Frameworks / NIST SP 800-145 / NISTSP145-7 NIST SP 800-145
Procurement and Service Catalogue Alignment
NIST SP 800-145 NISTSP145-7: Cloud Procurement Standards Aligned to NIST SP 800-145 Definition Embed the NIST SP 800-145 cloud definition into procurement standards, vendor questionnaires, and service catalogue intake. Procurement evaluation must score every candidate against (a) presence of all five essential characteristics, (b) declared service model SaaS PaaS IaaS, (c) declared deployment model private community public hybrid. Procurement contracts and statements of work must include the cloud-definition conformance clause, the right-to-audit conformance evidence, and the obligation to notify the consumer of any change to service-model or deployment-model declaration. The service catalogue must record the cloud-definition triple (characteristics, service model, deployment model) for every active service.
Maintained by Gerard Blokdyk · Verified against the published standard 31 May 2026 · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 328 controls across 125 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
BSI-13 Risk assessment procedures BSI-14 Vulnerability scanning and management BSI-15 Security categorization BSI-17 Continuous monitoring strategy BSI-23 Baseline configuration establishment BSI-24 Configuration change control BSI-26 System component inventory IEC62304-4.1 Quality Management System IEC62304-5.1 Software Development Planning IEC62304-5.2 Software Requirements Analysis IEC62304-5.3 Software Architectural Design IEC62304-7.2 Risk Control Measures IEC62304-8.2 Change Control IEC62304-9.4 Use Change Control Process ISO23894-1 Scope of AI Risk Management ISO23894-3 AI-Specific Terminology ISO23894-6.2 Scope, Context and Criteria ISO23894-6.3 AI Risk Assessment ISO23894-6.3.1 AI Risk Identification ISO23894-6.3.3 AI Risk Evaluation API1164-07 Remote Access API1164-14 Physical Security API1164-22 Configuration management for OT systems API1164-23 Change management procedures API1164-24 Vulnerability assessment for critical systems IEC62443-07 Personnel risk assessment IEC62443-14 System security hardening IEC62443-22 Configuration management for OT systems IEC62443-23 Change management procedures IEC62443-24 Vulnerability assessment for critical systems ISO27019-07 Personnel risk assessment ISO27019-14 System security hardening ISO27019-22 Configuration management for OT systems ISO27019-23 Change management procedures ISO27019-24 Vulnerability assessment for critical systems 27557-1 Scope 27557-3 Terms and definitions 27557-4.3 Individual impact consideration 27557-6.2 Scope, context, and criteria for privacy 27557-6.3 Privacy risk assessment 29147-3 Terms and definitions 29147-5.11 Researcher Safe Harbour and Legal Posture 29147-5.6 Advisory Content and Quality 29147-7.8 Remediation information 29147-9.2 Contact mechanisms and scope NIST-CSF-DE.AE-08 Incidents are declared when adverse events meet the defined incident criteria NIST-CSF-GV.RM-07 Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions NIST-CSF-ID.RA-09 The authenticity and integrity of hardware and software are assessed prior to acquisition and use NIST-CSF-PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties NIST-CSF-PR.PS-01 Configuration management practices are established and applied FEDRAMP-CM-1 Configuration Management Policy FEDRAMP-CM-2 Baseline Configuration FEDRAMP-CM-6 Configuration Settings FEDRAMP-CP-9 System Backup ISO-26262-3-5 Item definition ISO-26262-3-7 Hazard analysis and risk assessment (HARA) ISO-26262-8-7 Configuration management ISO-26262-8-8 Change management 29134-1 Scope 29134-3 Terms and definitions 29134-9.1 PIA report structure 29134-9.2 Report findings and recommendations 30111-1 Scope 30111-3 Terms and definitions 30111-5.1 Organizational policy 30111-8.1 Post-release monitoring ASTWO-1 Audit Planning, Scaling, Risk Assessment, and Integration ASTWO-3 Entity-Level Controls and Period-End Financial Reporting Process ASTWO-7 Deficiency Evaluation, Material Weakness, and Communication ASTWO-8 ICFR Opinion, Basis, Definition, Limitations, Combined vs Separate Reports ASD37-04 User application hardening (Essential) ASD37-10 Server application hardening (Very Good) ASD37-11 Operating system hardening (Very Good) AWWA-1.1 Security Policy and Governance AWWA-1.2 Risk Assessment AWWA-4.3 Configuration Management DA-1 Enterprise Data Architecture DIQ-1 Data Integration and Interoperability DIQ-2 Data Quality Management CJIS-16 Cloud Computing CJIS-17 Risk Assessment CJIS-7 Configuration Management FTC-Safeguards-9-Elements 9 Safeguard Elements - Access, Inventory, Encryption, Secure-Dev, MFA, Disposal, Change-Mgmt, Monitoring, Pen-Test (16 CFR 314.4(c)) FTC-Safeguards-Scope-Defs Scope, Definitions and Financial Institution Applicability (16 CFR 314.1, 314.2) FTC-Safeguards-ServiceProvider-Evaluation Service Provider Oversight + Program Evaluation + Personnel Training (16 CFR 314.4(d-g)) Sapin2-Pillar1-Code-of-Conduct Pillar 1 - Anti-Corruption Code of Conduct Sapin2-Pillar3-Risk-Mapping Pillar 3 - Corruption Risk Mapping (Cartographie des Risques) Sapin2-Pillar4-ThirdParty-DueDiligence Pillar 4 - Third-Party Due Diligence (Clients, Suppliers, Intermediaries, M&A) ISO-15189-5.1 Legal entity ISO-15189-5.4 Structure and authority ISO-15189-6.7 Service agreements ISO-19650-1-4 Information management concepts ISO-19650-1-7 Common Data Environment (CDE) concept ISO-19650-3-5.3 Trigger events for information exchange ISO-22320-5.1 General process requirements ISO-22320-5.3 Incident management structure (command) ISO-22320-5.4 Roles and responsibilities ISO27003-4.3 Determining the scope of the information security management system ISO27003-6.1 Actions to address risks and opportunities ISO27003-8.2 Information security risk assessment 27004-3 Terms and definitions 27004-A.2 Patching and Vulnerability Measures 27004-B.1 Example measurement definitions 27011-1 Scope 27011-3 Terms and definitions 27011-8.5 Vulnerability and malware management 29100-1 Scope 29100-3 Terms and definitions 29100-4.1 Actors and roles NZISM-1 NZISM Governance, Documentation, and Classification System NZISM-3 Personnel Security, Physical Security, and Cryptography NZISM-5 Network Security, System Hardening, and Application Security DSOMM-1 Culture, Organization, Education, and Governance DSOMM-2 Implementation Practices, Secure Coding, and Threat Modelling DSOMM-3 Build, Deployment, Infrastructure Hardening, and Secrets Management IM8-CLD.2 Cloud Security Controls IM8-RES.2 Disaster Recovery IM8-SEC.4 Vulnerability Management ISMSP-MS-02 Risk Management ISMSP-SYS-01 System Hardening and Patch Management ISMSP-SYS-04 Vulnerability Management CH-FADP-21 Data protection impact assessments FADP-5 Definitions (Article 5) FADP-7 Data Protection Impact Assessment (Articles 9-10) 58.1 Scope 58.3 Definitions 4.3.1 Risk Assessment and Impact Analysis 4.4.1 Resources, Roles, Responsibility, and Authority AL-DPA-1 Scope and Definitions AL-DPA-3 Lawful Basis for Processing AT-DSG-2 Section 2 - Scope and application AT-DSG-8 Section 22 - Functions and powers of the DPA MLE.1 Machine Learning Requirements Analysis MLE.3 Machine Learning Training BB-DPA-2 Section 2 - Interpretation BB-DPA-20 Sections 50-60 - Registration and Responsibilities CPG-5.A Vulnerability Disclosure Program CPG-6.B Supply Chain Incident Reporting CA-ITSG33-SC-01 Security Control Catalogue CA-ITSG33-SC-03 Cloud Security IS.D.OR.205 Information Security Risk Assessment IS.I.OR.205 Information Security Risk Assessment FFIEC-05 Roles and responsibilities definition FFIEC-10 Secure configuration standards FDBR-702 Definitions (§501.702) FDBR-Scope-Defs Scope, Applicability Thresholds and Definitions (Fla. Stat. 501.701, 501.702, 501.703, 501.704) ICAO-ANX17-Chap2-ThreatAssessment-RiskManagement-Cyber-GASeP ICAO Annex 17 Chapter 2 - Threat Assessment + Risk Management + Cyber Threats to Critical Aviation Systems (Amendment 17/18) ICAO-ANX17-Chap4-Cargo-Mail-Catering-Stores-Supplies-RegulatedAgent-KnownConsignor ICAO Annex 17 Chapter 4 - Cargo + Mail + Catering + Stores + Supplies Security + Regulated Agent + Known Consignor + Supply Chain 60601-1.3 Terminology and definitions 60601-1.4.1 General requirements ISO-20400-4.2 Principles of sustainable procurement ISO-20400-7.2 Integrating sustainability into specifications ISO-41001-4.1 Understanding the organization and its context ISO-41001-4.3 Determining the scope of the FM management system ISO-56002-4.3 Determining the scope of the innovation management system ISO-56002-8.3.4 Develop solutions ISO8000-DQM-02 Data Quality Dimensions ISO8000-MDG-03 Continuous Improvement ISO-17025-5.1 Legal entity ISO-17025-5.4 Personnel for the management system ISO20000-06 Change management processes ISO20000-10 Configuration management ISO-25012-5.2 Defining data quality measures ISO-25012-5.3 Planning and performing data quality evaluations 27014-1 Scope 27014-3 Terms and definitions 27031-5.1 IRBC Policy 27031-7.2 Resource Requirements ISO27043-04 Roles and responsibilities definition ISO27043-25 Technical vulnerability management 27400-3 Terms and definitions 27400-6.4 Default Configuration Security ISO21434-04 Roles and responsibilities definition ISO21434-25 Technical vulnerability management ITIL4-06 Change management processes ITIL4-10 Configuration management STANAG-1 STANAG 4774 Confidentiality Label Schema and XML Structure STANAG-2 STANAG 4778 Metadata Binding Mechanism and Cryptographic Binding NISTSP34-1 Contingency Planning Policy, Programme, and Plan Coordination NISTSP34-2 Business Impact Analysis (BIA): Critical Resources, Recovery Priorities NDPA-2 Consumer Rights - Access, Correct, Delete, Portability, Appeal NDPA-5 Privacy Notice, Data Minimisation, and Purpose Limitation OWASPMASVS-6 MASVS-CODE: Code Quality, Build Settings, and Updates OWASPMASVS-8 MASVS-PRIVACY: Privacy and Data Protection PAKPDPB-7 NCPDP, Registration, Records, Processor Contracts, DPO PAKPDPB-8 Enforcement, Penalties, Complaints, Retention, Training 2.4.4 Hazard Analysis and Risk Assessment 2.7.2 Food Fraud Plan C1 Organizational Boundary C3 Scope 1 and 2 Coverage PIPA-CPO-DPO-Privacy-Officer-PIA-Personal-Information-Impact-Assessment-Articles-31-33 Korea PIPA CPO + DPO + Privacy Officer + PIA + Personal Information Impact Assessment + Articles 31-33 PIPA-Data-Subject-Rights-Access-Correction-Erasure-Portability-Automated-Decisions-Articles-35-37-2 Korea PIPA Data Subject Rights + Access + Correction + Erasure + Portability + Article 35-37 CRM-1 AML/CFT Compliance CRM-4 Business Risk Assessment VIETNAMCYBER-2 Prohibited Acts (Access, Interception, Forgery, Content) VIETNAMCYBER-4 Incident Reporting and Cooperation CFR211-A-3 Section 211.3 - Definitions AMLCTF-PartA-RiskAssess ML/TF Risk Assessment CPS230-11 Identification, Assessment and Management of Operational Risk AS9100D-8.1 Operational Planning and Control AZ-DPA-2 Article 2 - Basic Concepts COBIT-BAI02 Managed requirements definition CAT-D3-3 Corrective controls CA-9 Internal System Connections CA-9 Internal System Connections UAE-PDPL-Art.18_19_20_21 Security measures, controller/processor relationship, DPIA (UAE PDPL Articles 18-21) ICP-1 Objectives, Powers and Responsibilities of the Supervisor IATA-IOSA-Section1-ORG-Organization-ManagementSystem-SMS IATA IOSA Section 1 - ORG Organization and Management System + Safety Management System (SMS) + Safety Policy + Hazard ID + Quality 62351-2 Glossary of terms ISO-14064-1-5.1 Organizational boundaries ISO-22313-8.2 Business impact analysis and risk assessment ISO27799-06 Security management process and risk analysis ISO28001-PI-01 Personnel Security Screening ISO30401-18 Innovation and change management 27007-5.2 Audit Programme Objectives 27050-1.4 Terms and definitions 29115-3 Terms and definitions BIPA-SEC5-1 Biometric Identifier Definition NFPA1600-5.1 Risk Assessment NISTPF-8 Protect-P Information Protection Processes (PR.PO-P) NJDPA-7 Data Protection Assessments and Processor Contracts NGOB-1 Open Banking Registry Participation, Tiered Categorisation, and KYP AUNDB-A3 Eligible Data Breach Determination and Serious Harm Threshold OCCHS-1 Scope, Applicability, and Definitions of Heightened Standards OWASPAPI-6 Security Misconfiguration and Secure API Design 2.2.2 2.2.2 Vendor default accounts managed AUPRV-6 Sensitive Information, PIA, Privacy by Design, Children PSPF24-1 Security Culture, Governance, Risk Management EHDSREG-1 Mandatory Requirements for EHR Systems (Articles 14-29) SWIFTCSCF-1 Restrict Internet Access and Protect Critical Systems (Objective 1) TEFCAREC-1 Common Agreement Conformance and Onboarding TURKEYKVKK-3 Special Categories and Sensitive Data UNGPBHR-2 Pillar II: Corporate Responsibility to Respect Human Rights CPSC-RA.3 Lifecycle Risk Assessment 15 U.S.C. § 78dd-2(h) Definition of Domestic Concern USMCADIGITAL-1 Cross-Border Data Flows and Localisation VERMONTAICDA-4 Vermont AG Enforcement and Cure W3CVCDM-1 Three-Party Ecosystem (Issuer, Holder, Verifier) Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Query this from an agent The graph holds this control, the 328 it maps to, and the evidence behind each claim, over MCP and REST.