NIST Cybersecurity Risk Assessments and Compliance Assessments

Demonstrate Compliance with NIST 800-53, NIST 800-171, and the NIST CSF

The National Institute for Standards & Technology (NIST) provides a structured set of measurements and standards for a variety of technical disciplines, including cybersecurity. The NIST cybersecurity framework (CSF) is designed to “facilitate and support the development of a voluntary, consensus-based, industry-led set of standards, guidelines, best practices, methodologies, procedures, and processes to cost-effectively reduce cyber risks;” individual NIST special publications 800-53 and 800-171 provide additional guidance for security and privacy controls for federal and non-federal information systems.

Implementing the NIST Cybersecurity Framework

The NIST CSF – formally known as the Framework for Improving Critical Infrastructure Security – outlines a number of standards for handling controlled unclassified information (CUI), such as personnel records, general financial information, budgets, and sensitive personally identifiable information (PII). To protect this information from internal and external threats, the framework covers elements such as:

• Inventory and control of hardware and software assets
• Continuous vulnerability management
• Controlled use of administrative privileges
• Secure configuration for hardware and software on mobile devices, laptops, workstations, and servers
• Maintenance, monitoring, and analysis of access logs
• Email and web browser protections
• Malware defenses
• Limitation and control of network ports, protocols, and services
• Data recovery capabilities
• Secure configuration for network devices, including firewalls, routers, and switches

• Boundary defense
• Data protection
• Controlled access
• Wireless access control
• Account monitoring and control
• Security awareness and training programs
• Application software security
• Incident response and management
• Penetration tests and red team exercises

The NIST cybersecurity framework is outcome-driven. It does not prescribe minimum standards for its elements; instead, it allows organizations to decide on their own risk-based implementations.

NIST CSF Core Functions, Implementation Tiers, and Profiles

The framework’s core functions – identify, protect, detect, respond, and recover – organize basic cybersecurity functions at their highest level. This in turn provides a strategic view of an organization’s cybersecurity efforts, in a format that’s easy to understand for both technical and non-technical stakeholders. Each of the framework’s major categories (such as governance, risk management, monitoring, and response planning) fall into one of the core functions:

The framework also includes implementation tiers, which help organizations understand how their current cybersecurity practices align with the NIST CSF. While similar to maturity levels, NIST implementation tiers are not quite as formal. Instead of striving for the highest possible maturity level, organizations should select the NIST tier that is most appropriate for their objectives, resources, and risk profile.

Similarly, NIST CSF profiles allow organizations to map their efforts to the framework’s core functions. Organizations can use profiles to identify opportunities for improvement by comparing their current profile to a desired “target” profile.

Obtaining Proof of NIST Compliance

Unlike other NIST standards, the NIST CSF is not a formal certification or accreditation program. Federal contracts and RFPs often require organizations to “self-certify”, or attest that they are in compliance with the NIST cyber risk management framework. However, third-party validation of an organization’s controls can provide an additional level of assurance.

NIST Cybersecurity Assessments

As an independent, third-party cybersecurity and compliance firm, 360 Advanced can help you navigate the NIST CSF assessment process. With a deep understanding of the NIST cybersecurity framework, our auditors can guide you through a CSF risk assessment or a formal NIST security assessment.

NIST Assessments as Part of an Integrated Compliance Initiative

Our firm takes a 360-degree approach to compliance. That means integrating NIST 800-53 and NIST 800-171 assessments with your other privacy, security, and information management initiatives. We can integrate your NIST CSF assessments with ISO certification efforts, FISMA certification efforts, DFARS (Defense Federal Acquisition Regulation Supplement) compliance initiatives, and DOD CMMC (Cybersecurity Maturity Model Certification) initiatives. We can also integrate your NIST compliance efforts with healthcare-specific assessments, such as HIPAA and HITRUST, or other general security initiatives, such as SOC 1 or SOC 2 examinations.

Our integrated approach streamlines the process for your entire team, allowing you to reduce duplicative requests and interviews and lowering your overall cost of compliance. Our fixed-fee model lets you focus on your business, while allowing our team to provide unlimited support and guidance along the way.