families. This document can be a helpful resource for businesses who want to ensure they are implementing the most effective controls.
One Reply to “What Guidance Identifies Federal Information Security Controls”