Frameworks / NIST SP 800-144 / 2 NIST SP 800-144
Architecture and Isolation
NIST SP 800-144 2: Cloud Architecture, Service Selection, and Tenant Isolation Apply Section 5 cloud architecture and service selection covering IaaS + PaaS + SaaS + FaaS + serverless models + deployment models (public + private + community + hybrid + multicloud) per NIST SP 800-145. Assess tenant isolation (hypervisor + container + namespace + network + storage + memory + cache) per Section 5.4 including side-channel attacks (Spectre + Meltdown + Foreshadow + Zombieload + MDS + Microarchitectural Data Sampling) + noisy neighbour + microcode patches + hardware attestation. Apply Cloud Security Alliance (CSA) Cloud Controls Matrix (CCM) for shared responsibility.
Maintained by Gerard Blokdyk · Verified against the published standard 31 May 2026 · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 42 controls across 22 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
ASD37-20 Multi-factor authentication (Essential) ASD37-22 Network segmentation (Excellent) ASD37-25 Software firewall - inbound (Very Good) CPG-1.D Revoking Credentials for Departing Employees CPG-8.A Network Segmentation 27011-6.3 Awareness and Training 27011-8.2 Network security and segregation API1164-13 Business Continuity and Recovery AWWA-3.1 Network Segmentation CAT-D3-1 Preventative controls FFIEC-06 Network security and segmentation IEC62443-13 Network security monitoring ISO28001-PS-01 Facility Security 27010-13.1 Communications Security ISO27019-13 Network security monitoring ISO27043-27 Network security management ISO21434-27 Network security management NISTPF-5 Protect-P Access Control (PR.AC-P) NZISM-5 Network Security, System Hardening, and Application Security IM8-SEC.3 Network Security ISMSP-AC-04 Network Access Control CPSC-CS.1 Network Security for Connected Products USSDWA-2 Cybersecurity Practices (Assessment, Access, Network, IR) Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Query this from an agent The graph holds this control, the 42 it maps to, and the evidence behind each claim, over MCP and REST.