Mapping NIST SP800-53 With COBIT 4 (1) .1 Research
Mapping NIST SP800-53 With COBIT 4 (1) .1 Research
IT Governance Institute
The IT Governance Institute (ITGI) (www.itgi.org) was established by ISACA in 1998 to advance international thinking and standards
in directing and controlling an enterprises information technology. ITGI developed Control Objectives for Information and related
Technology (COBIT), now in its fourth edition, and Val ITTM, and offers original research and case studies to assist enterprise leaders and
boards of directors in their IT governance responsibilities.
Disclaimer
ITGI (the Owner) and the author have designed this publication, titled COBIT Mapping: Mapping of NIST SP800-53 Rev 1 With
COBIT 4.1 (the Work), primarily as an educational resource for control professionals. The Owner makes no claim that use of any of
the Work will assure a successful outcome. The Work should not be considered inclusive of any proper information, procedures and tests
or exclusive of other proper information procedures and tests that are reasonably directed to obtaining the same results. In determining
the propriety of any specific information procedure or test, controls professionals should apply their own professional judgement to the
specific control circumstances presented by the particular systems or information technology environment.
Disclosure
2007 ITGI. All rights reserved. No part of this publication may be used, copied, reproduced, modified, distributed, displayed, stored in
a retrieval system or transmitted in any form by any means (electronic, mechanical, photocopying, recording or otherwise) without prior
written authorisation of ITGI. Reproduction and use of all or portions of this publication is solely permitted for academic, internal and
non-commercial use and for consulting/advisory engagements, and must include full attribution of the materials source. No other right
or permission is granted with respect to this work.
IT Governance Institute
3701 Algonquin Road, Suite 1010
Rolling Meadows, IL 60008 USA
Phone: +1.847.660.5700
Fax: +1.847.253.1443
E-mail: [email protected]
Web site: www.itgi.org
ISBN 978-1-60420-034-8
COBIT Mapping: Mapping of NIST SP800-53 Rev 1 With COBIT 4.1
Printed in the United States of America
RIGHTS
RESERVED
ACKNOWLEDGEMENTS
ACKNOWLEDGEMENTS
ITGI wishes to recognise:
Researcher
John W. Lainhart IV, CISA, CISM, CIPP/G, IBM, USA
Nichola M. Tiesenga, CISA, CISM, IBM, USA
Robert W. Weaver, Ph.D., CISSP, IBM, USA
Expert Reviewers
Guy H. Groner, CISA, CIA, CISSP, USA
Jimmy Heschl, CISA, CISM, KPMG, Austria
Benjamin Hsiao, CISA, Federal Deposit Insurance Corporation, USA
James Koh, CISA, CISSP, PricewaterhouseCoopers LLP, USA
Linda Kostic, CISA, CPA, E*Trade Financial, USA
Anh Tran, CISA, BearingPoint Inc., USA
ITGI Board of Trustees
Lynn Lawton, CISA, FBCS CITP, FCA, FIIA, PIIA, KPMG LLP, UK, International President
Georges Ataya, CISA, CISM, CISSP, ICT Control sa-nv, Belgium, Vice President
Avinash Kadam, CISA, CISM, CBCP, CISSP, Miel e-Security Pvt. Ltd., India, Vice President
Howard Nicholson, CISA, City of Salisbury, Australia, Vice President
Jose Angel Pena Ibarra, Consultoria en Comunicaciones e Info., SA & CV, Mexico, Vice President
Robert E. Stroud, CA Inc., USA, Vice President
Kenneth L. Vander Wal, CISA, CPA, Ernst & Young LLP, USA, Vice President
Frank Yam, CISA, FHKCS, FHKIoD, CIA, CCP, CFE, CFSA, FFA, Focus Strategic Group, Hong Kong, Vice President
Marios Damianides, CISA, CISM, CA, CPA, Ernst & Young LLP, USA, Past International President
Everett C. Johnson, CPA, Deloitte & Touche LLP (retired), USA, Past International President
Ronald Saull, CSP, Great-West Life Assurance and IGM Financial, Canada, Trustee
Tony Hayes, FCPA, Queensland Government, Australia, Trustee
IT Governance Committee
Tony Hayes, FCPA, Queensland Government, Australia, Chair
Max Blecher, Virtual Alliance, South Africa
Sushil Chatterji, Edutech, Singapore
Anil Jogani, CISA, FCA, Avon Consulting Ltd., UK
John W. Lainhart IV, CISA, CISM, IBM, USA
Lucio Molina Focazzio, CISA, Colombia
Ronald Saull, CSP, Great-West Life Assurance and IGM Financial, Canada
Michael Schirmbrand, Ph.D., CISA, CISM, CPA, KPMG, Austria
Robert E. Stroud, CA Inc., USA
John Thorp, The Thorp Network Inc., Canada
Wim Van Grembergen, Ph.D., University of Antwerp, University of Antwerp Management School, and IT Alignment and Governance
Research Institute (ITAG), Belgium
COBIT Steering Committee
Robert E. Stroud, CA Inc., USA, Chair
Gary S. Baker, CA, Deloitte & Touche, Canada
Rafael Eduardo Fabius, CISA, Republica AFAP SA, Uruguay
Urs Fischer, CISA, CIA, CPA (Swiss), Swiss Life, Switzerland
Erik Guldentops, CISA, CISM, University of Antwerp Management School, Belgium
Jimmy Heschl, CISA, CISM, KPMG, Austria
Debbie A. Lew, CISA, Ernst & Young LLP, USA
Maxwell J. Shanahan, CISA, FCPA, Max Shanahan & Associates, Australia
Dirk E. Steuperaert, CISA, PricewaterhouseCoopers, Belgium
RIGHTS
RESERVED
TABLE OF CONTENTS
TABLE OF CONTENTS
1. Purpose of the Document.....................................................................................................................................................................6
2. Methodology for the Mapping .............................................................................................................................................................8
3. COBIT Overview ...................................................................................................................................................................................9
4. NIST SP800-53 Overview .................................................................................................................................................................16
5. High-level Mapping............................................................................................................................................................................23
6. Detailed Mapping ...............................................................................................................................................................................26
7. References...........................................................................................................................................................................................56
AppendixCOBIT and Related Products ..............................................................................................................................................57
RIGHTS
RESERVED
COBIT Mapping:
COBIT Mapping:
COBIT Mapping:
COBIT Mapping:
COBIT Mapping:
This publication contains a detailed mapping of National Institute of Standards and Technology (NIST) Special Publication
(SP) 800-53 Revision 1 with COBIT 4.1 and also contains the classification of the standards as presented in the overview document,
COBIT Mapping: Overview of International IT Guidance, 2nd Edition.
A brief overview of the standards mapped against each other in this publication is as follows:
COBITOriginally released as an IT process and control framework linking IT to business requirements, it was initially used mainly
by the assurance community in conjunction with business and IT process owners. With the addition of management guidelines in 1998,
COBIT was used more frequently as a management framework, providing management tools such as metrics and maturity models to
complement the control framework. With the release of COBIT 4.0 in 2005, it became a more complete IT governance framework.
Incremental updates to COBIT 4.0 were made in 2007; they can be seen as a fine-tuning of the framework, not fundamental changes.
The current version is COBIT 4.1.
NIST SP800-53 Rev 1The application of the security controls defined in NIST SP800-53 Rev 1 represents the current state-of-thepractice safeguards and countermeasures for US federal information systems. The 17 areas represent a broad-based, balanced
information security programme that addresses the management, operational, and technical aspects of protecting US federal
information and information systems.
This publication does not contain all of the details of NIST SP800-53. Some language is included as provided in the publication, but it is
recommended to obtain a copy of the original document. The document is available from the NIST Computer Security Resource Center
web site at http://csrc.nist.gov/publications/.
RIGHTS
RESERVED
Step
1
The resulting information of step 3 helps implementers and auditors using the COBIT framework to see if they consider the requirements
of NIST SP800-53 Rev 1.
RIGHTS
RESERVED
3. COBIT OVERVIEW
3. COBIT OVERVIEW
DOCUMENT TAXONOMY
COBIT represents a collection of documents that can be classified as generally accepted good practice for IT governance, control
and assurance.
ISSUER
The first edition of COBIT was issued by ISACF in 1996. In 1998, the second edition was published with additional control objectives
and the Implementation Tool Set. The third edition was issued by ITGI in 2000 and included the management guidelines and several new
control objectives. In 2005, ITGI finalised a complete rework of the COBIT content and published COBIT 4.0, which demonstrates a clear
focus on IT governance. The current version 4.1 encompasses incremental updates.
RIGHTS
RESERVED
TARGET AUDIENCE
All types of organisations, public and private companies, and external assurance and advisory professionals form the relevant target
group. Within organisations, COBIT intends to support executive management and boards, business and IT management as well as
governance, assurance, control and security professionals. The primary and secondary audiences are indicated in figure 2.
Figure 2Chart of COBIT Audiences
Chief Financial
Officer (CFO)
Business
Executive
Chief Information
Officer (CIO)
Business
Process Owner
Head of
Operations
Chief Architect
Head of
Development
Head of IT
Administration
Compliance, Audit,
Risk and Security
Activities
COBIT
Chief Executive
Officer (CEO)
Functions: Primary (P), secondary (S) to the pertinence of COBIT to that particular audience
TIMELINESS
The core content of COBIT was updated in 2005, resulting in COBIT 4.0, and further refined in 2007, resulting in COBIT 4.1. The research
conducted for these updates addressed components of the control objectives and management guidelines. Specific areas that were
addressed include:
COBITIT governance bottom-up and top-down alignment
COBIT and other detailed standardsDetailed mapping between COBIT and ITIL,3 CMM,4 COSO,5 PMBOK,6 ISFs Standard of
Good Practice for Information Security,7 ISO/IEC 27000 series8 and other global and regional frameworks and standards, to enable
harmonisation with those standards in language, definitions and concepts
Review of the quality of the critical success factors (CSFs)CSFs were replaced by process inputs (success factors needed from
others) and activity goals (goals that the process owner must address).
Review of CSFs contentSplitting the CSFs into what you need from others and what you need to do yourself. CSFs were replaced
by process inputs (success factors needed from others) and activity goals (goals that the process owner must address themselves).
Linking of business goals, IT goals and IT processesDetailed research in eight different industries, resulting in more detailed insight
into how COBIT processes support the achievement of specific IT goals and, by extension, business goals
Review of maturity models contentEnsured consistency and quality of maturity levels between and within processes, including better
definitions of maturity model attributes
Also, the range of COBIT-related products was expanded in 2007 to include a new IT Assurance Guide: Using COBIT, IT Governance
Implementation Guide: Using COBIT and Val IT, and COBIT Control Practices, 2nd Edition.
CERTIFICATION OPPORTUNITIES
The IT Assurance Guide can be used for auditing and self-assessment against the control objectives, but there is no certification for
organisations. However, the COBIT framework is used frequently by Certified Public Accountants (CPAs) and Chartered Accountants
(CAs) when performing a Statement on Auditing Standards (SAS) No. 70 service organisation review, earning SysTrust certification
or pursuing Sarbanes-Oxley compliance. The IT Assurance Guide is aligned with COBIT 4.1 and can be used for auditing and
self-assessment against the control objectives.
British Office of Government Commerce (OCG), IT Infrastructure Library (ITIL), UK, 1999-2004
Software Engineering Institute (SEI) of Carnegie Mellon University, Capability Maturity Model for Software (CMM), USA, 1993, and Capability Maturity Model
Integration (CMMI), 2000
5
Committee of Sponsoring Organisations of the Treadway Commission (COSO), Internal ControlIntegrated Framework, USA, 1994, and Enterprise Risk
ManagementIntegrated Framework, 2004
6
Project Management Institute, A Guide to the Project Management Body of Knowledge (PMBOK), 3rd Edition, 2004
7
Information Security Forum (ISF), Standard of Good Practice for Information Security, UK, 2003
8
International Organisation for Standardisation(ISO)/International Electrotechnical Commission (IEC), 27000 (Series working title: Information TechnologySecurity
TechniquesInformation Security Management SystemsOverview and Vocabulary), Switzerland. The first document, 27001, was published in 2005. Others are still
in development.
4
10
RIGHTS
RESERVED
3. COBIT OVERVIEW
For certification of individuals, the COBIT Foundation Course is offered. Non-COBIT certification is available through ISACA, ITGIs
affiliated association, in the form of the Certified Information Systems Auditor (CISA) and Certified Information Security Manager
(CISM) certifications.
CIRCULATION
COBIT is used worldwide. In addition to the English version, COBIT has been translated into French, German, Hungarian, Italian, Japanese,
Korean, Portuguese and Spanish. Further translations (Czech, Hebrew, Turkish) and updates of translations to COBIT 4.1 are in development.
COMPLETENESS
COBIT addresses a broad spectrum of duties in IT management. COBIT includes the most significant parts of IT management, including
those covered by other standards. Although no technical details have been included, the necessary tasks for complying with the control
objectives are self-explanatory. Therefore, it is classified as relatively high level, aiming to be generically complete but not specific.
AVAILABILITY
COBIT 4.1 is a framework and is readily accessible for complimentary electronic download from the ITGI or ISACA web sites,
www.itgi.org or www.isaca.org/cobit. COBIT Online can be purchased at www.isaca.org/cobitonline. COBIT Online allows users to
customise a version of COBIT for their own enterprise, then store and manipulate that version as desired. Online, real-time surveys and
benchmarking are offered. The print version of COBIT 4.1 can be purchased from the ISACA Bookstore, www.isaca.org/bookstore.
2 3
5 6
9 10
2
4
5 6
3
7
1 2 3 4 5 6 7 8 9 10 11 12 13
Full
None
Effectiveness
Efficiency
Confidentiality
Integrity
Availability
Compliance
Reliability
RIGHTS
RESERVED
11
IT RESOURCES CONCERNED
IT Resources
+
+
+
+
Applications
Information
Infrastructure
People
IC
EG NT
AT ME
R
ST LIGN
A
DE VAL
LIV UE
ER
Y
MAN RISK
AGE
ME
CE
MANENT
FOR
PER SUREM
MEA
NT
Primary
IT GOVERNANCE
Secondary
Not Addressed
RESOURCE
MANAGEMENT
12
RIGHTS
RESERVED
3. COBIT OVERVIEW
COBIT
INFORMATION
CRITERIA
Effectiveness
Efficiency
Confidentiality
Integrity
Availability
Compliance
Reliability
MONITOR AND
EVALUATE
PLAN AND
ORGANISE
IT RESOURCES
Applications
Information
Infrastructure
People
DELIVER AND
SUPPORT
ACQUIRE AND
IM PLEM ENT
RIGHTS
RESERVED
13
INFORMATION CRITERIA
To satisfy business objectives, information needs to conform to certain control criteria, which COBIT refers to as business requirements
for information. Based on the broader quality, fiduciary and security requirements, seven distinct, certainly overlapping, information
criteria are defined as follows:
Effectiveness deals with information being relevant and pertinent to the business process as well as being delivered in a timely, correct,
consistent and usable manner.
Efficiency concerns the provision of information through the optimal (most productive and economical) use of resources.
Confidentiality concerns the protection of sensitive information from unauthorised disclosure.
Integrity relates to the accuracy and completeness of information as well as to its validity in accordance with business values and
expectations.
Availability relates to information being available when required by the business processnow and in the future. Availability also
concerns the safeguarding of necessary resources and associated capabilities.
Compliance deals with complying with those laws, regulations and contractual arrangements to which the business process is subject,
i.e., externally imposed business criteria as well as internal policies.
Reliability relates to the provision of appropriate information for management to operate the entity and exercise its fiduciary and
governance responsibilities.
IT RESOURCES
Following the COBIT definition, the resources used by IT are identified as follows:
Applications are automated user systems and manual procedures that process the information.
Information is the data in all their formsinput, processed and output by the information systems in whatever form is used
by the business.
Infrastructure is the technology and facilities (hardware, operating systems, database management systems, networking, multimedia,
etc., and the environment that houses and supports the facilities) that enable the processing of the applications.
People are the personnel required to plan, organise, acquire, implement, deliver, support, monitor and evaluate the information systems
and services. People may be internal, outsourced or contracted as required.
MATURITY MODELS
Maturity modelling for management and control over IT processes is based on a method of self-evaluation by the organisation.
A maturity model has been defined for each of the 34 COBIT IT processes, providing an incremental measurement scale from
0, non-existent, through 5, optimised. Using the maturity models developed for each IT process, management can identify:
The actual performance of the enterpriseWhere the enterprise is today
The current status of the industryThe comparison
The enterprises target for improvementWhere the enterprise wants to be
The maturity attributes list the characteristics of how IT processes are managed and describes how they evolve from a non-existent to an
optimised process. These attributes can be used for more comprehensive assessment, gap analysis and improvement planning. The
maturity attributes are:
Awareness and communication
Policies, plans and procedures
Tools and automation
Skills and expertise
Responsibility and accountability
Goal setting and measurement
14
RIGHTS
RESERVED
3. COBIT OVERVIEW
COBIT CUBE
Business Requirements
y
s
e
ity
es ncy tialit rity
lity
nc
bil
ie
g
lia liabi
a
n
l
c
e
p
i
e
i
t
a
m
In
Eff onfid
Re
Av
Co
C
FURTHER REFERENCES
PROCESSES
Information
Applications
IT Processes
DOMAINS
People
e
Eff
Infrastructure
en
v
cti
ACTIVITIES
Internet
ISACA
ITGI
rce
u
so
www.isaca.org/cobit
www.itgi.org
IT
Re
Business
Goals
requirements
information
IT Goals
IT Processes
n
ke
ur
bro
Performance
Indicators
for outcom
Outcome
Measures
oll
ed
by
derived
from
Control
Outcome
Tests
Control
Objectives
ith
w
ed
dit
y
rit
fo
ntr
atu
rm
rfo
e
rp
co
rm
Responsibility
and
Accountability
Chart
by
s
ea
by
fo
fo
r
pe
ed
rm
c
an
Key
Activities
ed
audited with
nto
ni
w
do
Maturity
Models
im
ple
m
ent
au
Control
Design
Tests
ed
wit
h
Control
Practices
based on
RIGHTS
RESERVED
15
ISSUER
SP800 series documents have been issued since 1991. SP800-53, Recommended Security Controls for Federal Information Systems,
was first issued in February 2005, after a period of public discussion. The document was developed and has been issued under the
authority of FISMA, P.L. 107-347.
16
RIGHTS
RESERVED
TARGET AUDIENCE
The primary and secondary audiences are indicated in figure 6.
Figure 6Chart of SP800-53 Audiences
Chief Financial
Officer (CFO)
Business
Executive
Chief Information
Officer (CIO)
Business
Process Owner
Head of
Operations
Chief Architect
Head of
Development
Head of IT
Administration
Compliance, Audit,
Risk and Security
Activities
NIST SP800-53
Chief Executive
Officer (CEO)
Functions: Primary (P), secondary (S) to the pertinence of NIST SP800-53 to the particular audience
An additional secondary audience is information systems security officers, and additional primary audiences include:
Senior agency information officers
Designated authorising officers
Inspector general
TIMELINESS
The core content of NIST SP800-53 is under continuous revision through public discussion, with a commitment to a biennial review and
update cycle. Rev 1 contains relatively modest changes in a few notable areas from previous public draft versions of this publication:
There have been several additions to the security control catalogue, reflecting new controls and control enhancements to provide users
with greater choices in supplementing their security control baselines.
There have been some minor additions to the security control baselines reflecting an increased need for protection within federal
information systems and to better align the minimum security controls with current federal policy and recommended security practices.
There have been some changes to the tailoring guidance for security control baselines reflecting environmental considerations and the
application of compensating controls.
Chapters two and three have been expanded to include guidance on implementing security controls in external environments and
responding to information systems incidents.
There have been two new appendices added to the publication providing;
A two-way crosswalk from the security controls in SP800-53 to the NIST suite of security standards and guidelines
Initial guidance on the application of SP800-53 to industrial control systems
Enhancements to SP800-53 at the time of this publication include SP800-53A, a 300-page document providing explicit control
assessment criteria for the controls documented in SP800-53.
CERTIFICATION OPPORTUNITIES
No certification opportunities are available at time of publication.
CIRCULATION
The standard is mandatory for US federal systems that are not national security systems.
COMPLETENESS
The SP800-53 criteria are designed to provide technically sound and broadly applicable sets of controls for information systems. The
criteria are intended to be sufficiently rich to satisfy the breadth and depth of security requirements derived from laws, executive orders,
directives, policies, regulations and organisational needs, to ensure the confidentiality, integrity and availability of the information being
processed, stored or transmitted. Whilst intended to be cost-effective, unlike COBIT it does not address financial issues. However, its
catalogue of security controls is intended to demonstrate compliance with a variety of governmental, organisational or institutional security
requirements, facilitating consistent and repeatable control design and measured effectiveness in a consistent and repeatable manner.
RIGHTS
RESERVED
17
AVAILABILITY
The standard is readily available from the NIST web site. The document notes that it has been prepared for use by federal agencies, and
may be used by non-governmental organisations on a voluntary basis. It is not subject to copyright.
5 6
9 10
2
4
5 6
3
7
1 2 3 4 5 6 7 8 9 10 11 12 13
Full
None
Effectiveness
Efficiency
Confidentiality
Integrity
Availability
Compliance
Reliability
IT RESOURCES CONCERNED
IT Resources
o
+
+
+
18
Applications
Information
Infrastructure
People
RIGHTS
RESERVED
GIC
TE ENT
A
R M
ST IGN
AL
DE VALU
LIV E
ER
Y
Primary
MAN RISK
AGEM
ENT
E
ANC
ORM NT
PERFSUREME
MEA
IT GOVERNANCE
Secondary
Not Addressed
RESOURCE
MANAGEMENT
RIGHTS
RESERVED
19
Suns
nce
ra
tio
n
s/M
ai
pe
ntena
After initial
system testing,
the system is
installed or fielded.
ent
sm
on
Initiati
Imp
l em
en
ta
ti
es
ss
/A
on
Ac
q
01523a
et (Disposal)
Management Guidelines
The NIST SP800-53 document should be considered, not by itself, but in the context of the full library of NIST Special Publications and
Federal Information Processing Standards. For example, the authority document that mandates the use of the catalogue from SP800-53
comes from FIPS 200, Minimum Security Requirements for Federal Information and Information Systems, and states: Federal
agencies must meet the minimum security requirements as defined herein through the use of the security controls in accordance with
NIST Special Publication 800-53, Recommended Security Controls for Federal Information Systems, as amended.
Other elements in the SP800 library address topics ranging from broad management issues, such as security planning, security
engineering principles, control life cycle issues, integrating security into the capital planning programme, and security awareness and
training, to focused, technical specifications such as allowed block encryption modes, key management, Domain Name System (DNS)
deployment, radio-frequency identification (RFID) schema, and cell phone forensics.
Of particular note is SP800-100, Information Security Handbook: A Guide for Managers, a comprehensive guide that summarizes and
augments a number of existing NIST standards and guidance documents and provides additional information on related topics. Such
documents are referenced within appropriate subchapters.
20
RIGHTS
RESERVED
Family
Risk Assessment
Planning
System and Services Acquisition
Certification, Accreditation, and Security Assessments
Personnel Security
Physical and Environmental Protection
Contingency Planning
Configuration Management
Maintenance
System and Information Integrity
Media Protection
Incident Response
Awareness and Training
Identification and Authentication
Access Control
Audit and Accountability
System and Communications Protection
Identifier
RA
PL
SA
CA
PS
PE
CP
CM
MA
SI
MP
IR
AT
IA
AC
AU
SC
Maturity Models
SP800-53A describes maturity models for information systems security control environments, linking them to impact assessments
derived from the guidance from FIPS 199. Maturity modelling is based over both the presence and configuration of explicit, auditable
criteria as well as language based upon conventional Capability Maturity Model (CMM) approaches. The maturity model has three
(successful) levels of increasing rigour:
Security controls in place; no obvious errors
Security controls correctly implemented; operating as intended
Security controls consistently applied on an ongoing basis with continuous improvement
Explicit language in the assessment provides for a determination of process maturity levels.
Control Practices
Control practices were developed for NIST SP800-53 programmatically as part of the FISMA Implementation Project
(http://csrc.nist.gov/sec-cert/). Input came from a variety of sources including NIST SP800-26, Security Self-Assessment Guide for
Information Technology Systems, US Department of Defense (DoD) Policy 8500, Director of Central Intelligence Directive (DCID) 6/3,
ISO/IEC 17799, US Government Accountability Office (GAO) Federal Information System Controls Audit Manual (FISCAM), and US
Health and Human Services (HHS) Centers for Medicare and Medicaid Services (CMS) Core Security Requirements; and these sources
are subject to extensive public review by security professionals. The control practices provide a common baseline with a high level of
detail to ensure consistent, effective control implementation across federal entities.
Audit Guidelines
To achieve the desired goals and objectives, and to provide consistent reporting and oversight to the American public, each federal entity
must audit its procedures constantly and consistently, its reporting status quarterly and the overall programme assessment annually. The
audit guidelines in NIST SP800-53A describe actual assessment activities to be performed by external auditors, identifying roles,
responsibilities, mechanisms for assessment and appropriate metrics. Other NIST guidelines (NIST SP800-26, Security Self-assessment
Guide for Information Technology Systems, and NIST SP800-80, Guide for Developing Performance Metrics for Information Security)
provide a wealth of information for internal assessments.
RIGHTS
RESERVED
21
FURTHER REFERENCES
Internet
NIST SP800-53
FISMA Implementation Project
22
http://csrc.nist.gov/publications/nistpubs/800-53/SP800-53.pdf
http://csrc.nist.gov/sec-cert/
RIGHTS
RESERVED
5. HIGH-LEVEL MAPPING
5. HIGH-LEVEL MAPPING
OVERVIEW
This section contains the result of the mapping of objectives as stated in NIST SP800-53 to the IT processes of COBIT;
an overview of the results can be found in figure 9. A copy of NIST SP800-53 can be obtained from NIST at
http://csrc.nist.gov/publications/nistpubs/800-53/SP800-53.pdf.
Figure 9NIST SP800-53 Processes Mapped to High-level COBIT Processes
COBIT 4.1 Processes and Domains
1
Plan and Organise
+
Acquire and Implement
o
Deliver and Support
o
Monitor and Evaluate
Process Controls
Application Controls
o
2
+
+
o
o
o
o
3
o
o
4
o
+
o
o
5
o
o
+
6
o
o
-
+
o
7
+
o
o
8
o
9
+
10
o
11
12
13
(+) Significant match (more than two objectives were mapped to a COBIT process)
(o) Minor match (one or two objectives were mapped)
(-) Unrelated focus (no objective was mapped)
(\) No COBIT IT process exists.
Contribution of COBIT
Requirements of this focus area can be covered by
implementing the COBIT processes. Processes with a
primary impact on this focus area are:
PO1 Define a strategic IT plan
PO2 Define the information architecture
PO6 Communicate management aims and direction
PO7 Manage IT human resources
PO8 Manage quality
PO9 Assess and manage IT risks
PO10 Manage projects
AI1 Identify automated solutions
AI2 Acquire and maintain application software
DS1 Define and manage service levels
ME3 Ensure compliance with external requirements
ME4 Provide IT governance
AC4 Processing integrity and validity
AC6 Transaction authentication and integrity
The processes ensure that the IT-enabled initiatives
are planned and organised in a structured manner and
initiated appropriately. In addition, the delivery of
IT services meets the business and regulatory
requirements and enables the management and the
business to oversee service development and
service delivery.
RIGHTS
RESERVED
23
Risk management
Contribution of COBIT
Requirements of this focus area can be covered by
implementing the COBIT processes. Processes with
a primary impact on this focus area are:
PO5 Manage the IT investment
AI1 Identify automated solutions
AI2 Acquire and maintain application software
AI4 Enable operation and use
AI6 Manage changes
AI7 Install and accredit solutions and changes
DS1 Define and manage service levels
DS2 Manage third-party services
DS4 Ensure continuous service
DS7 Educate and train users
DS8 Manage service desk and incidents
DS9 Manage the configuration
DS10 Manage problems
DS11 Manage data
ME2 Monitor and evaluate internal control
ME4 Provide IT governance
AC4 Processing integrity and validity
AC6 Transaction authentication and integrity
The processes ensure that IT-enabled business
initiatives deliver value to the business by proper
planning of the implementation, delivery of knowledge
to ensure beneficial usage of services and providing
a proper support for the services required in line
with the business requirements.
Requirements of this focus area can be covered by
implementing the COBIT processes. Processes with a
primary impact on this focus area are:
PO4 Define the IT processes, organisation
and relationships
PO6 Communicate management aims and direction
PO9 Assess and manage IT risks
DS2 Manage third-party services
DS4 Ensure continuous service
DS5 Ensure systems security
DS11 Manage data
DS12 Manage the physical environment
ME2 Monitor and evaluate internal control
ME3 Ensure compliance with external requirements
ME4 Provide IT governance
AC4 Processing integrity and validity
AC6 Transaction authentication and integrity
These processes ensure that risks are identified and
managed in a way that enables business and top
management to understand the relevance of IT-related
risks, implications on business risks and the adequacy of
measures to control risks.
24
RIGHTS
RESERVED
5. HIGH-LEVEL MAPPING
Performance
measurement
Contribution of COBIT
Requirements of this focus area can be covered by
implementing the COBIT processes. Processes with
a primary impact on this focus area are:
PO2 Define the information architecture
PO3 Determine technological direction
PO4 Define the IT processes, organisation
and relationships
PO7 Manage IT human resources
AI3 Acquire and maintain technology infrastructure
AI5 Procure IT resources
DS1 Define and manage service levels
DS3 Manage performance and capacity
DS6 Identify and allocate costs
DS9 Manage the configuration
DS11 Manage data
DS13 Manage operations
ME4 Provide IT governance
The processes are responsible to ensure IT is able
to provide resources required to deliver the services
by focusing on planning and managing resources as
applications, infrastructure, information and people.
Requirements of this focus area can be covered by
implementing the COBIT processes. Processes with
a primary impact on this focus area are:
DS1 Define and manage service levels
ME1 Monitor and evaluate IT performance
ME4 Provide IT governance
RIGHTS
RESERVED
25
6. DETAILED MAPPING
As stated previously, the detailed mapping consists of the information requirements of NIST SP800-53 mapped to each COBIT control
objective. The structure follows the domains, processes and control objectives of COBIT.
The coverage of the mapped information requirements is noted in four different levels:
EThe requirements stated in NIST SP800-53 exceed the requirement of COBIT. Therefore, NIST SP800-53 should be seen as the
primary source for further information and guidance to improve the process or control objective.
CThe requirements of the control objective are covered by the mapped requirements of the guidance in NIST SP800-53.
ASome aspects of the control objectives are addressed by NIST SP800-53, but the requirements of the control objective are not
covered completely.
N/AThere is no match between the requirements of COBIT and NIST SP800-53.
Each COBIT control objective number and title is listed in tables as in the example in figure 11.
Figure 11Example of Detailed Mapping of NIST SP800-53 With COBIT
Control Objective Example
The description of the COBIT control objective is provided to give an overview of the aim of the specific part of COBIT.
Note: Mapping cannot always be one-to-one because the COBIT control objectives operate at a higher level, and the detail of SP800-53
is much closer to the level of detail of the COBIT control practices.
OVERVIEW
NIST SP800-53 Rev 1 is presented in numbered, outline form, broken into 17 families and multiple controls per family. Controls have a
reference statement, expanded guidance and control enhancements for environments where the risk suggests a more controlled
environment. References provided are at the level of detail of the reference statement.
Figure 12 gives a qualitative overview of the coverage.
Figure 12NIST SP800-53 Processes Mapped to High-level COBIT Processes
COBIT 4.1 Processes and Domains
1
Plan and Organise
+
Acquire and Implement
o
Deliver and Support
o
Monitor and Evaluate
Process Controls
Application Controls
o
2
+
+
o
o
o
o
3
o
o
4
o
+
o
o
5
o
o
+
6
o
o
-
+
o
7
+
o
o
8
o
9
+
10
o
11
12
13
26
RIGHTS
RESERVED
6. DETAILED MAPPING
RIGHTS
RESERVED
27
28
RIGHTS
RESERVED
6. DETAILED MAPPING
This was mapped with AC-13 Supervision and Reviewaccess control, which requires the organisation to supervise and review the
activities of users with respect to the enforcement and usage of information systems access controls.
While more terse, the NIST standard is actually more restrictive, in that it requires formal access authorisations and an enforcement process.
PO4.11 Segregation of duties states: Implement a division of roles and responsibilities that reduces the possibility for a single
individual to compromise a critical process. Make sure that personnel are performing only authorised duties relevant to their respective
jobs and positions.
This was mapped with:
AC-5 Separation of Duties, which requires the information system to enforce separation of duties through assigned access
authorisations
AC-6 Least Privilege, which requires the information system to enforce the most restrictive set of rights/privileges or accesses needed
by users (or processes acting on behalf of users) for the performance of specified tasks
While more terse, the NIST standard is actually more restrictive in that it requires formal access authorisations and an
enforcement process.
PO4.13 Key IT personnel states: Define and identify key IT personnel (e.g., replacements/backup personnel), and minimise reliance on
a single individual performing a critical job function.
This was mapped with PS-2 Position Categorisation, which requires the organisation to assign a risk designation to all positions and
establish screening criteria for individuals filling those positions. The organisation reviews and revises position risk designations based
on the organisation-defined frequency.
The goals here are similar. To identify critical job functions, position categorisations must be established. Whilst minimisation of single
points of failures is not explicitly stated in PS-2, such reliances would be covered under business continuity controls, explicitly covered
elsewhere.
PO4.14 Contracted staff policies and procedures states: Ensure that consultants and contract personnel who support the IT function
know and comply with the organisations policies for the protection of the organisations information assets such that they meet agreedupon contractual requirements.
This was mapped with PS-7 Third-Party Personnel Security, which requires the organisation to establish personnel security requirements,
including security roles and responsibilities for third-party providers, and monitor provider compliance to ensure adequate security.
RIGHTS
RESERVED
29
30
RIGHTS
RESERVED
6. DETAILED MAPPING
RIGHTS
RESERVED
31
32
RIGHTS
RESERVED
6. DETAILED MAPPING
This was mapped with RA-3 Risk Assessment, which requires the organisation to conduct assessments of the risk and magnitude of
harm that could result from the unauthorised access, use, disclosure, disruption, modification or destruction of information and
information systems that support the operations and assets of the agency (including information and information systems
managed/operated by external parties).
RIGHTS
RESERVED
33
This was mapped with SA-11 Developer Security Testing, which requires the information systems developer to create a security test and
evaluation plan, implement the plan, and document the results. This mandates security assurance, but would generally be integrated with
QA requirements.
AI2.10 Application software maintenance states: Develop a strategy and plan for the maintenance of software applications.
This was mapped with MA-2 Periodic Maintenance, which requires the organisation to schedule, perform and document routine
preventive and regular maintenance on the components of the information system in accordance with manufacturer or vendor
specifications and/or organisational requirements.
34
RIGHTS
RESERVED
6. DETAILED MAPPING
RIGHTS
RESERVED
35
CP-6 Alternate Storage Sites, which requires the organisation to identify an alternate storage site and initiate necessary agreements to
permit the storage of information systems backup information
CP-7 Alternate Processing Sites, which requires the organisation to identify an alternate processing site and initiate necessary
agreements to permit the resumption of information systems operations for critical mission/business functions within the
organisation-defined time period when the primary processing capabilities are unavailable
CP-8 Telecommunications Services, which requires the organisation to identify primary and alternate telecommunications services to
support the information system and initiate necessary agreements to permit the resumption of system operations for critical
mission/business functions within the organisation-defined time period when the primary telecommunications capabilities are unavailable
The NIST guidance requires more explicit controls to be present in the continuity solution.
DS4.2 IT continuity plans states: Develop IT continuity plans based on the framework and designed to reduce the impact of a major
disruption on key business functions and processes. The plans should be based on risk understanding of potential business impacts and
address requirements for resilience, alternative processing and recovery capability of all critical IT services. The plans should also cover
usage guidelines, roles and responsibilities, procedures, communication processes, and the testing approach.
This was mapped with:
CP-2 Contingency Plan, which requires the organisation to develop and implement a contingency plan for the information system,
addressing contingency roles, responsibilities, assigned individuals with contact information, and activities associated with restoring the
system after a disruption or failure. Designated officials within the organisation review and approve the contingency plan and distribute
copies of the plan to key contingency personnel.
CP-4 Contingency Plan Testing, which requires the organisation to test the contingency plan for the information system based on the
organisation-defined frequency, using organisation-defined tests and exercises to determine the plans effectiveness and the
organisations readiness to execute the plan. Appropriate officials within the organisation review the contingency plan test results and
initiate corrective actions.
CP-9 Information System Backup, which requires the organisation to conduct backups of user-level and system-level information
(including system state information) contained in the information system based on the organisation-defined frequency and protect
backup information whilst in transit and at the storage location
The NIST guidance seems to cover the COBIT control objective with more explicit language.
DS4.4 Maintenance of the IT continuity plan states: Encourage IT management to define and execute change control procedures to
ensure that the IT continuity plan is kept up to date and continually reflects actual business requirements. Communicate changes in
procedures and responsibilities clearly and in a timely manner.
This was mapped with CP-5 Contingency Plan Update, which requires the organisation to review the contingency plan for the
information system based on the organisation-defined frequency, at least annually, and revise the plan to address system/organisational
changes or problems encountered during plan implementation, execution or testing.
DS4.5 Testing of the IT continuity plan states: Test the IT continuity plan on a regular basis to ensure that IT systems can be
effectively recovered, shortcomings are addressed and the plan remains relevant. This requires careful preparation, documentation,
reporting test results and, according to the results, implementation of an action plan. Consider the extent of testing recovery of single
applications to integrated testing scenarios to end-to-end testing and integrated vendor testing.
This was mapped with CP-4 Contingency Plan Testing, which requires the organisation to test the contingency plan for the information
system based on the organisation-defined frequency, using organisation-defined tests and exercises to determine the plans effectiveness
and the organisations readiness to execute the plan. Appropriate officials within the organisation review the contingency plan test results
and initiate corrective actions.
DS4.6 IT continuity plan training states: Provide all concerned parties with regular training sessions regarding the procedures and their
roles and responsibilities in case of an incident or disaster. Verify and enhance training according to the results of the contingency tests.
This was mapped with CP-3 Contingency Training, which requires the organisation to train personnel in their contingency roles and
responsibilities with respect to the information system and provide refresher training based on the organisation-defined frequency, at
least annually.
36
RIGHTS
RESERVED
6. DETAILED MAPPING
DS4.8 IT services recovery and resumption states: Plan the actions to be taken for the period when IT is recovering and resuming
services. This may include activation of backup sites, initiation of alternative processing, customer and stakeholder communication, and
resumption procedures. Ensure that the business understands IT recovery times and the necessary technology investments to support
business recovery and resumption needs.
This was mapped with:
CP-7 Alternate Processing Sites, which requires the organisation to identify an alternate processing site and initiate necessary
agreements to permit the resumption of information systems operations for critical mission/business functions within the
organisation-defined time period when the primary processing capabilities are unavailable
CP-10 Information System Recovery and Reconstitution, which requires the organisation to employ mechanisms with supporting
procedures to allow the information system to be recovered and reconstituted to a known secure state after a disruption or failure
DS4.9 Offsite backup storage states: Store offsite all critical backup media, documentation and other IT resources necessary for
IT recovery and business continuity plans. Determine the content of backup storage in collaboration between business process owners
and IT personnel. Management of the offsite storage facility should respond to the data classification policy and the enterprises media
storage practices. IT management should ensure that offsite arrangements are periodically assessed, at least annually, for content,
environmental protection and security. Ensure compatibility of hardware and software to restore archived data, and periodically test and
refresh archived data.
This was mapped with:
CP-6 Alternate Storage Sites, which requires the organisation to identify an alternate storage site and initiate necessary agreements to
permit the storage of information systems backup information
CP-9 Information System Backup, which requires the organisation to conduct backups of user-level and system-level information
(including system state information) contained in the information system based on the organisation-defined frequency and protect
backup information whilst in transit and at the storage location
RIGHTS
RESERVED
37
system owners and implemented by the security-responsible person. Maintain user identities and access rights in a central repository.
Deploy cost-effective technical and procedural measures, and keep them current to establish user identification, implement
authentication and enforce access rights.
This was mapped with:
IA-1 Identification and Authentication Policy and Procedures, which requires the organisation to develop, disseminate and periodically
review/update:
A formal, documented identification and authentication policy that addresses purpose, scope, roles, responsibilities, management
commitment, co-ordination amongst organisational entities and compliance
Formal, documented procedures to facilitate the implementation of the identification and authentication policy and associated
identification and authentication controls
IA-2 User Identification and Authentication, which requires the information system to uniquely identify and authenticate users (or
processes acting on behalf of users)
IA-4 Identifier Management, which requires the organisation to manage user identifiers by:
Uniquely identifying each user
Verifying the identity of each user
Receiving authorisation to issue a user identifier from an appropriate organisation official
Ensuring that the user identifier is issued to the intended party
Disabling the user identifier after the organisation-defined time period of inactivity
Archiving user identifiers
Centralisation of user identities and access rights (mentioned in the COBIT control objectives) is not required by NIST guidance, but is
usually implemented as a matter of efficiency. In addition, US Homeland Security Presidential Directive/HSPD-12, Policy for a
Common Identification Standard for Federal Employees and Contractors, mandates that all US federal agencies use a governmentwide standard form of identification for the federal governments employees and contractors. This policy is intended to enhance security,
increase government efficiency, reduce identity fraud and protect personal privacy. It requires the use of this identification for gaining
physical access to federally controlled facilities and logical access to federally controlled information systems.
DS5.4 User account management states: Address requesting, establishing, issuing, suspending, modifying and closing user accounts
and related user privileges with a set of user account management procedures. Include an approval procedure outlining the data or
system owner granting the access privileges. These procedures should apply for all users, including administrators (privileged users) and
internal and external users, for normal and emergency cases. Rights and obligations relative to access to enterprise systems and
information should be contractually arranged for all types of users. Perform regular management review of all accounts and related
privileges.
This was mapped with:
AC-2 Account Management, which requires the organisation to manage information systems accounts, including establishing,
activating, modifying, reviewing, disabling and removing accounts. The organisation reviews information systems accounts based on
the organisation-defined frequency, at least annually.
IA-4 Identifier Management, which requires the organisation to manage user identifiers by:
Uniquely identifying each user
Verifying the identity of each user
Receiving authorisation to issue a user identifier from an appropriate organisation official
Ensuring that the user identifier is issued to the intended party
Disabling user identifier after the organisation-defined time period of inactivity
Archiving user identifiers
PS-6 Access Agreements, which requires the organisation to complete appropriate access agreements for individuals requiring access to
organisational information and information systems, before authorising access, and review/update the agreements
DS5.5 Security testing, surveillance and monitoring states: Test and monitor the IT security implementation in a proactive way. IT
security should be reaccredited in a timely manner to ensure that the approved enterprises information security baseline is maintained. A
logging and monitoring function will enable the early prevention and/or detection and subsequent timely reporting of unusual and/or
abnormal activities that may need to be addressed.
This was mapped with:
AU-6 Audit Monitoring, Analysis, and Reporting, which requires the organisation to regularly review/analyse information system audit
records for indications of inappropriate or unusual activity, investigate suspicious activity or suspected violations, report findings to
appropriate officials, and take necessary actions.
38
RIGHTS
RESERVED
6. DETAILED MAPPING
CA-2 Security Assessments, which requires the organisation to conduct an assessment of the security controls in the information
system based on the organisation-defined frequency, at least annually, to determine the extent to which the controls are implemented
correctly, operating as intended and producing the desired outcome with respect to meeting the security requirements for the system
CA-6 Security Accreditation, which requires the organisation to authorise (i.e., accredit) the information system for processing before
operations and update the authorisation based on the organisation-defined frequency, at least every three years or when there is a
significant change to the system. A senior organisational official signs and approves the security accreditation.
CA-7 Continuous Monitoring, which requires the organisation to monitor the security controls in the information system on an
ongoing basis.
CM-4 Monitoring Configuration Changes, which requires the organisation to monitor changes to the information system, conducting
security impact analyses to determine the effects of the changes
RA-5 Vulnerability Scanning, which requires the organisation to scan for vulnerabilities in the information system based on the
organisation-defined frequency or when significant new vulnerabilities potentially affecting the system are identified and reported. This
is also part of the FIPS 199 risk calculation.
SI-4 Information System Monitoring Tools and Techniques, which requires the organisation to employ tools and techniques to monitor
events on the information system, detect attacks and provide identification of unauthorised use of the system
DS5.6 Security incident definition states: Clearly define and communicate the characteristics of potential security incidents so that
they can be properly classified and treated by the incident and problem management process.
This was mapped with:
IR-1 Incident Response Policy and Procedures, which requires the organisation to develop, disseminate and periodically review/update:
A formal, documented incident response policy that addresses purpose, scope, roles, responsibilities, management commitment,
co-ordination amongst organisational entities and compliance
Formal, documented procedures to facilitate the implementation of the incident response policy and associated incident response
controls
IR-6 Incident Reporting, which requires the organisation to promptly report incident information to appropriate authorities
DS5.7 Protection of security technology states: Make security-related technology resistant to tampering, and do not disclose security
documentation unnecessarily.
This was mapped with:
PE-4 Access Control for Transmission Medium, which requires the organisation to control physical access to information system
distribution and transmission lines within organisational facilities to prevent accidental damage, eavesdropping, in-transit
modifications, disruption, or physical tampering
SA-5 Information System Documentation, which requires the organisation to ensure that adequate documentation for the information
system is available, protected when required, and distributed to authorised personnel
SC-3 Security Function Isolation, which requires the information system to isolate security functions from non-security functions
The COBIT control seems to imply a broader non-tampering requirement. The US federal perspective does not require any particular
level of tamper resistance.
DS5.8 Cryptographic key management states: Determine that policies and procedures are in place to organise the generation, change,
revocation, destruction, distribution, certification, storage, entry, use and archiving of cryptographic keys to ensure the protection of keys
against modification and unauthorised disclosure.
This was mapped with:
SC-12 Cryptographic Key Establishment and Management, which requires the information system to employ automated mechanisms
with supporting procedures or manual procedures for cryptographic key establishment and key management
SC-13 Use of Validated Cryptography, which requires that when cryptography is employed within the information system, the
cryptography to comply with applicable federal laws, directives, policies, regulations, standards, and guidance, including FIPS 140-2
(as amended), which requires the system to perform all cryptographic operations (including key generation) using FIPS 140-2 validated
cryptographic modules operating in approved modes of operation
The supplemental guidance to SC-12 points to NIST SP800-56 and NIST SP800-57 on key establishment and key management.
DS5.9 Malicious software prevention, detection and correction states: Put preventive, detective and corrective measures in place
(especially up-to-date security patches and virus control) across the organisation to protect information systems and technology from
malware (e.g., viruses, worms, spyware, spam).
RIGHTS
RESERVED
39
40
RIGHTS
RESERVED
6. DETAILED MAPPING
DS7.2 Delivery of training and education states: Based on the identified education and training needs, identify target groups and their
members, efficient delivery mechanisms, teachers, trainers and mentors. Appoint trainers and organise timely training sessions. Record
registration (including prerequisites), attendance and training session performance evaluations.
This was mapped with:
AT-3 Security Training, which requires the organisation to identify personnel with significant information systems security roles and
responsibilities, document those roles and responsibilities, and provide appropriate information system security training before
authorising access to the system, when required by system changes, and based on the organisation-defined frequency thereafter
AT-4 Security Training Records, which requires the organisation to document and monitor individual information systems security
training activities, including basic security awareness training and specific information systems security training
The NIST guidance focuses exclusively on security training.
RIGHTS
RESERVED
41
42
RIGHTS
RESERVED
6. DETAILED MAPPING
DS11.4 Disposal states: Define and implement procedures to ensure that business requirements for protection of sensitive data and
software are met when data and hardware are disposed or transferred.
This was mapped with:
MP-5 Media Transport, which requires the organisation to control information media (paper and digital) during transport and restrict
the pickup, receipt, transfer and delivery of such media to authorised personnel
MP-6 Media Sanitisation and Disposal, which requires the organisation to sanitise information systems media, both digital and nondigital, prior to disposal or release for reuse
DS11.5 Backup and restoration states: Define and implement procedures for backup and restoration of system, application, data and
documentation in line with business requirements and the continuity plan.
This was mapped with:
CP-9 Information System Backup, which requires the organisation to conduct backups of user-level and system-level information
(including system state information) contained in the information system based on the organisation-defined frequency and protect
backup information whilst in transit and at the storage location
CP-10 Information System Recovery and Reconstitution, which requires the organisation to employ mechanisms with supporting
procedures to allow the information system to be recovered and reconstituted to a known secure state after a disruption or failure
DS11.6 Security requirements for data management states: Define and implement policies and procedures to identify and apply
security requirements applicable to the receipt, processing, storage and output of data to meet business objectives, the organisations
security policy and regulatory requirements.
This was mapped with:
AC-1 Access Control Policy and Procedures, which requires the organisation to develop, disseminate and periodically review/update:
A formal, documented access control policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination amongst organisational entities and compliance
Formal, documented procedures to facilitate the implementation of the access control policy and associated access controls
AC-3 Access Enforcement, which requires the information system to enforce assigned authorisations for controlling access to the
system in accordance with applicable policy
AC-15 Automated Marking, which requires the information system to mark output using standard naming conventions to identify any
special dissemination, handling or distribution instructions
AC-16 Automated Labelling, which requires the information system to appropriately label information in storage, in process and in
transmission
MP-1 Media Protection Policy and Procedures, which requires the organisation to develop, disseminate and periodically review/update:
A formal, documented media protection policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination amongst organisational entities and compliance
Formal, documented procedures to facilitate the implementation of the media protection policy and associated media protection
controls
MP-2 Media Access, which requires the organisation to ensure that only authorised users have access to information in printed form or
on digital media removed from the information system.
MP-3 Media Labeling, which requires the organisation to affix external labels to removable information storage media and information
system output indicating the distribution limitations and handling caveats of the information. The organisation exempts the following
specific types of media or hardware components from labeling so long as they remain within a secure environment: based on the
organisation-defined list of media types and hardware components.
MP-4 Media Storage, which requires the organisation to physically control and securely store information system media, both paper
and digital, based on the highest FIPS 199 security category of the information recorded on the media
MP-5 Media Transport, which requires the organisation to control information system media (paper and digital) during transport and
restrict the pickup, receipt, transfer and delivery of such media to authorised personnel.
MP-6 Media Sanitation and Disposal, which requires the organisation to control information system media (paper and digital) during
transport and restrict the pickup, receipt, transfer and delivery of such media to authorised personnel
SI-10 Information Accuracy, Completeness, Validity and Authenticity, which requires the information system to check information for
accuracy, completeness, validity and authenticity
SI-12 Information Output Handing and Retention, which requires the organisation to handle and retain output from the information
system in accordance with organisational policy and operational requirements
RIGHTS
RESERVED
43
RIGHTS
RESERVED
6. DETAILED MAPPING
DS12.4 Protection against environmental factors states: Design and implement measures for protection against environmental factors.
Install specialised equipment and devices to monitor and control the environment.
This was mapped with:
PE-9 Power Equipment and Power Cabling, which requires the organisation to protect power equipment and power cabling for the
information system from damage and destruction
PE-10 Emergency Shutoff, which requires for specific locations within a facility containing concentrations of information systems
resources, the organisation to provide the capability of shutting off power to any information systems component that may be
malfunctioning or threatened without endangering personnel by requiring them to approach the equipment
PE-11 Emergency Power, which requires the organisation to provide a short-term uninterruptible power supply to facilitate an orderly
shutdown of the information system in the event of a primary power source loss
PE-12 Emergency Lighting, which requires the organisation to employ and maintain automatic emergency lighting that activates in the
event of a power outage or disruption and that covers emergency exits and evacuation routes
PE-13 Fire Protection, which requires the organisation to employ and maintain fire suppression and detection devices/systems that can
be activated in the event of a fire
PE-14 Temperature and Humidity Controls, which requires the organisation to regularly maintain within acceptable levels, and monitor
the temperature and humidity within the facility where the information system resides
PE-15 Water Damage Protection, which requires the organisation to protect the information system from water damage resulting from
broken plumbing lines or other sources of water leakage by ensuring that master shut-off valves are accessible, working properly and
known to key personnel
DS12.5 Physical facilities management states: Manage facilities, including power and communications equipment, in line with laws
and regulations, technical and business requirements, vendor specifications, and health and safety guidelines.
This was mapped with PE-1 Physical and Environmental Protection Policy and Procedures, which requires the organisation to develop,
disseminate and periodically review/update:
A formal, documented physical and environmental protection policy that addresses purpose, scope, roles, responsibilities, management
commitment, co-ordination amongst organisational entities and compliance
Formal, documented procedures to facilitate the implementation of the physical and environmental protection policy and associated
physical and environmental protection controls
RIGHTS
RESERVED
45
46
RIGHTS
RESERVED
6. DETAILED MAPPING
CP-1 Contingency Planning Policy and Procedures, which requires the organisation to develop, disseminate and periodically
review/update:
A formal, documented contingency planning policy that addresses purpose, scope, roles, responsibilities, management commitment,
co-ordination amongst organisational entities and compliance
Formal, documented procedures to facilitate the implementation of the contingency planning policy and associated contingency
planning controls
IA-1 Identification and Authentication Policy and Procedures, which requires organisation to develop, disseminate and periodically
review/update:
A formal, documented identification and authentication policy that addresses purpose, scope, roles, responsibilities, management
commitment, co-ordination amongst organisational entities and compliance
Formal, documented procedures to facilitate the implementation of the identification and authentication policy and associated
identification and authentication controls
IR-1 Incident Response Policy and Procedures, which requires the organisation to develop, disseminate and periodically review/update:
A formal, documented incident response policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination amongst organisational entities and compliance
Formal, documented procedures to facilitate the implementation of the incident response policy and associated incident response
controls
MA-1 System Maintenance Policy and Procedures, which requires the organisation to develop, disseminate and periodically
review/update:
A formal, documented information system maintenance policy that addresses purpose, scope, roles, responsibilities, management
commitment, co-ordination amongst organisational entities and compliance
Formal, documented procedures to facilitate the implementation of the information system maintenance policy and associated system
maintenance controls
MP-1 Media Protection Policy and Procedures, which requires the organisation to develop, disseminate and periodically review/update:
A formal, documented media protection policy that addresses purpose, scope, roles, responsibilities, management commitment,
co-ordination amongst organisational entities and compliance
Formal, documented procedures to facilitate the implementation of the media protection policy and associated media protection
controls
PE-1 Physical and Environmental Protection Policy and Procedures, which requires the organisation to develop, disseminate and
periodically review/update:
A formal, documented physical and environmental protection policy that addresses purpose, scope, roles, responsibilities,
management commitment, co-ordination amongst organisational entities and compliance
Formal, documented procedures to facilitate the implementation of the physical and environmental protection policy and associated
physical and environmental protection controls
PL-1 Security Planning Policy and Procedures, which requires the organisation to develop, disseminate and periodically review/update:
A formal, documented security planning policy that addresses purpose, scope, roles, responsibilities, management commitment,
co-ordination amongst organisational entities and compliance
Formal, documented procedures to facilitate the implementation of the security planning policy and associated security planning
controls
PS-1 Personnel Security Policy and Procedures, which requires the organisation to develop, disseminate and periodically
review/update:
A formal, documented personnel security policy that addresses purpose, scope, roles, responsibilities, management commitment,
co-ordination amongst organisational entities and compliance
Formal, documented procedures to facilitate the implementation of the personnel security policy and associated personnel security
controls
RA-1 Risk Assessment Policy and Procedures, which requires the organisation to develop, disseminate and periodically review/update:
A formal, documented risk assessment policy that addresses purpose, scope, roles, responsibilities, management commitment,
co-ordination amongst organisational entities and compliance
Formal, documented procedures to facilitate the implementation of the risk assessment policy and associated risk assessment controls
SA-1 System and Services Acquisition Policy and Procedures, which requires the organisation to develop, disseminate and periodically
review/update:
A formal, documented system and services acquisition policy that includes information security considerations and that addresses
purpose, scope, roles, responsibilities, management commitment, co-ordination amongst organisational entities and compliance
Formal, documented procedures to facilitate the implementation of the system
SC-1 System and Communications Protection Policy and Procedures, which requires the organisation to develop, disseminate and
periodically review/update:
A formal, documented system and communications protection policy that addresses purpose, scope, roles, responsibilities,
management commitment, co-ordination amongst organisational entities and compliance
Formal, documented procedures to facilitate the implementation of the system and communications protection policy and associated
system and communications protection controls
SI-1 System and Information Integrity, which requires the organisation to develop, disseminate and periodically review/update:
A formal, documented system and information integrity policy that addresses purpose, scope, roles, responsibilities, management
commitment, co-ordination amongst organisational entities and compliance
2007 IT GOVERNANCE INSTITUTE. ALL
RIGHTS
RESERVED
47
Formal, documented procedures to facilitate the implementation of the system and information integrity policy and associated system
and information integrity controls
48
RIGHTS
RESERVED
6. DETAILED MAPPING
RESULT
Figure 13Detailed Mapping of NIST SP800-53 With COBIT
COBIT 4.1 Control Objective
PO1
PO1.1
PO1.2
PO1.3
PO1.4
PO1.5
PO1.6
PO2
PO2.1
PO2.2
PO2.3
PO2.4
PO3
PO3.1
PO3.2
PO3.3
PO3.4
PO3.5
PO4
PO4.1
PO4.2
PO4.3
PO4.4
PO4.5
PO4.6
PO4.7
PO4.8
PO4.9
PO4.10
PO4.11
PO4.12
PO4.13
PO4.14
PO4.15
PO5
PO5.1
PO5.2
PO5.3
PO5.4
PO5.5
NIST SP800-53
Requirements
Coverage
A
N/A
A
A
N/A
A
A
N/A
A
C
SA-2
CA-7
PL-2, PL-3
CM-2
CM-1, CM-2
AC-3, AC-15, AC-16
SI-1, SI-4, SI-7, SI-10
N/A
N/A
N/A
N/A
N/A
N/A
N/A
N/A
N/A
N/A
A
N/A
N/A
N/A
A
A
N/A
A
A
N/A
N/A
A
N/A
N/A
N/A
RIGHTS
PS-1
AC-13
AC-5, AC-6
PS-2
PS-7
SA-2
RESERVED
49
NIST SP800-53
Requirements
Coverage
N/A
N/A
N/A
N/A
A
N/A
N/A
A
A
N/A
A
N/A
A
N/A
N/A
A
N/A
N/A
N/A
A
A
A
A
C
E
N/A
N/A
N/A
N/A
N/A
N/A
N/A
N/A
N/A
N/A
N/A
A
N/A
N/A
PL-4
PS-1, PS-2
AT-2, AT-3
PS-3
PS-4, PS-5
SA-3
RA-1
RA-2
RA-3, RA-5
RA-3, RA-4
IR-1, IR-4
IR-1, IR-4
CA-1
RIGHTS
RESERVED
6. DETAILED MAPPING
RA-3
N/A
N/A
N/A
N/A
N/A
A
C
A
N/A
A
A
N/A
A
AU-2, SI-10
AC-3, IA-2, SA-4, SA-8, SC-2, SI-7, SI-10
SA-1
SA-3
SA-11
MA-2
N/A
N/A
N/A
N/A
N/A
N/A
N/A
N/A
A
N/A
N/A
A
A
N/A
A
N/A
N/A
RIGHTS
SA-1
SA-4
CM-1, CM-3
CM-3
RESERVED
51
52
N/A
N/A
N/A
N/A
N/A
N/A
A
N/A
N/A
N/A
N/A
N/A
N/A
N/A
A
N/A
A
A
N/A
CA-4, CA-6
SA-9
PS-7
SA-9
N/A
N/A
N/A
N/A
N/A
E
C
N/A
C
C
C
N/A
C
C
N/A
RIGHTS
RESERVED
6. DETAILED MAPPING
N/A
E
C
C
E
E
C
C
C
C
E
N/A
N/A
N/A
N/A
A
A
N/A
AT-1
AT-3, AT-4
A
A
N/A
A
N/A
IR-7
IR-1, IR-4, IR-5
C
C
C
CM-1, CM-2
CM-3
CM-4, SA-6, SA-7
IR-5
N/A
N/A
N/A
N/A
C
C
N/A
C
C
E
RIGHTS
53
DS12.5
DS13
DS13.1
DS13.2
DS13.3
DS13.4
DS13.5
ME1
ME1.1
ME1.2
ME1.3
ME1.4
ME1.5
ME1.6
ME2
ME2.1
ME2.2
ME2.3
ME2.4
ME2.5
ME2.6
ME2.7
ME3
ME3.1
ME3.2
ME3.3
ME3.4
ME3.5
ME4
ME4.1
ME4.2
ME4.3
ME4.4
ME4.5
ME4.6
ME4.7
54
C
E
C
E
A
PE-1, PE-18
PE-3, PE-4, PE-5, PE-16, PE-19
PE-2, PE-6, PE-7, PE-8
PE-9, PE-10, PE-11, PE-12, PE-13, PE-14,
PE-15
PE-1
N/A
N/A
N/A
N/A
N/A
N/A
N/A
N/A
N/A
N/A
N/A
N/A
N/A
N/A
N/A
N/A
N/A
A
CA-5
N/A
SA-9
N/A
N/A
N/A
N/A
SA-9
N/A
N/A
N/A
N/A
N/A
N/A
N/A
RIGHTS
RESERVED
6. DETAILED MAPPING
PC6
AC
AC1
AC2
AC3
AC4
AC5
AC6
N/A
A
N/A
A
C
AU-1
PL-4
AC-1, AT-1, AU-1, CA-1, CM-1, CP-1, IA-1,
IR-1, MA-1, MP-1, PE-1, PL-1, PS-1, RA-1,
SA-1, SC-1, SI-1
N/A
A
A
A
A
A
E
SI-9
SI-9, AC-15
SI-10
SI-10
SI-11, SI-12
AU-10, SC-8, SC-9, SC-11, SC-23, SI-10
RIGHTS
RESERVED
55
7. REFERENCES
IT Governance Institute, COBIT 4.1, USA, 2007
National Institute of Standards and Technology, Computer Security Division, Information Technology Laboratory, USA:
FIPS 199, Standards for Security Categorization of Federal Information and Information Systems
FIPS 200, Minimum Security Requirements for Federal Information and Information Systems
SP800-18, Guide for Developing Security Plans for Federal Information Systems
SP800-26, Security Self-Assessment Guide for Information Technology Systems
SP800-30, Risk Management Guide for Information Technology Systems
SP800-37, Guide for the Security Certification and Accreditation of Federal Information Systems
SP800-39, Managing Risks from Information Systems: An Organizational Perspective (Initial Public Draft)
SP800-53 Rev 1, Recommended Security Controls for Federal Information Systems
SP800-53A, Guide for Assessing the Security Controls in Federal Information Systems, Second Public Draft
SP800-60, Guide for Mapping Types of Information and Information Systems to Security Categories
SP800-70, Security Configuration Checklists Program for IT Products
SP800-80, Guide for Developing Performance Metrics for Information Security
SP800-100, Information Security Handbook: A Guide for Managers
Paulk, M.C.; et al; Capability Maturity ModelSM for Software, CMU/SEI-93-TR-24, Carnegie Mellon University, Software Engineering
Institute, USA, 1993
56
RIGHTS
RESERVED
RIGHTS
RESERVED
57