April 16, 2018
Function
Category
Cybersecurity Framework
Subcategory
Version 1.1
Informative References
ISO/IEC 27001:2013 A.6.1.5, A.14.1.1, A.14.2.1,
A.14.2.5
NIST SP 800-53 Rev. 4 PL-8, SA-3, SA-4, SA-8,
SA-10, SA-11, SA-12, SA-15, SA-17, SI-12, SI13, SI-14, SI-16, SI-17
PR.IP-3: Configuration change control
processes are in place
CIS CSC 3, 11
COBIT 5 BAI01.06, BAI06.01
ISA 62443-2-1:2009 4.3.4.3.2, 4.3.4.3.3
ISA 62443-3-3:2013 SR 7.6
ISO/IEC 27001:2013 A.12.1.2, A.12.5.1,
A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4
NIST SP 800-53 Rev. 4 CM-3, CM-4, SA-10
PR.IP-4: Backups of information are
conducted, maintained, and tested
CIS CSC 10
COBIT 5 APO13.01, DSS01.01, DSS04.07
ISA 62443-2-1:2009 4.3.4.3.9
ISA 62443-3-3:2013 SR 7.3, SR 7.4
ISO/IEC 27001:2013 A.12.3.1, A.17.1.2,
A.17.1.3, A.18.1.3
NIST SP 800-53 Rev. 4 CP-4, CP-6, CP-9
PR.IP-5: Policy and regulations regarding
the physical operating environment for
organizational assets are met
COBIT 5 DSS01.04, DSS05.05
ISA 62443-2-1:2009 4.3.3.3.1 4.3.3.3.2, 4.3.3.3.3,
4.3.3.3.5, 4.3.3.3.6
ISO/IEC 27001:2013 A.11.1.4, A.11.2.1,
A.11.2.2, A.11.2.3
NIST SP 800-53 Rev. 4 PE-10, PE-12, PE-13, PE14, PE-15, PE-18
PR.IP-6: Data is destroyed according to
policy
COBIT 5 BAI09.03, DSS05.06
ISA 62443-2-1:2009 4.3.4.4.4
ISA 62443-3-3:2013 SR 4.2
ISO/IEC 27001:2013 A.8.2.3, A.8.3.1, A.8.3.2,
A.11.2.7
NIST SP 800-53 Rev. 4 MP-6
This publication is available free of charge from: https://doi.org/10.6028/NIST.CSWP.04162018
34