Frameworks / NIST SP 800-144 / NISTSP144-1 NIST SP 800-144
Governance and Trust
NIST SP 800-144 NISTSP144-1: Cloud Governance, Risk Assessment, and Provider Trust Evaluation Apply NIST SP 800-144 Guidelines on Security and Privacy in Public Cloud Computing published December 2011 + companion to NIST SP 800-145 + NIST SP 800-146 + FedRAMP + DoD Cloud Security Requirements Guide. Establish cloud governance framework + cloud risk assessment per Section 4 covering shared responsibility model + provider trust evaluation (SOC 2 Type II + ISO 27001/27017/27018 + FedRAMP Authorization + DoD IL2-6 + CCM + STAR + customer due diligence). Coordinate with CIO + CISO + CDO + CFO + General Counsel.
Maintained by Gerard Blokdyk · Verified against the published standard 31 May 2026 · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 367 controls across 130 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
AWWA-1.1 Security Policy and Governance AWWA-1.2 Risk Assessment AWWA-1.3 Security Awareness and Training AWWA-2.1 User Access Management AWWA-2.2 Authentication Mechanisms AWWA-2.3 Account Management BSI-01 Account management and provisioning BSI-02 Access enforcement and least privilege BSI-03 Multi-factor authentication requirements BSI-13 Risk assessment procedures BSI-15 Security categorization BSI-17 Continuous monitoring strategy ISO23894-1 Scope of AI Risk Management ISO23894-3 AI-Specific Terminology ISO23894-6.2 Scope, Context and Criteria ISO23894-6.3 AI Risk Assessment ISO23894-6.3.1 AI Risk Identification ISO23894-6.3.3 AI Risk Evaluation NIST-CSF-DE.AE-08 Incidents are declared when adverse events meet the defined incident criteria NIST-CSF-GV.RM-07 Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions NIST-CSF-ID.RA-09 The authenticity and integrity of hardware and software are assessed prior to acquisition and use NIST-CSF-PR.AA-01 Identities and credentials for authorized users, services, and hardware are managed by the organization NIST-CSF-PR.AA-02 Identities are proofed and bound to credentials based on the context of interactions NIST-CSF-PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties 27557-1 Scope 27557-3 Terms and definitions 27557-4.3 Individual impact consideration 27557-6.2 Scope, context, and criteria for privacy 27557-6.3 Privacy risk assessment DSOMM-1 Culture, Organization, Education, and Governance DSOMM-2 Implementation Practices, Secure Coding, and Threat Modelling DSOMM-3 Build, Deployment, Infrastructure Hardening, and Secrets Management DSOMM-4 Test and Verification - SAST, DAST, IAST, SCA, Penetration Testing DSOMM-6 Metrics, Maturity Measurement, and Continuous Improvement ISMSP-AC-01 Access Control Policy ISMSP-AC-02 User Account Management ISMSP-AC-03 Authentication Mechanisms ISMSP-MS-02 Risk Management ISMSP-SYS-04 Vulnerability Management DA-1 Enterprise Data Architecture DIQ-1 Data Integration and Interoperability DIQ-2 Data Quality Management DSO-3 Data Access Management ISO-15189-5.1 Legal entity ISO-15189-5.4 Structure and authority ISO-15189-6.2 Personnel ISO-15189-6.7 Service agreements ISO-19650-1-4 Information management concepts ISO-19650-1-7 Common Data Environment (CDE) concept ISO-19650-2-5.7 Information model delivery ISO-19650-3-5.3 Trigger events for information exchange ISO27043-04 Roles and responsibilities definition ISO27043-12 User access management and provisioning ISO27043-13 Authentication and password management ISO27043-14 Privileged access management 29115-11 Mapping other authentication schemes 29115-12.1 Exchanging authentication results 29115-12.2 Controls for mitigating threats 29115-3 Terms and definitions ISO21434-04 Roles and responsibilities definition ISO21434-12 User access management and provisioning ISO21434-13 Authentication and password management ISO21434-14 Privileged access management OWASPLLM-1 Prompt Injection and System Prompt Leakage (LLM01 + LLM07) OWASPLLM-2 Improper Output Handling and Misinformation (LLM05 + LLM09) OWASPLLM-3 Sensitive Information Disclosure and Privacy (LLM02) OWASPLLM-6 Excessive Agency and Unbounded Consumption (LLM06 + LLM10) ASTWO-1 Audit Planning, Scaling, Risk Assessment, and Integration ASTWO-3 Entity-Level Controls and Period-End Financial Reporting Process ASTWO-7 Deficiency Evaluation, Material Weakness, and Communication ASTWO-8 ICFR Opinion, Basis, Definition, Limitations, Combined vs Separate Reports IM8-CLD.2 Cloud Security Controls IM8-RES.2 Disaster Recovery IM8-SEC.2 Access Control IM8-SEC.4 Vulnerability Management CH-FADP-21 Data protection impact assessments CH-FADP-25 Compliance monitoring and auditing FADP-5 Definitions (Article 5) FADP-7 Data Protection Impact Assessment (Articles 9-10) ASD37-18 Restrict administrative privileges (Essential) ASD37-20 Multi-factor authentication (Essential) ASD37-23 Protect authentication credentials (Excellent) FDBR-702 Definitions (§501.702) FDBR-Scope-Defs Scope, Applicability Thresholds and Definitions (Fla. Stat. 501.701, 501.702, 501.703, 501.704) FDBR-SensitiveData-Children-VoiceFacial Sensitive Data, Children's Privacy and Voice/Facial Recognition (Fla. Stat. 501.711, 501.1735) Sapin2-Pillar1-Code-of-Conduct Pillar 1 - Anti-Corruption Code of Conduct Sapin2-Pillar3-Risk-Mapping Pillar 3 - Corruption Risk Mapping (Cartographie des Risques) Sapin2-Pillar4-ThirdParty-DueDiligence Pillar 4 - Third-Party Due Diligence (Clients, Suppliers, Intermediaries, M&A) IEC62304-5.2 Software Requirements Analysis IEC62304-5.3 Software Architectural Design IEC62304-7.2 Risk Control Measures ISO-22320-5.1 General process requirements ISO-22320-5.3 Incident management structure (command) ISO-22320-5.4 Roles and responsibilities ISO27799-01 ePHI access controls and authorization ISO27799-06 Security management process and risk analysis ISO27799-12 Unique user identification and authentication ISO27003-4.3 Determining the scope of the information security management system ISO27003-6.1 Actions to address risks and opportunities ISO27003-8.2 Information security risk assessment 27004-3 Terms and definitions 27004-A.2 Patching and Vulnerability Measures 27004-B.1 Example measurement definitions 27011-1 Scope 27011-3 Terms and definitions 27011-8.1 User Endpoint Devices 29100-1 Scope 29100-3 Terms and definitions 29100-4.1 Actors and roles 29134-1 Scope 29134-3 Terms and definitions 29134-9.1 PIA report structure 29147-3 Terms and definitions 29147-5.11 Researcher Safe Harbour and Legal Posture 29147-9.2 Contact mechanisms and scope NZISM-1 NZISM Governance, Documentation, and Classification System NZISM-2 Certification and Accreditation (C&A) for Government Systems NZISM-3 Personnel Security, Physical Security, and Cryptography OWASPAPI-1 Broken Object Level Authorization (BOLA) and BFLA OWASPAPI-2 Broken Authentication and Token Management OWASPAPI-3 Broken Object Property Level Authorization (BOPLA) EHDSREG-1 Mandatory Requirements for EHR Systems (Articles 14-29) EHDSREG-5 Cross-Border Health Data Flows EHDSREG-6 Phased Application and Enforcement PIPA-CPO-DPO-Privacy-Officer-PIA-Personal-Information-Impact-Assessment-Articles-31-33 Korea PIPA CPO + DPO + Privacy Officer + PIA + Personal Information Impact Assessment + Articles 31-33 PIPA-Data-Subject-Rights-Access-Correction-Erasure-Portability-Automated-Decisions-Articles-35-37-2 Korea PIPA Data Subject Rights + Access + Correction + Erasure + Portability + Article 35-37 PIPA-Pseudonymisation-Article-28-2-3-Enforcement-PIPC-Investigation-Surcharges-3-Percent-Revenue-Article64-2 Korea PIPA Pseudonymisation + Article 28-2 + Enforcement + PIPC + Surcharges 3% + Article 63 + 64-2 58.1 Scope 58.3 Definitions AMLCTF-35 Identity Verification Standard AMLCTF-PartA-RiskAssess ML/TF Risk Assessment API1164-07 Remote Access API1164-24 Vulnerability assessment for critical systems 4.3.1 Risk Assessment and Impact Analysis 4.4.1 Resources, Roles, Responsibility, and Authority AL-DPA-1 Scope and Definitions AL-DPA-3 Lawful Basis for Processing AT-DSG-2 Section 2 - Scope and application AT-DSG-8 Section 22 - Functions and powers of the DPA MLE.1 Machine Learning Requirements Analysis MLE.3 Machine Learning Training BB-DPA-2 Section 2 - Interpretation BB-DPA-20 Sections 50-60 - Registration and Responsibilities IS.D.OR.205 Information Security Risk Assessment IS.I.OR.205 Information Security Risk Assessment CJIS-16 Cloud Computing CJIS-17 Risk Assessment FTC-Safeguards-9-Elements 9 Safeguard Elements - Access, Inventory, Encryption, Secure-Dev, MFA, Disposal, Change-Mgmt, Monitoring, Pen-Test (16 CFR 314.4(c)) FTC-Safeguards-Scope-Defs Scope, Definitions and Financial Institution Applicability (16 CFR 314.1, 314.2) AC-2 Account Management CA-9 Internal System Connections AC-2 Account Management CA-9 Internal System Connections FEDRAMP-CM-6 Configuration Settings FEDRAMP-CP-9 System Backup UAE-PDPL-Art.18_19_20_21 Security measures, controller/processor relationship, DPIA (UAE PDPL Articles 18-21) UAE-PDPL-Status UAE PDPL status, executive regulations, UAE Data Office guidance evolution ICAO-ANX17-Chap2-ThreatAssessment-RiskManagement-Cyber-GASeP ICAO Annex 17 Chapter 2 - Threat Assessment + Risk Management + Cyber Threats to Critical Aviation Systems (Amendment 17/18) ICAO-ANX17-Chap4-Cargo-Mail-Catering-Stores-Supplies-RegulatedAgent-KnownConsignor ICAO Annex 17 Chapter 4 - Cargo + Mail + Catering + Stores + Supplies Security + Regulated Agent + Known Consignor + Supply Chain 60601-1.3 Terminology and definitions 60601-1.4.1 General requirements 62351-2 Glossary of terms 62351-8 Role-based access control (RBAC) IEC62443-07 Personnel risk assessment IEC62443-24 Vulnerability assessment for critical systems ISO-20400-4.2 Principles of sustainable procurement ISO-20400-7.2 Integrating sustainability into specifications ISO-26262-3-5 Item definition ISO-26262-3-7 Hazard analysis and risk assessment (HARA) ISO-41001-4.1 Understanding the organization and its context ISO-41001-4.3 Determining the scope of the FM management system ISO-56002-4.3 Determining the scope of the innovation management system ISO-56002-8.3.4 Develop solutions ISO8000-DQM-02 Data Quality Dimensions ISO8000-MDG-03 Continuous Improvement ISO-17025-5.1 Legal entity ISO-17025-5.4 Personnel for the management system 23837-1.1 Scope 23837-1.7.3 Authentication and classical post-processing ISO-25012-5.2 Defining data quality measures ISO-25012-5.3 Planning and performing data quality evaluations 27014-1 Scope 27014-3 Terms and definitions ISO27019-07 Personnel risk assessment ISO27019-24 Vulnerability assessment for critical systems 27031-5.1 IRBC Policy 27031-7.2 Resource Requirements 27400-3 Terms and definitions 27400-6.1 Secure Device Design 30111-3 Terms and definitions 30111-5.1 Organizational policy BIPA-SEC5-1 Biometric Identifier Definition BIPA-SEC5-2 Biometric Information Definition STANAG-1 STANAG 4774 Confidentiality Label Schema and XML Structure STANAG-2 STANAG 4778 Metadata Binding Mechanism and Cryptographic Binding NISTPF-3 Control-P - Privacy Controls, Data Management, and Disassociated Processing NISTPF-5 Protect-P Access Control (PR.AC-P) NISTSP34-1 Contingency Planning Policy, Programme, and Plan Coordination NISTSP34-2 Business Impact Analysis (BIA): Critical Resources, Recovery Priorities NDPA-2 Consumer Rights - Access, Correct, Delete, Portability, Appeal NDPA-5 Privacy Notice, Data Minimisation, and Purpose Limitation NJDPA-7 Data Protection Assessments and Processor Contracts NJDPA-8 AG Platkin Enforcement, 18-Month Cure Sunset, and Division of Consumer Affairs PAKPDPB-7 NCPDP, Registration, Records, Processor Contracts, DPO PAKPDPB-8 Enforcement, Penalties, Complaints, Retention, Training AUPRV-6 Sensitive Information, PIA, Privacy by Design, Children AUPRV-8 OAIC Cooperation, Vendor Management, Training, Complaints, Enforcement 2.4.4 Hazard Analysis and Risk Assessment 2.7.2 Food Fraud Plan SWIFTCSCF-1 Restrict Internet Access and Protect Critical Systems (Objective 1) SWIFTCSCF-6 Detect Anomalous Activity (Objective 6) C1 Organizational Boundary C3 Scope 1 and 2 Coverage CRM-1 AML/CFT Compliance CRM-4 Business Risk Assessment CPSC-CS.2 Authentication and Access Controls CPSC-RA.3 Lifecycle Risk Assessment USMCADIGITAL-1 Cross-Border Data Flows and Localisation USMCADIGITAL-2 Personal Information Protection and Consumer Protection VERMONTAICDA-3 Bias Testing, Discrimination Prevention, Transparency VERMONTAICDA-4 Vermont AG Enforcement and Cure VIETNAMCYBER-2 Prohibited Acts (Access, Interception, Forgery, Content) VIETNAMCYBER-4 Incident Reporting and Cooperation CFR211-A-3 Section 211.3 - Definitions CPS230-11 Identification, Assessment and Management of Operational Risk AZ-DPA-2 Article 2 - Basic Concepts COBIT-BAI02 Managed requirements definition CA-ITSG33-SC-03 Cloud Security CAT-IRP-4 Organizational characteristics FFIEC-05 Roles and responsibilities definition ICP-1 Objectives, Powers and Responsibilities of the Supervisor IATA-IOSA-Section1-ORG-Organization-ManagementSystem-SMS IATA IOSA Section 1 - ORG Organization and Management System + Safety Management System (SMS) + Safety Policy + Hazard ID + Quality ISO-14064-1-5.1 Organizational boundaries ISO-22313-8.2 Business impact analysis and risk assessment ISO28001-PI-01 Personnel Security Screening 27007-5.2 Audit Programme Objectives 27010-9.2 Authentication of Sources 27050-1.4 Terms and definitions NFPA1600-5.1 Risk Assessment NGOB-1 Open Banking Registry Participation, Tiered Categorisation, and KYP AUNDB-A3 Eligible Data Breach Determination and Serious Harm Threshold OCCHS-1 Scope, Applicability, and Definitions of Heightened Standards 2.2.2 2.2.2 Vendor default accounts managed PSPF24-1 Security Culture, Governance, Risk Management RUSPD-2 Lawful Basis, Consent, Notice TEFCAREC-1 Common Agreement Conformance and Onboarding TURKEYKVKK-3 Special Categories and Sensitive Data ACE-CR-4 Cargo Release Authorization USSDWA-2 Cybersecurity Practices (Assessment, Access, Network, IR) 15 U.S.C. § 78dd-2(h) Definition of Domestic Concern CYB-2 Account Security Measures W3CVCDM-1 Three-Party Ecosystem (Issuer, Holder, Verifier) Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Query this from an agent The graph holds this control, the 367 it maps to, and the evidence behind each claim, over MCP and REST.