Frameworks / NIST SP 800-144 / NISTSP144-7 NIST SP 800-144
Workload and Configuration
NIST SP 800-144 NISTSP144-7: Cloud Workload Protection, Containers, Serverless, and Configuration Apply Section 7.5 cloud workload protection covering CWPP (Cloud Workload Protection Platform) + image and template hardening (golden image builds + AMI/VHD hardening + scanning) + container security (image scanning + admission control + runtime monitoring for container and Kubernetes workloads) + serverless security (function-level IAM least privilege + cold-start security). Apply Section 7.18 cloud configuration management + CSPM (Cloud Security Posture Management) + IaC scanning.
Maintained by Gerard Blokdyk · Verified against the published standard 31 May 2026 · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 108 controls across 44 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
BSI-14 Vulnerability scanning and management BSI-23 Baseline configuration establishment BSI-24 Configuration change control BSI-26 System component inventory IEC62304-4.1 Quality Management System IEC62304-5.1 Software Development Planning IEC62304-8.2 Change Control IEC62304-9.4 Use Change Control Process API1164-14 Physical Security API1164-22 Configuration management for OT systems API1164-23 Change management procedures ASD37-04 User application hardening (Essential) ASD37-10 Server application hardening (Very Good) ASD37-11 Operating system hardening (Very Good) IEC62443-14 System security hardening IEC62443-22 Configuration management for OT systems IEC62443-23 Change management procedures ISO27019-14 System security hardening ISO27019-22 Configuration management for OT systems ISO27019-23 Change management procedures 30111-1 Scope 30111-3 Terms and definitions 30111-8.1 Post-release monitoring CA-ITSG33-SC-01 Security Control Catalogue CA-ITSG33-SC-03 Cloud Security CJIS-16 Cloud Computing CJIS-7 Configuration Management FTC-Safeguards-9-Elements 9 Safeguard Elements - Access, Inventory, Encryption, Secure-Dev, MFA, Disposal, Change-Mgmt, Monitoring, Pen-Test (16 CFR 314.4(c)) FTC-Safeguards-ServiceProvider-Evaluation Service Provider Oversight + Program Evaluation + Personnel Training (16 CFR 314.4(d-g)) FEDRAMP-CM-1 Configuration Management Policy FEDRAMP-CM-2 Baseline Configuration ISO-26262-8-7 Configuration management ISO-26262-8-8 Change management ISO20000-06 Change management processes ISO20000-10 Configuration management 29147-5.6 Advisory Content and Quality 29147-7.8 Remediation information ITIL4-06 Change management processes ITIL4-10 Configuration management NZISM-3 Personnel Security, Physical Security, and Cryptography NZISM-5 Network Security, System Hardening, and Application Security DSOMM-1 Culture, Organization, Education, and Governance DSOMM-3 Build, Deployment, Infrastructure Hardening, and Secrets Management IM8-CLD.2 Cloud Security Controls IM8-SEC.4 Vulnerability Management ISMSP-SYS-01 System Hardening and Patch Management ISMSP-SYS-04 Vulnerability Management AS9100D-8.1 Operational Planning and Control AWWA-4.3 Configuration Management Clause 10 Change and configuration management CPG-5.A Vulnerability Disclosure Program DIQ-1 Data Integration and Interoperability CAT-D3-3 Corrective controls FFIEC-10 Secure configuration standards ISO30401-18 Innovation and change management 27011-8.5 Vulnerability and malware management ISO27043-25 Technical vulnerability management 27400-6.4 Default Configuration Security 29134-9.2 Report findings and recommendations ISO21434-25 Technical vulnerability management NISTPF-8 Protect-P Information Protection Processes (PR.PO-P) OWASPAPI-6 Security Misconfiguration and Secure API Design OWASPMASVS-6 MASVS-CODE: Code Quality, Build Settings, and Updates OWASPTOP10-2 A02:2025 Cryptographic Failures and Secret Management UNGPBHR-2 Pillar II: Corporate Responsibility to Respect Human Rights Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Query this from an agent The graph holds this control, the 108 it maps to, and the evidence behind each claim, over MCP and REST.