NIST Cybersecurity Framework (800-171)

The purpose of NIST 800-171 is to protect the confidentiality of Controlled Unclassified Information (CUI) in non-federal systems and organizations, particularly for those organizations that work with or partner with government entities. 

There are a total of 17 control families in the framework. They are briefly described below. 

1. Access Control (AC)
   Establishes who can access systems and data, and under what conditions, to ensure only authorized users can interact with CUI.
2. Awareness and Training (AT)
   Ensures personnel are trained to recognize and respond to cybersecurity threats and understand their responsibilities in protecting CUI.
3. Audit and Accountability (AU)
   Requires logging of system activity and monitoring to detect and respond to inappropriate or unauthorized actions.
4. Assessment, Authorization, and Monitoring (CA)
   Mandates regular security assessments and continuous monitoring to ensure systems remain secure and compliant.
5. Configuration Management (CM)
   Controls changes to system configurations to prevent unauthorized or unintended alterations that could compromise security.
6. Identification and Authentication (IA)
   Requires verification of user identities before granting access to systems, using secure methods like passwords or multi-factor authentication.
7. Incident Response (IR)
   Establishes procedures for detecting, reporting, and responding to cybersecurity incidents to minimize damage and recover quickly.
8. Maintenance (MA)
   Ensures that system maintenance is performed securely, including remote maintenance, and prevents unauthorized maintenance.
9. Media Protection (MP)
   Protects digital and physical media containing CUI from unauthorized access, use, or disposal.
10. Physical and Environmental Protection (PE)
    Secures physical access to systems and facilities to prevent unauthorized access or damage from environmental hazards.
11. Planning (PL)
    Requires the development and maintenance of security plans that define system boundaries, environments, and roles.
12. Personnel Security (PS)
    Ensures that individuals with access to CUI are trustworthy and that access is revoked promptly when it is no longer needed.
13. Risk Assessment (RA)
    Identifies and evaluates risks to organizational operations and assets, and implements measures to mitigate them.
14. System and Services Acquisition (SA)
    Ensures that security requirements are included in the acquisition of systems and services, including third-party vendors.
15. System and Communications Protection (SC)
    Protects data in transit and at rest, and ensures secure communication channels and system boundaries.
16. System and Information Integrity (SI)
    Monitors systems for flaws and malicious activity, and ensures timely updates and corrections to maintain integrity.
17. Supply Chain Risk Management (SR)
    Manages risks associated with third-party suppliers and service providers that could impact the confidentiality of CUI.