NIST SP 800-137
Reporting and Risk Scoring

NIST SP 800-137 NISTSP137-4: Security Status Reporting and Risk Score Aggregation

Provide security status reporting per Section 3.6 to System Owners + ISSO + AO + CISO + senior leadership. Apply risk score aggregation including: vulnerability scoring (CVSS v4.0 + EPSS + KEV catalog) + asset criticality scoring + threat intelligence overlay + business impact analysis. Use ATT&CK MITRE coverage scoring + NIST Cybersecurity Framework profile scoring + RMF system risk score per NIST SP 800-39 + Continuous Diagnostics and Mitigation (CDM) Federal Dashboard. Apply Federal Information Security Modernization Act (FISMA) reporting + OMB CyberStat reviews + annual FISMA report.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 37 controls across 17 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

BSI IT-Grundschutz · 3 controls

  • BSI-28 Audit event logging and storage
  • BSI-29 Audit record review and analysis
  • BSI-31 Audit log protection and retention

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association) · 1 control

  • AWWA-4.4 Audit Logging and Monitoring

Annex 11 to EU GMP - Computerised Systems · 1 control

FFIEC Cybersecurity Assessment Tool (CAT) · 1 control

  • CAT-D3-2 Detective controls

FTC GLBA Safeguards Rule (16 CFR Part 314) · 1 control

  • FTC-Safeguards-9-Elements 9 Safeguard Elements - Access, Inventory, Encryption, Secure-Dev, MFA, Disposal, Change-Mgmt, Monitoring, Pen-Test (16 CFR 314.4(c))

IEC 62351 - Power Systems Communication Security · 1 control

  • 62351-14 Cyber security event logging

ISO 27799:2025 · 1 control

  • ISO27799-05 Audit trail for ePHI access

ISO/IEC 25012:2008 - Data Quality Model · 1 control

  • ISO-25012-4.11 Traceability

ISO/IEC 27011:2024 · 1 control

  • 27011-8.4 Logging and monitoring

ISO/IEC 27043:2015 · 1 control

  • ISO27043-24 Logging and monitoring

ISO/SAE 21434 · 1 control

  • ISO21434-24 Logging and monitoring

NIST Privacy Framework · 1 control

  • NISTPF-8 Protect-P Information Protection Processes (PR.PO-P)

OWASP ASVS · 1 control

OWASP DevSecOps Maturity Model (DSOMM) · 1 control

  • DSOMM-3 Build, Deployment, Infrastructure Hardening, and Secrets Management

OWASP MASVS · 1 control

OWASP Top 10:2025 · 1 control

  • OWASPTOP10-9 A09:2025 Security Logging and Monitoring Failures

South Korea ISMS-P · 1 control

  • ISMSP-SYS-03 Security Monitoring and Log Management

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Query this from an agent

The graph holds this control, the 37 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll NIST SP 800-137 controls