Frameworks / NIST SP 800-144 / 1 NIST SP 800-144
Governance and Trust
NIST SP 800-144 1: Cloud Governance, Risk Assessment, and Provider Trust Evaluation Apply NIST SP 800-144 Guidelines on Security and Privacy in Public Cloud Computing published December 2011 + companion to NIST SP 800-145 + NIST SP 800-146 + FedRAMP + DoD Cloud Security Requirements Guide. Establish cloud governance framework + cloud risk assessment per Section 4 covering shared responsibility model + provider trust evaluation (SOC 2 Type II + ISO 27001/27017/27018 + FedRAMP Authorization + DoD IL2-6 + CCM + STAR + customer due diligence). Coordinate with CIO + CISO + CDO + CFO + General Counsel.
What else in your programme already covers this This control maps to 437 controls across 146 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
BSI-01 Account management and provisioning BSI-02 Access enforcement and least privilege BSI-03 Multi-factor authentication requirements BSI-13 Risk assessment procedures BSI-15 Security categorization BSI-17 Continuous monitoring strategy NIST-CSF-DE.AE-08 Incidents are declared when adverse events meet the defined incident criteria NIST-CSF-GV.RM-07 Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions NIST-CSF-ID.RA-09 The authenticity and integrity of hardware and software are assessed prior to acquisition and use NIST-CSF-PR.AA-01 Identities and credentials for authorized users, services, and hardware are managed by the organization NIST-CSF-PR.AA-02 Identities are proofed and bound to credentials based on the context of interactions NIST-CSF-PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties 3.11 Encrypt Sensitive Data at Rest 3.3 Configure Data Access Control Lists 3.7 Establish and Maintain a Data Classification Scheme 3.7.1 Key-management policies and procedures are implemented to include generation of strong cryptographic keys used to protect stored account data FEDRAMP-CM-6 Configuration Settings FEDRAMP-CP-9 System Backup DSOMM-1 Culture, Organization, Education, and Governance DSOMM-2 Implementation Practices, Secure Coding, and Threat Modelling DSOMM-3 Build, Deployment, Infrastructure Hardening, and Secrets Management DSOMM-4 Test and Verification - SAST, DAST, IAST, SCA, Penetration Testing DSOMM-6 Metrics, Maturity Measurement, and Continuous Improvement DA-1 Enterprise Data Architecture DIQ-1 Data Integration and Interoperability DIQ-2 Data Quality Management DSO-3 Data Access Management 6.4 Logging and Monitoring ISO13485-01 ePHI access controls and authorization ISO13485-06 Security management process and risk analysis ISO13485-12 Unique user identification and authentication OWASPLLM-1 Prompt Injection and System Prompt Leakage (LLM01 + LLM07) OWASPLLM-2 Improper Output Handling and Misinformation (LLM05 + LLM09) OWASPLLM-3 Sensitive Information Disclosure and Privacy (LLM02) OWASPLLM-6 Excessive Agency and Unbounded Consumption (LLM06 + LLM10) ASTWO-1 Audit Planning, Scaling, Risk Assessment, and Integration ASTWO-3 Entity-Level Controls and Period-End Financial Reporting Process ASTWO-7 Deficiency Evaluation, Material Weakness, and Communication ASTWO-8 ICFR Opinion, Basis, Definition, Limitations, Combined vs Separate Reports CH-FADP-21 Data protection impact assessments CH-FADP-25 Compliance monitoring and auditing FADP-5 Definitions (Article 5) FADP-7 Data Protection Impact Assessment (Articles 9-10) ASD37-18 Restrict administrative privileges (Essential) ASD37-20 Multi-factor authentication (Essential) ASD37-23 Protect authentication credentials (Excellent) 1.2 Operating System Privileged Account Control 1.3 Virtualisation Platform Protection 3.3 Configure Data Access Control Lists 6.4 Logging and Monitoring 6.5 Preparing and Distributing Audit Report 6.7 Conducting Audit Follow-up NZISM-1 NZISM Governance, Documentation, and Classification System NZISM-2 Certification and Accreditation (C&A) for Government Systems NZISM-3 Personnel Security, Physical Security, and Cryptography OWASPAPI-1 Broken Object Level Authorization (BOLA) and BFLA OWASPAPI-2 Broken Authentication and Token Management OWASPAPI-3 Broken Object Property Level Authorization (BOPLA) EHDSREG-1 Mandatory Requirements for EHR Systems (Articles 14-29) EHDSREG-5 Cross-Border Health Data Flows EHDSREG-6 Phased Application and Enforcement 4.3.1 Risk Assessment and Impact Analysis 4.4.1 Resources, Roles, Responsibility, and Authority AT-DSG-2 Section 2 - Scope and application AT-DSG-8 Section 22 - Functions and powers of the DPA MLE.1 Machine Learning Requirements Analysis MLE.3 Machine Learning Training BB-DPA-2 Section 2 - Interpretation BB-DPA-20 Sections 50-60 - Registration and Responsibilities FTC-Safeguards-9-Elements 9 Safeguard Elements - Access, Inventory, Encryption, Secure-Dev, MFA, Disposal, Change-Mgmt, Monitoring, Pen-Test (16 CFR 314.4(c)) FTC-Safeguards-Scope-Defs Scope, Definitions and Financial Institution Applicability (16 CFR 314.1, 314.2) AC-2 Account Management CA-9 Internal System Connections AC-2 Account Management CA-9 Internal System Connections UAE-PDPL-Art.18_19_20_21 Security measures, controller/processor relationship, DPIA (UAE PDPL Articles 18-21) UAE-PDPL-Status UAE PDPL status, executive regulations, UAE Data Office guidance evolution STANAG-1 STANAG 4774 Confidentiality Label Schema and XML Structure STANAG-2 STANAG 4778 Metadata Binding Mechanism and Cryptographic Binding NISTPF-3 Control-P - Privacy Controls, Data Management, and Disassociated Processing NISTPF-5 Protect-P Access Control (PR.AC-P) AC-2 Account Management CA-9 Internal System Connections AC-2 Account Management CA-9 Internal System Connections AC-2 Account Management CA-9 Internal System Connections NISTSP34-1 Contingency Planning Policy, Programme, and Plan Coordination NISTSP34-2 Business Impact Analysis (BIA): Critical Resources, Recovery Priorities NDPA-2 Consumer Rights - Access, Correct, Delete, Portability, Appeal NDPA-5 Privacy Notice, Data Minimisation, and Purpose Limitation NJDPA-7 Data Protection Assessments and Processor Contracts NJDPA-8 AG Platkin Enforcement, 18-Month Cure Sunset, and Division of Consumer Affairs PAKPDPB-7 NCPDP, Registration, Records, Processor Contracts, DPO PAKPDPB-8 Enforcement, Penalties, Complaints, Retention, Training AUPRV-6 Sensitive Information, PIA, Privacy by Design, Children AUPRV-8 OAIC Cooperation, Vendor Management, Training, Complaints, Enforcement 2.4.4 Hazard Analysis and Risk Assessment 2.7.2 Food Fraud Plan SWIFTCSCF-1 Restrict Internet Access and Protect Critical Systems (Objective 1) SWIFTCSCF-6 Detect Anomalous Activity (Objective 6) C1 Organizational Boundary C3 Scope 1 and 2 Coverage CRM-1 AML/CFT Compliance CRM-4 Business Risk Assessment CPS230-11 Identification, Assessment and Management of Operational Risk FFIEC-05 Roles and responsibilities definition ICP-1 Objectives, Powers and Responsibilities of the Supervisor ISO14001-03 Legal and regulatory compliance obligations 6.7 Conducting Audit Follow-up NGOB-1 Open Banking Registry Participation, Tiered Categorisation, and KYP AUNDB-A3 Eligible Data Breach Determination and Serious Harm Threshold OCCHS-1 Scope, Applicability, and Definitions of Heightened Standards 2.2.2 Vendor default accounts are managed as follows: • If the vendor default account(s) will be used, the default password is changed per Requirement 8.3.6. • If the vendor default account(s) will not be used, PSPF24-1 Security Culture, Governance, Risk Management RUSPD-2 Lawful Basis, Consent, Notice TEFCAREC-1 Common Agreement Conformance and Onboarding USSDWA-2 Cybersecurity Practices (Assessment, Access, Network, IR) CYB-2 Account Security Measures W3CVCDM-1 Three-Party Ecosystem (Issuer, Holder, Verifier) Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Query this from an agent The graph holds this control, the 437 it maps to, and the evidence behind each claim, over MCP and REST.