NIST Risk Management Framework RMF

Overlay Name:  NIST SP 800-161, Rev. 1, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations

Overlay Publication Date: May 2022

Technology or System: Cyber Supply Chain

Overlay Author: Jon Boyens (NIST), Angela Smith (NIST), Nadya Bartol (BCG), Kris Winkler (BCG), Alex Holbrook (BCG), Matthew Fallon (BCG)

Overview: Identification and augmentation of cybersecurity supply chain risk management (C-SCRM)-related controls in SP 800-53, Revision 5. Refer to SP 800-161r1, Appendix A, for the C-SCRM Controls. C-SCRM is an enterprise-wide activity that should be directed from a governance perspective, regardless of the specific enterprise structure. This publication is intended to serve a diverse audience involved in C-SCRM, including those responsible for: Risk management and oversight Project management Systems development Acquisition and procurement Security and privacy implementation and operations Security and privacy assessment and monitoring Creating component products and systems Building security and privacy technologies,

Overlay Point of Contact: Jon Boyens

Overlay Name:  NIST SP 800-82, Rev. 3, Guide to Operational Technology (OT) Security

Overlay Publication Date: September 2023

Technology or System: Operational Technology

Overlay Author: Keith Stouffer (NIST), Michael Pease (NIST), CheeYee Tang (NIST), Timothy Zimmerman (NIST), Victoria Pillitteri (NIST), Suzanne Lightman (NIST), Adam Hahn (MITRE), Stephanie Saravia (MITRE), Aslam Sherule (MITRE), Michael Thompson (MITRE)

Overview: The OT overlay is a partial tailoring of the controls and security baselines in SP 800-53, Revision 5, for Low, Moderate, and High-Impact (per FIPS 199) OT systems, with supplementary guidance specific to OT. Refer to SP 800-82r3, Appendix F, for the OT Overlay.

The OT overlay is intended to be applicable to all OT systems in all industrial sectors. Examples of OT systems include industrial control systems (ICS), building automation systems, transportation systems, physical access control systems, physical environment monitoring systems, and physical environment measurement systems.

Overlay Point of Contact: Keith Stouffer and Victoria Pillitteri 

Overlay Name:  NIST SP 800-171, Rev 3, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations

Overlay Publication Date: May 2024

Technology or System: Controlled Unclassified Information

Overlay Author: Ron Ross (NIST), Victoria Pillitteri (NIST)

Overview: Supplement to SP 800-171, Revision 3, identifying controls for protecting the confidentiality of Controlled Unclassified Information (CUI) based on SP 800-53, Revision 5, and SP 800-53B. The control overlay serves as an alternative method to capture the security requirements in SP 800-171, Revision 3, and provides a detailed analysis of the tailoring decisions at the control item (or requirement item)-level between SP 800-53 and SP 800-171. The CUI overlay (.xlsx) is provided in the Supplemental Materials section of the SP 800-171 publication details page.

The overlay is applicable to any entity or user of SP 800-171.

Overlay Point of Contact: Ron Ross, Victoria Pillitteri 

Overview: The Control Overlays for Securing AI Systems (COSAiS) project will develop a series of overlays for securing AI systems using the NIST Special Publication (SP) 800-53 controls. Information about the project can be found on the COSAiS Project Page.