NIST SP 800-144
Architecture and Isolation

NIST SP 800-144 2: Cloud Architecture, Service Selection, and Tenant Isolation

Apply Section 5 cloud architecture and service selection covering IaaS + PaaS + SaaS + FaaS + serverless models + deployment models (public + private + community + hybrid + multicloud) per NIST SP 800-145. Assess tenant isolation (hypervisor + container + namespace + network + storage + memory + cache) per Section 5.4 including side-channel attacks (Spectre + Meltdown + Foreshadow + Zombieload + MDS + Microarchitectural Data Sampling) + noisy neighbour + microcode patches + hardware attestation. Apply Cloud Security Alliance (CSA) Cloud Controls Matrix (CCM) for shared responsibility.

What else in your programme already covers this

This control maps to 44 controls across 24 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

  • ASD37-20 Multi-factor authentication (Essential)
  • ASD37-22 Network segmentation (Excellent)
  • ASD37-25 Software firewall - inbound (Very Good)
  • CPG-1.D Revoking Credentials for Departing Employees
  • CPG-8.A Network Segmentation

ISO/IEC 27011:2024 · 2 controls

API 1164 · 1 control

  • FFIEC-06 Network security and segmentation

IEC 62443 · 1 control

ISO 27017 · 1 control

ISO 27018 · 1 control

ISO 27019 · 1 control

ISO 27043 · 1 control

ISO/IEC 27010:2015 · 1 control

ISO/SAE 21434 · 1 control

  • NISTPF-5 Protect-P Access Control (PR.AC-P)
  • NZISM-5 Network Security, System Hardening, and Application Security

OWASP ASVS · 1 control

OWASP MASVS · 1 control

South Korea ISMS-P · 1 control

  • USSDWA-2 Cybersecurity Practices (Assessment, Access, Network, IR)

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Query this from an agent

The graph holds this control, the 44 it maps to, and the evidence behind each claim, over MCP and REST.