US Federal Agencies: Here’s How to Put NIST SP 800-53 and the NIST Cybersecurity Framework (NCSF) Together

The US National Institute of Standards and Technology (NIST) is a global leader in standards development. While its mission is to serve the US public and private sector organizations, NIST’s efforts support and influence standards worldwide—especially for cybersecurity. 
But are US federal agencies getting “too much of a good thing”? Since a Trump executive order in 2017, they’ve had to comply with NIST SP 800-53, Security and Privacy Controls for Information Systems and Organizations, and the NIST Cybersecurity Framework (NCSF). 

Is there a way to streamline compliance around NIST SP 800-53 and the NCSF?

On a recent episode of The Virtual CISO Podcast, host John Verry, Pivot Point Security’s CISO and managing partner, got firsthand insight into that question. His special guest, Dr. Ron Ross, is “uniquely qualified” to illuminate that topic as he heads development of NIST’s cybersecurity and privacy publications.
As Dr. Ross put it, “As they say at NASA, ‘Houston, we have a problem…’ because we’ve got two frameworks now.”
“So the private sector had one framework [NCSF], which was voluntary,” continues Dr. Ross. “Now the feds have two frameworks and they’re both mandatory. So we had a little bit of an issue here. It’s not a bad problem. In fact, it turned out rather well and we’re still working on that resolution.” 
“When we updated the Risk Management Framework [RMF, aka NIST 800-37] in 2018, we said, ‘How can we use the best concepts in both of these frameworks?’ recalls Dr. Ross. “In other words, the frameworks are different: one is a risk management framework, one is a cybersecurity framework, but they both have strengths and weaknesses.”

How would that look?

Dr Ross shares: “For example, you create a profile, you have a starting state in your framework, and then you have your goal state. That starts to sound a lot like my control selection process: I build a profile of what I would like to achieve in my organization with regard to cybersecurity, and that can actually form the basis of my security plan or my control selection process.
“So we talk about in our RMF 2.0, how can you actually do that, and use both frameworks together? We don’t just use the baselines anymore to do our control selection. Because of our engineering guidance documents, you can now drive your control selection from an engineering-based approach as well. 
“Let’s say you’re building a new system, and you’re going through all the requirements engineering at the front into that. Once you get your set of system level requirements, where a subset of those are designated as security requirements, you can then specifically take those requirements and map those to specific controls, which can be implemented to satisfy those requirements. 
“It’s a top-down driven process based on good systems engineering. Or you can go back to the enterprise approach at take the Moderate/Low/High baseline and do tailoring,” Dr. Ross summarizes. “Or you can use the NCSF. … Pick a framework that you feel comfortable with, but make sure once you’ve got that you do a good job of executing. We’ve got a whole set of tools in our toolbox to help our customers do that.”

CBIZ Pivot Point Security has helped hundreds of organizations of all sizes understand their cybersecurity posture utilizing the NIST Cybersecurity Framework (CSF). We utilize risk assessments, gap analysis, maturity modeling and more to help organizations understand their current and target cybersecurity goals.