Cloud Controls Matrix

Hi All,

@Daniele Catteddu


Launching Today | New Online Tool to Improve Stakeholder Engagement with Security and Privacy Controls

We've heard your feedback about improving the usability of our most downloaded NIST publication, Special Publication (SP) 800-53! We have now made it available in additional data formats (e.g., CSV, XML, OSCAL, and online) and have improved the overall accessibility of the document. In response to your suggestions (and in the spirit of the NIST publication development principles), we have also developed a new online tool to allow stakeholders to provide real-time input and plan for future changes. This tool is a model for how standards and guidelines can keep pace with changes in technology and society, encourage all stakeholders to participate in the NIST standards/publication development and review process, and modernize how certain types of publications are issued in a more user-friendly manner.

The NIST SP 800-53 Controls Public Comment Site now enables stakeholders to:

• Keep up to date with the SP 800-53 controls and SP 800-53B control baselines, and access the most current controls in multiple data formats to manage cybersecurity, privacy, and supply chain risk.

• Provide feedback more easily on the controls and baselines and track how feedback is addressed. Users can comment and provide suggestions on the controls, control enhancements, and control baselines at any time. Users will also receive automated updates on the status of submitted comments and suggestions.

• Participate in comment periods to review draft controls and changes to control baselines proposed for a future release of SP 800-53 and SP 800-53B. During public comment periods, reduce the level of effort needed to review and comment on proposed changes, engage with other stakeholders about proposed changes, and provide feedback to NIST via the SP 800-53 Public Comment Site.

• Prepare for updates to SP 800-53 and SP 800-53B. With a new regular update schedule, stakeholders can better allocate resources to participate in the NIST feedback process, as well as plan for and preview updates to SP 800-53.

Learn more about the NIST SP 800-53 Controls Public Comment Site. We are excited about this tool and the opportunity to modernize how NIST solicits input from users, coordinates public comment periods, and issues future revisions to NIST SP 800-53. This is only the first step! Future plans include making the control assessment procedures available as part of the online platform – allowing stakeholders to comment on and preview control and assessment procedures together.
We look forward to your comments and ideas on the SP 800-53 controls. Check out our new site and all of the resources (more information, user guide, FAQ), and contact us with any questions or comments at [email protected]. Also, see our new infographic on how to engage, submit, and view comments.

NIST Cybersecurity and Privacy Program
NIST Computer Security Division (CSD)
Questions/Comments about this notice: [email protected]
CSRC Website questions: [email protected]

​​

------------------------------
Michael Roza CPA, CISA, CIA, MBA, Exec MBA
------------------------------

Hi All,

@Daniele Catteddu

The links are as follows:

The online version of 800-53: https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#!/800-53 
Online Feedback: https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/public-comments#!/home ​

------------------------------
Michael Roza CPA, CISA, CIA, MBA, Exec MBA
------------------------------

Original Message:
Sent: Sep 28, 2021 07:09:55 AM
From: Michael Roza
Subject: NIST Launching Today | New Online Tool to Improve Stakeholder Engagement with Security and Privacy Controls

Hi All,

@Daniele Catteddu


Launching Today | New Online Tool to Improve Stakeholder Engagement with Security and Privacy Controls

We've heard your feedback about improving the usability of our most downloaded NIST publication, Special Publication (SP) 800-53! We have now made it available in additional data formats (e.g., CSV, XML, OSCAL, and online) and have improved the overall accessibility of the document. In response to your suggestions (and in the spirit of the NIST publication development principles), we have also developed a new online tool to allow stakeholders to provide real-time input and plan for future changes. This tool is a model for how standards and guidelines can keep pace with changes in technology and society, encourage all stakeholders to participate in the NIST standards/publication development and review process, and modernize how certain types of publications are issued in a more user-friendly manner.

The NIST SP 800-53 Controls Public Comment Site now enables stakeholders to:

• Keep up to date with the SP 800-53 controls and SP 800-53B control baselines, and access the most current controls in multiple data formats to manage cybersecurity, privacy, and supply chain risk.

• Provide feedback more easily on the controls and baselines and track how feedback is addressed. Users can comment and provide suggestions on the controls, control enhancements, and control baselines at any time. Users will also receive automated updates on the status of submitted comments and suggestions.

• Participate in comment periods to review draft controls and changes to control baselines proposed for a future release of SP 800-53 and SP 800-53B. During public comment periods, reduce the level of effort needed to review and comment on proposed changes, engage with other stakeholders about proposed changes, and provide feedback to NIST via the SP 800-53 Public Comment Site.

• Prepare for updates to SP 800-53 and SP 800-53B. With a new regular update schedule, stakeholders can better allocate resources to participate in the NIST feedback process, as well as plan for and preview updates to SP 800-53.

Learn more about the NIST SP 800-53 Controls Public Comment Site. We are excited about this tool and the opportunity to modernize how NIST solicits input from users, coordinates public comment periods, and issues future revisions to NIST SP 800-53. This is only the first step! Future plans include making the control assessment procedures available as part of the online platform – allowing stakeholders to comment on and preview control and assessment procedures together.
We look forward to your comments and ideas on the SP 800-53 controls. Check out our new site and all of the resources (more information, user guide, FAQ), and contact us with any questions or comments at [email protected]. Also, see our new infographic on how to engage, submit, and view comments.

NIST Cybersecurity and Privacy Program
NIST Computer Security Division (CSD)
Questions/Comments about this notice: [email protected]
CSRC Website questions: [email protected]

​​

------------------------------
Michael Roza CPA, CISA, CIA, MBA, Exec MBA
------------------------------

This is awesome, Michael.
Gives my team and I some good ideas of what we can do with our own NZ ISM national technical policy & controls manual. 
We are already investigating OSCAL as an option; and hope to soon be launching on a new web-platform (allowing us to be more innovative).  https://nzism.gcsb.govt.nz/ 

Best Wishes,
Phil Cutforth
Manager, Office of Govt CISO, New Zealand

------------------------------
Phil Cutforth
Manager, INFOSEC Policy and Research
NZ GCISO
------------------------------

Original Message:
Sent: Sep 28, 2021 07:15:54 AM
From: Michael Roza
Subject: NIST Launching Today | New Online Tool to Improve Stakeholder Engagement with Security and Privacy Controls

Hi All,

@Daniele Catteddu

The links are as follows:

The online version of 800-53: https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#!/800-53
Online Feedback: https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/public-comments#!/home ​

------------------------------
Michael Roza CPA, CISA, CIA, MBA, Exec MBA

Original Message:
Sent: Sep 28, 2021 07:09:55 AM
From: Michael Roza
Subject: NIST Launching Today | New Online Tool to Improve Stakeholder Engagement with Security and Privacy Controls

Hi All,

@Daniele Catteddu


Launching Today | New Online Tool to Improve Stakeholder Engagement with Security and Privacy Controls

We've heard your feedback about improving the usability of our most downloaded NIST publication, Special Publication (SP) 800-53! We have now made it available in additional data formats (e.g., CSV, XML, OSCAL, and online) and have improved the overall accessibility of the document. In response to your suggestions (and in the spirit of the NIST publication development principles), we have also developed a new online tool to allow stakeholders to provide real-time input and plan for future changes. This tool is a model for how standards and guidelines can keep pace with changes in technology and society, encourage all stakeholders to participate in the NIST standards/publication development and review process, and modernize how certain types of publications are issued in a more user-friendly manner.

The NIST SP 800-53 Controls Public Comment Site now enables stakeholders to:

• Keep up to date with the SP 800-53 controls and SP 800-53B control baselines, and access the most current controls in multiple data formats to manage cybersecurity, privacy, and supply chain risk.

• Provide feedback more easily on the controls and baselines and track how feedback is addressed. Users can comment and provide suggestions on the controls, control enhancements, and control baselines at any time. Users will also receive automated updates on the status of submitted comments and suggestions.

• Participate in comment periods to review draft controls and changes to control baselines proposed for a future release of SP 800-53 and SP 800-53B. During public comment periods, reduce the level of effort needed to review and comment on proposed changes, engage with other stakeholders about proposed changes, and provide feedback to NIST via the SP 800-53 Public Comment Site.

• Prepare for updates to SP 800-53 and SP 800-53B. With a new regular update schedule, stakeholders can better allocate resources to participate in the NIST feedback process, as well as plan for and preview updates to SP 800-53.

Learn more about the NIST SP 800-53 Controls Public Comment Site. We are excited about this tool and the opportunity to modernize how NIST solicits input from users, coordinates public comment periods, and issues future revisions to NIST SP 800-53. This is only the first step! Future plans include making the control assessment procedures available as part of the online platform – allowing stakeholders to comment on and preview control and assessment procedures together.
We look forward to your comments and ideas on the SP 800-53 controls. Check out our new site and all of the resources (more information, user guide, FAQ), and contact us with any questions or comments at [email protected]. Also, see our new infographic on how to engage, submit, and view comments.

NIST Cybersecurity and Privacy Program
NIST Computer Security Division (CSD)
Questions/Comments about this notice: [email protected]
CSRC Website questions: [email protected]

​​

------------------------------
Michael Roza CPA, CISA, CIA, MBA, Exec MBA
------------------------------

Original Message:
Sent: 9/28/2021 4:55:00 PM
From: Phil Cutforth
Subject: RE: NIST Launching Today | New Online Tool to Improve Stakeholder Engagement with Security and Privacy Controls

This is awesome, Michael.
Gives my team and I some good ideas of what we can do with our own NZ ISM national technical policy & controls manual. 
We are already investigating OSCAL as an option; and hope to soon be launching on a new web-platform (allowing us to be more innovative).  https://nzism.gcsb.govt.nz/ 

Best Wishes,
Phil Cutforth
Manager, Office of Govt CISO, New Zealand

------------------------------
Phil Cutforth
Manager, INFOSEC Policy and Research
NZ GCISO
------------------------------

Original Message:
Sent: Sep 28, 2021 07:15:54 AM
From: Michael Roza
Subject: NIST Launching Today | New Online Tool to Improve Stakeholder Engagement with Security and Privacy Controls

Hi All,

@Daniele Catteddu

The links are as follows:

The online version of 800-53: https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#!/800-53
Online Feedback: https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/public-comments#!/home ​

------------------------------
Michael Roza CPA, CISA, CIA, MBA, Exec MBA

Original Message:
Sent: Sep 28, 2021 07:09:55 AM
From: Michael Roza
Subject: NIST Launching Today | New Online Tool to Improve Stakeholder Engagement with Security and Privacy Controls

Hi All,

@Daniele Catteddu


Launching Today | New Online Tool to Improve Stakeholder Engagement with Security and Privacy Controls

We've heard your feedback about improving the usability of our most downloaded NIST publication, Special Publication (SP) 800-53! We have now made it available in additional data formats (e.g., CSV, XML, OSCAL, and online) and have improved the overall accessibility of the document. In response to your suggestions (and in the spirit of the NIST publication development principles), we have also developed a new online tool to allow stakeholders to provide real-time input and plan for future changes. This tool is a model for how standards and guidelines can keep pace with changes in technology and society, encourage all stakeholders to participate in the NIST standards/publication development and review process, and modernize how certain types of publications are issued in a more user-friendly manner.

The NIST SP 800-53 Controls Public Comment Site now enables stakeholders to:

• Keep up to date with the SP 800-53 controls and SP 800-53B control baselines, and access the most current controls in multiple data formats to manage cybersecurity, privacy, and supply chain risk.

• Provide feedback more easily on the controls and baselines and track how feedback is addressed. Users can comment and provide suggestions on the controls, control enhancements, and control baselines at any time. Users will also receive automated updates on the status of submitted comments and suggestions.

• Participate in comment periods to review draft controls and changes to control baselines proposed for a future release of SP 800-53 and SP 800-53B. During public comment periods, reduce the level of effort needed to review and comment on proposed changes, engage with other stakeholders about proposed changes, and provide feedback to NIST via the SP 800-53 Public Comment Site.

• Prepare for updates to SP 800-53 and SP 800-53B. With a new regular update schedule, stakeholders can better allocate resources to participate in the NIST feedback process, as well as plan for and preview updates to SP 800-53.

Learn more about the NIST SP 800-53 Controls Public Comment Site. We are excited about this tool and the opportunity to modernize how NIST solicits input from users, coordinates public comment periods, and issues future revisions to NIST SP 800-53. This is only the first step! Future plans include making the control assessment procedures available as part of the online platform – allowing stakeholders to comment on and preview control and assessment procedures together.
We look forward to your comments and ideas on the SP 800-53 controls. Check out our new site and all of the resources (more information, user guide, FAQ), and contact us with any questions or comments at [email protected]. Also, see our new infographic on how to engage, submit, and view comments.

NIST Cybersecurity and Privacy Program
NIST Computer Security Division (CSD)
Questions/Comments about this notice: [email protected]
CSRC Website questions: [email protected]

​​

------------------------------
Michael Roza CPA, CISA, CIA, MBA, Exec MBA
------------------------------

Thanks, Micheal!
Indeed very well done.

And this is also the direction we have taken with CCM  (we have the YAML version), and keep on working on machine-readable versions of CCM.

The change request/feedback form is something I'd like to add to our CCM process.


​​

------------------------------
Daniele Catteddu
CTO
Cloud Security Alliance
------------------------------

Original Message:
Sent: Sep 28, 2021 07:15:54 AM
From: Michael Roza
Subject: NIST Launching Today | New Online Tool to Improve Stakeholder Engagement with Security and Privacy Controls

Hi All,

@Daniele Catteddu

The links are as follows:

The online version of 800-53: https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#!/800-53
Online Feedback: https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/public-comments#!/home ​

------------------------------
Michael Roza CPA, CISA, CIA, MBA, Exec MBA

Original Message:
Sent: Sep 28, 2021 07:09:55 AM
From: Michael Roza
Subject: NIST Launching Today | New Online Tool to Improve Stakeholder Engagement with Security and Privacy Controls

Hi All,

@Daniele Catteddu


Launching Today | New Online Tool to Improve Stakeholder Engagement with Security and Privacy Controls

We've heard your feedback about improving the usability of our most downloaded NIST publication, Special Publication (SP) 800-53! We have now made it available in additional data formats (e.g., CSV, XML, OSCAL, and online) and have improved the overall accessibility of the document. In response to your suggestions (and in the spirit of the NIST publication development principles), we have also developed a new online tool to allow stakeholders to provide real-time input and plan for future changes. This tool is a model for how standards and guidelines can keep pace with changes in technology and society, encourage all stakeholders to participate in the NIST standards/publication development and review process, and modernize how certain types of publications are issued in a more user-friendly manner.

The NIST SP 800-53 Controls Public Comment Site now enables stakeholders to:

• Keep up to date with the SP 800-53 controls and SP 800-53B control baselines, and access the most current controls in multiple data formats to manage cybersecurity, privacy, and supply chain risk.

• Provide feedback more easily on the controls and baselines and track how feedback is addressed. Users can comment and provide suggestions on the controls, control enhancements, and control baselines at any time. Users will also receive automated updates on the status of submitted comments and suggestions.

• Participate in comment periods to review draft controls and changes to control baselines proposed for a future release of SP 800-53 and SP 800-53B. During public comment periods, reduce the level of effort needed to review and comment on proposed changes, engage with other stakeholders about proposed changes, and provide feedback to NIST via the SP 800-53 Public Comment Site.

• Prepare for updates to SP 800-53 and SP 800-53B. With a new regular update schedule, stakeholders can better allocate resources to participate in the NIST feedback process, as well as plan for and preview updates to SP 800-53.

Learn more about the NIST SP 800-53 Controls Public Comment Site. We are excited about this tool and the opportunity to modernize how NIST solicits input from users, coordinates public comment periods, and issues future revisions to NIST SP 800-53. This is only the first step! Future plans include making the control assessment procedures available as part of the online platform – allowing stakeholders to comment on and preview control and assessment procedures together.
We look forward to your comments and ideas on the SP 800-53 controls. Check out our new site and all of the resources (more information, user guide, FAQ), and contact us with any questions or comments at [email protected]. Also, see our new infographic on how to engage, submit, and view comments.

NIST Cybersecurity and Privacy Program
NIST Computer Security Division (CSD)
Questions/Comments about this notice: [email protected]
CSRC Website questions: [email protected]

​​

------------------------------
Michael Roza CPA, CISA, CIA, MBA, Exec MBA
------------------------------