NIST SP 800-190
NIST SP 800-190: Cloud Operations & Monitoring

NIST SP 800-190 NIST190-24: Cloud change management

Cloud change management. Control from NIST SP 800-190 framework, domain: NIST SP 800-190: Cloud Operations & Monitoring.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 34 controls across 22 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

  • IEC62304-8.2 Change Control
  • IEC62304-9.4 Use Change Control Process
  • NISTSP82-5 OT Configuration Management, Patching, Vulnerability Management, and Malware Protection
  • NISTSP82-6 OT Audit, Monitoring, Anomaly Detection, and OT-Specific SOC

SASB Standards · 2 controls

  • SASB-1 Business Model + Innovation (BMI)
  • SASB-BMI-5 Physical Impacts of Climate Change
  • SSAE18-CC3.4 CC3.4 - COSO Principle 9: Change Management
  • SSAE18-CC8.1 CC8.1 - Infrastructure and Software Change Management

API 1164 · 1 control

  • API1164-23 Change management procedures
  • Clause 10 Change and configuration management

BSI IT-Grundschutz · 1 control

  • BSI-24 Configuration change control
  • FTC-Safeguards-9-Elements 9 Safeguard Elements - Access, Inventory, Encryption, Secure-Dev, MFA, Disposal, Change-Mgmt, Monitoring, Pen-Test (16 CFR 314.4(c))

IEC 62443 · 1 control

  • IEC62443-23 Change management procedures
  • ISO-26262-8-8 Change management

ISO 30401 · 1 control

  • ISO30401-18 Innovation and change management
  • ISO20000-06 Change management processes

ISO/IEC 27019:2024 · 1 control

  • ISO27019-23 Change management procedures

ITIL 4 · 1 control

  • ITIL4-06 Change management processes
  • NISTPF-8 Protect-P Information Protection Processes (PR.PO-P)

NIST SP 1800-32 · 1 control

  • NRFCS-1 Retail Cybersecurity Governance, Policy, and Regulatory Change Management

SOC 2 · 1 control

  • SOC2-CC8.1 CC8.1 Managing changes to procedures, software, data and infrastructure

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in NIST SP 800-190: Cloud Operations & Monitoring

Query this from an agent

The graph holds this control, the 34 it maps to, and the evidence behind each claim, over MCP and REST.