NIST SP 800-171A - Assessing Security Requirements for Controlled Unclassified Information (CUI) 171A-03.12.01: Security Assessment

What else in your programme already covers this

This control maps to 34 controls across 15 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 5 controls

CCM-A&A-02 Independent Assessments
CCM-A&A-03 Risk Based Planning Assessment
CCM-A&A-04 Requirements Compliance
CCM-A&A-05 Audit Management Process
CCM-STA-11 Internal Compliance Testing

NIST SP 800-53 Rev 5 · 4 controls

NIST800-CA-2 CA-2 Control Assessments
NIST800-CA-6 CA-6 Authorization
NIST800-PM-14 PM-14 Testing, Training, and Monitoring
NIST800-SA-11 SA-11 Developer Testing and Evaluation

PCI DSS 4.0 · 4 controls

11.1.1 11.1.1 Requirement 11 policies and procedures managed
12.4.2 12.4.2 Quarterly reviews that personnel follow security procedures
12.4.2.1 12.4.2.1 Documentation of quarterly operational reviews
12.5.2 12.5.2 Annual and change-driven scope confirmation

FedRAMP High · 3 controls

CA-2 Control Assessments
CA-2(1) Independent Assessors
CA-6 Authorization

FedRAMP Moderate · 3 controls

CA-2 Control Assessments
CA-2(1) Independent Assessors
CA-6 Authorization

ISO 27001:2022 · 3 controls

5.35 Independent review of information security
5.36 Compliance with policies, rules and standards for information security
8.34 Protection of information systems during audit testing

ISO 27002:2022 · 3 controls

5.35 Independent review of information security
5.36 Compliance with policies, rules and standards for information security
8.34 Protection of information systems during audit testing

NIST Cybersecurity Framework 2.0 · 2 controls

NIST-CSF-ID.IM-02 Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties
NIST-CSF-ID.RA-08 Processes for receiving, analyzing, and responding to vulnerability disclosures are established

Azure Security Benchmark · 1 control

PV-2 Audit and enforce secure configurations

CMMC 2.0 · 1 control

CA.L2-3.12.1 Security Control Assessment

HIPAA Security Rule · 1 control

164.308(a)(8) Evaluation (Standard)

ISO 22301:2019 · 1 control

9.2.1 General

NIST SP 800-171 Rev 3 · 1 control

03.12.01 Security Assessment

NIST SP 800-66 Rev 2 · 1 control

164.308(a)(8) Evaluation (Standard)

SOC 2 · 1 control

SOC2-CC4.1 CC4.1 Ongoing and separate evaluations of control (COSO principle 16)

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.