attachment
<div dir="ltr"><div><br clear="all"></div><div>FYI - significant update of a base NIST standard very widely referenced in other SDOs</div><div>and other NIST standards.<br></div><div><div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">---------- Forwarded message ---------<br>From: <b class="gmail_sendername" dir="auto">'Brewer, Jeffrey (Fed)' via sw.assurance</b> <span dir="auto"><<a href="mailto:sw.assurance@list.nist.gov">sw.assurance@list.nist.gov</a>></span><br>Date: Wed, Sep 23, 2020 at 4:21 PM<br>Subject: [sw.assurance] Security and Privacy Controls for Information Systems and Organizations: NIST Publishes SP 800-53, Revision 5<br>To: sec-cert <<a href="mailto:sec-cert@nist.gov">sec-cert@nist.gov</a>><br></div><br><br>
<div link="#0563C1" vlink="#954F72" lang="EN-US">
<div class="m_-7423209519420967876WordSection1">
<p class="MsoNormal">NIST Special Publication (SP) 800-53, Revision 5, <a href="https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final" target="_blank">
<i>Security and Privacy Controls for Information Systems and Organizations</i></a><i>,</i> represents a multi-year effort to develop the next generation of security and privacy controls needed to strengthen and support the Federal Government and every sector
of critical infrastructure. These next generation controls offer a proactive and systematic approach to ensuring that critical systems, components, and services are sufficiently trustworthy and have the necessary resilience to defend the economic and national
security interests of the United States. <u></u><u></u></p>
<p class="MsoNormal">The most significant changes to SP 800-53, Revision 5 include:<u></u><u></u></p>
<ul style="margin-top:0in" type="disc">
<li class="m_-7423209519420967876MsoListParagraphCxSpFirst" style="margin-left:0in">
<b>Consolidating the control catalog:</b> Information security and privacy controls are now integrated into a seamless, consolidated control catalog for information systems and organizations.<u></u><u></u></li><li class="m_-7423209519420967876MsoListParagraphCxSpMiddle" style="margin-left:0in">
<b>Integrating supply chain risk management:</b> Rev. 5 establishes a new supply chain risk management (SCRM) control family and integrates SCRM aspects throughout the catalog.<u></u><u></u></li><li class="m_-7423209519420967876MsoListParagraphCxSpMiddle" style="margin-left:0in">
<b>Adding new state-of-the-practice controls:</b> These are based on the latest threat intelligence and cyber-attack data (e.g., controls to support cyber resiliency, secure systems design, security and privacy governance, and accountability).<u></u><u></u></li><li class="m_-7423209519420967876MsoListParagraphCxSpMiddle" style="margin-left:0in">
<b>Making controls outcome-based:</b> Rev. 5 accomplishes this by removing the entity responsible for satisfying the control (i.e., information system, organization) from the control statement.<u></u><u></u></li><li class="m_-7423209519420967876MsoListParagraphCxSpMiddle" style="margin-left:0in">
<b>Improving descriptions of content relationships:</b> Rev. 5 clarifies the relationship between requirements and controls as well as the relationship between security and privacy controls.<u></u><u></u></li><li class="m_-7423209519420967876MsoListParagraphCxSpMiddle" style="margin-left:0in">
<b>Separating the control selection processes from the controls:</b> This allows the controls to be used by different communities of interest, including systems engineers, security architects, software developers, enterprise architects, systems security and
privacy engineers, and mission or business owners.<u></u><u></u></li><li class="m_-7423209519420967876MsoListParagraphCxSpLast" style="margin-left:0in">
<b>Transferring control baselines and tailoring guidance to NIST SP 800-53B:</b> This content has moved to the new (draft)
<i>Control Baselines for Information Systems and Organizations.</i><u></u><u></u></li></ul>
<p class="MsoNormal">Additional <a href="https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final" target="_blank">
supplemental materials</a> will be available immediately or in the near future, including:<u></u><u></u></p>
<ul style="margin-top:0in" type="disc">
<li class="m_-7423209519420967876MsoListParagraphCxSpFirst" style="margin-left:0in">
Security and privacy control collaboration index template <i>(now available)</i><u></u><u></u></li><li class="m_-7423209519420967876MsoListParagraphCxSpMiddle" style="margin-left:0in">
Comparison of Revisions 4 and 5 of SP 800-53 <i>(available soon)</i><u></u><u></u></li><li class="m_-7423209519420967876MsoListParagraphCxSpMiddle" style="margin-left:0in">
Control mappings to the <a href="https://doi.org/10.6028/NIST.CSWP.04162018" target="_blank">Cybersecurity Framework</a> and
<a href="https://doi.org/10.6028/NIST.CSWP.01162020" target="_blank">Privacy Framework</a> <i>(available soon)</i><u></u><u></u></li><li class="m_-7423209519420967876MsoListParagraphCxSpMiddle" style="margin-left:0in">
Control mappings to OMB Circular A-130 privacy requirements <i>(available soon)</i><u></u><u></u></li><li class="m_-7423209519420967876MsoListParagraphCxSpMiddle" style="margin-left:0in">
<a href="https://github.com/usnistgov/oscal-content/tree/master/nist.gov/SP800-53" target="_blank">Open Security Control Assessment Language (OSCAL)</a> version of SP 800-53 controls
<i>(available soon)</i> <u></u><u></u></li><li class="m_-7423209519420967876MsoListParagraphCxSpLast" style="margin-left:0in">
Spreadsheet of SP 800-53 controls <i>(available soon)</i><u></u><u></u></li></ul>
<p class="MsoNormal">Publication details for SP 800-53, Revision 5: <a href="https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final" target="_blank">
https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final</a><u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">For questions, comments and feedback on the catalog or the supplemental materials, contact:
<a href="mailto:sec-cert@nist.gov" target="_blank">sec-cert@nist.gov</a>. <u></u><u></u></p>
<p class="MsoNormal"><span style="font-family:"Times New Roman",serif"><u></u> <u></u></span></p>
<p class="MsoNormal">Jeff Brewer<u></u><u></u></p>
<p class="MsoNormal">Management and Program Analyst<u></u><u></u></p>
<p class="MsoNormal">Information Technology Lab, Computer Security Division, <u></u>
<u></u></p>
<p class="MsoNormal">National Institute of Standards and Technology<u></u><u></u></p>
<p class="MsoNormal">301-975-2489<u></u><u></u></p>
<p class="MsoNormal"><a href="mailto:Jeffrey.brewer@nist.gov" target="_blank">Jeffrey.brewer@nist.gov</a><u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
<p></p>
-- <br>
To unsubscribe from this group, send email to <a href="mailto:sw.assurance%2Bunsubscribe@list.nist.gov" target="_blank">sw.assurance+unsubscribe@list.nist.gov</a><br>
View this message at <a href="https://list.nist.gov/sw.assurance" target="_blank">https://list.nist.gov/sw.assurance</a><br>
--- <br>
To unsubscribe from this group and stop receiving emails from it, send an email to <a href="mailto:sw.assurance+unsubscribe@list.nist.gov" target="_blank">sw.assurance+unsubscribe@list.nist.gov</a>.<br>
</div></div></div></div>