TheArtOfService
Back to Frameworks

NIST Cybersecurity Framework 1.0

Self-Assess
United States (NIST); used internationally
vVersion 1.0, 12 February 2014; superseded by Version 1.1 on 16 April 2018
22 domains
98 controls

NIST's Framework for Improving Critical Infrastructure Cybersecurity, Version 1.0 (February 2014): the five Functions, 22 Categories and 98 Subcategories in the Version 1.0 wording, each marked as kept or reworded in Version 1.1. Superseded in April 2018; kept for historic assessments and contracts that cite it.

Verified

NIST Cybersecurity Framework 1.0 is a compliance framework from United States (NIST); used internationally with 22 domains and 98 controls that map to 1 other frameworks. The largest domains are Information Protection Processes and Procedures (PR.IP) – NIST Cybersecurity Framework 1.0 (12 controls), Security Continuous Monitoring (DE.CM) – NIST Cybersecurity Framework 1.0 (8 controls), Data Security (PR.DS) – NIST Cybersecurity Framework 1.0 (7 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard Blokdyk

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (22)

Access Control (PR.AC) – NIST Cybersecurity Framework 1.0

5 controls
Controls in the Access Control (PR.AC) – NIST Cybersecurity Framework 1.0 domain of NIST Cybersecurity Framework 1.0 — 5 controls
CodeTitle
nist-cybersecurity-framework-1-0::PR.AC-1PR.AC-1: Identities and credentials are managed for authorized devices and users
nist-cybersecurity-framework-1-0::PR.AC-2PR.AC-2: Physical access to assets is managed and protected
nist-cybersecurity-framework-1-0::PR.AC-3PR.AC-3: Remote access is managed
nist-cybersecurity-framework-1-0::PR.AC-4PR.AC-4: Access permissions are managed, incorporating the principles of least privilege and separation of duties
nist-cybersecurity-framework-1-0::PR.AC-5PR.AC-5: Network integrity is protected, incorporating network segregation where appropriate

Analysis (RS.AN) – NIST Cybersecurity Framework 1.0

4 controls
Controls in the Analysis (RS.AN) – NIST Cybersecurity Framework 1.0 domain of NIST Cybersecurity Framework 1.0 — 4 controls
CodeTitle
nist-cybersecurity-framework-1-0::RS.AN-1RS.AN-1: Notifications from detection systems are investigated
nist-cybersecurity-framework-1-0::RS.AN-2RS.AN-2: The impact of the incident is understood
nist-cybersecurity-framework-1-0::RS.AN-3RS.AN-3: Forensics are performed
nist-cybersecurity-framework-1-0::RS.AN-4RS.AN-4: Incidents are categorized consistent with response plans

Anomalies and Events (DE.AE) – NIST Cybersecurity Framework 1.0

5 controls
Controls in the Anomalies and Events (DE.AE) – NIST Cybersecurity Framework 1.0 domain of NIST Cybersecurity Framework 1.0 — 5 controls
CodeTitle
nist-cybersecurity-framework-1-0::DE.AE-1DE.AE-1: A baseline of network operations and expected data flows for users and systems is established and managed
nist-cybersecurity-framework-1-0::DE.AE-2DE.AE-2: Detected events are analyzed to understand attack targets and methods
nist-cybersecurity-framework-1-0::DE.AE-3DE.AE-3: Event data are aggregated and correlated from multiple sources and sensors
nist-cybersecurity-framework-1-0::DE.AE-4DE.AE-4: Impact of events is determined
nist-cybersecurity-framework-1-0::DE.AE-5DE.AE-5: Incident alert thresholds are established

Asset Management (ID.AM) – NIST Cybersecurity Framework 1.0

6 controls
Controls in the Asset Management (ID.AM) – NIST Cybersecurity Framework 1.0 domain of NIST Cybersecurity Framework 1.0 — 6 controls
CodeTitle
nist-cybersecurity-framework-1-0::ID.AM-1ID.AM-1: Physical devices and systems within the organization are inventoried
nist-cybersecurity-framework-1-0::ID.AM-2ID.AM-2: Software platforms and applications within the organization are inventoried
nist-cybersecurity-framework-1-0::ID.AM-3ID.AM-3: Organizational communication and data flows are mapped
nist-cybersecurity-framework-1-0::ID.AM-4ID.AM-4: External information systems are catalogued
nist-cybersecurity-framework-1-0::ID.AM-5ID.AM-5: Resources (e.g., hardware, devices, data, and software) are prioritized based on their classification, criticality, and business value
nist-cybersecurity-framework-1-0::ID.AM-6ID.AM-6: Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established

Awareness and Training (PR.AT) – NIST Cybersecurity Framework 1.0

5 controls
Controls in the Awareness and Training (PR.AT) – NIST Cybersecurity Framework 1.0 domain of NIST Cybersecurity Framework 1.0 — 5 controls
CodeTitle
nist-cybersecurity-framework-1-0::PR.AT-1PR.AT-1: All users are informed and trained
nist-cybersecurity-framework-1-0::PR.AT-2PR.AT-2: Privileged users understand roles & responsibilities
nist-cybersecurity-framework-1-0::PR.AT-3PR.AT-3: Third-party stakeholders (e.g., suppliers, customers, partners) understand roles & responsibilities
nist-cybersecurity-framework-1-0::PR.AT-4PR.AT-4: Senior executives understand roles & responsibilities
nist-cybersecurity-framework-1-0::PR.AT-5PR.AT-5: Physical and information security personnel understand roles & responsibilities

Business Environment (ID.BE) – NIST Cybersecurity Framework 1.0

5 controls
Controls in the Business Environment (ID.BE) – NIST Cybersecurity Framework 1.0 domain of NIST Cybersecurity Framework 1.0 — 5 controls
CodeTitle
nist-cybersecurity-framework-1-0::ID.BE-1ID.BE-1: The organization's role in the supply chain is identified and communicated
nist-cybersecurity-framework-1-0::ID.BE-2ID.BE-2: The organization's place in critical infrastructure and its industry sector is identified and communicated
nist-cybersecurity-framework-1-0::ID.BE-3ID.BE-3: Priorities for organizational mission, objectives, and activities are established and communicated
nist-cybersecurity-framework-1-0::ID.BE-4ID.BE-4: Dependencies and critical functions for delivery of critical services are established
nist-cybersecurity-framework-1-0::ID.BE-5ID.BE-5: Resilience requirements to support delivery of critical services are established

Communications (RC.CO) – NIST Cybersecurity Framework 1.0

3 controls
Controls in the Communications (RC.CO) – NIST Cybersecurity Framework 1.0 domain of NIST Cybersecurity Framework 1.0 — 3 controls
CodeTitle
nist-cybersecurity-framework-1-0::RC.CO-1RC.CO-1: Public relations are managed
nist-cybersecurity-framework-1-0::RC.CO-2RC.CO-2: Reputation after an event is repaired
nist-cybersecurity-framework-1-0::RC.CO-3RC.CO-3: Recovery activities are communicated to internal stakeholders and executive and management teams

Communications (RS.CO) – NIST Cybersecurity Framework 1.0

5 controls
Controls in the Communications (RS.CO) – NIST Cybersecurity Framework 1.0 domain of NIST Cybersecurity Framework 1.0 — 5 controls
CodeTitle
nist-cybersecurity-framework-1-0::RS.CO-1RS.CO-1: Personnel know their roles and order of operations when a response is needed
nist-cybersecurity-framework-1-0::RS.CO-2RS.CO-2: Events are reported consistent with established criteria
nist-cybersecurity-framework-1-0::RS.CO-3RS.CO-3: Information is shared consistent with response plans
nist-cybersecurity-framework-1-0::RS.CO-4RS.CO-4: Coordination with stakeholders occurs consistent with response plans
nist-cybersecurity-framework-1-0::RS.CO-5RS.CO-5: Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness

Data Security (PR.DS) – NIST Cybersecurity Framework 1.0

7 controls
Controls in the Data Security (PR.DS) – NIST Cybersecurity Framework 1.0 domain of NIST Cybersecurity Framework 1.0 — 7 controls
CodeTitle
nist-cybersecurity-framework-1-0::PR.DS-1PR.DS-1: Data-at-rest is protected
nist-cybersecurity-framework-1-0::PR.DS-2PR.DS-2: Data-in-transit is protected
nist-cybersecurity-framework-1-0::PR.DS-3PR.DS-3: Assets are formally managed throughout removal, transfers, and disposition
nist-cybersecurity-framework-1-0::PR.DS-4PR.DS-4: Adequate capacity to ensure availability is maintained
nist-cybersecurity-framework-1-0::PR.DS-5PR.DS-5: Protections against data leaks are implemented
nist-cybersecurity-framework-1-0::PR.DS-6PR.DS-6: Integrity checking mechanisms are used to verify software, firmware, and information integrity
nist-cybersecurity-framework-1-0::PR.DS-7PR.DS-7: The development and testing environment(s) are separate from the production environment

Detection Processes (DE.DP) – NIST Cybersecurity Framework 1.0

5 controls
Controls in the Detection Processes (DE.DP) – NIST Cybersecurity Framework 1.0 domain of NIST Cybersecurity Framework 1.0 — 5 controls
CodeTitle
nist-cybersecurity-framework-1-0::DE.DP-1DE.DP-1: Roles and responsibilities for detection are well defined to ensure accountability
nist-cybersecurity-framework-1-0::DE.DP-2DE.DP-2: Detection activities comply with all applicable requirements
nist-cybersecurity-framework-1-0::DE.DP-3DE.DP-3: Detection processes are tested
nist-cybersecurity-framework-1-0::DE.DP-4DE.DP-4: Event detection information is communicated to appropriate parties
nist-cybersecurity-framework-1-0::DE.DP-5DE.DP-5: Detection processes are continuously improved

Governance (ID.GV) – NIST Cybersecurity Framework 1.0

4 controls
Controls in the Governance (ID.GV) – NIST Cybersecurity Framework 1.0 domain of NIST Cybersecurity Framework 1.0 — 4 controls
CodeTitle
nist-cybersecurity-framework-1-0::ID.GV-1ID.GV-1: Organizational information security policy is established
nist-cybersecurity-framework-1-0::ID.GV-2ID.GV-2: Information security roles & responsibilities are coordinated and aligned with internal roles and external partners
nist-cybersecurity-framework-1-0::ID.GV-3ID.GV-3: Legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations, are understood and managed
nist-cybersecurity-framework-1-0::ID.GV-4ID.GV-4: Governance and risk management processes address cybersecurity risks

Improvements (RC.IM) – NIST Cybersecurity Framework 1.0

2 controls
Controls in the Improvements (RC.IM) – NIST Cybersecurity Framework 1.0 domain of NIST Cybersecurity Framework 1.0 — 2 controls
CodeTitle
nist-cybersecurity-framework-1-0::RC.IM-1RC.IM-1: Recovery plans incorporate lessons learned
nist-cybersecurity-framework-1-0::RC.IM-2RC.IM-2: Recovery strategies are updated

Improvements (RS.IM) – NIST Cybersecurity Framework 1.0

2 controls
Controls in the Improvements (RS.IM) – NIST Cybersecurity Framework 1.0 domain of NIST Cybersecurity Framework 1.0 — 2 controls
CodeTitle
nist-cybersecurity-framework-1-0::RS.IM-1RS.IM-1: Response plans incorporate lessons learned
nist-cybersecurity-framework-1-0::RS.IM-2RS.IM-2: Response strategies are updated

Information Protection Processes and Procedures (PR.IP) – NIST Cybersecurity Framework 1.0

12 controls
Controls in the Information Protection Processes and Procedures (PR.IP) – NIST Cybersecurity Framework 1.0 domain of NIST Cybersecurity Framework 1.0 — 12 controls
CodeTitle
nist-cybersecurity-framework-1-0::PR.IP-1PR.IP-1: A baseline configuration of information technology/industrial control systems is created and maintained
nist-cybersecurity-framework-1-0::PR.IP-10PR.IP-10: Response and recovery plans are tested
nist-cybersecurity-framework-1-0::PR.IP-11PR.IP-11: Cybersecurity is included in human resources practices (e.g., deprovisioning, personnel screening)
nist-cybersecurity-framework-1-0::PR.IP-12PR.IP-12: A vulnerability management plan is developed and implemented
nist-cybersecurity-framework-1-0::PR.IP-2PR.IP-2: A System Development Life Cycle to manage systems is implemented
nist-cybersecurity-framework-1-0::PR.IP-3PR.IP-3: Configuration change control processes are in place
nist-cybersecurity-framework-1-0::PR.IP-4PR.IP-4: Backups of information are conducted, maintained, and tested periodically
nist-cybersecurity-framework-1-0::PR.IP-5PR.IP-5: Policy and regulations regarding the physical operating environment for organizational assets are met
nist-cybersecurity-framework-1-0::PR.IP-6PR.IP-6: Data is destroyed according to policy
nist-cybersecurity-framework-1-0::PR.IP-7PR.IP-7: Protection processes are continuously improved
nist-cybersecurity-framework-1-0::PR.IP-8PR.IP-8: Effectiveness of protection technologies is shared with appropriate parties
nist-cybersecurity-framework-1-0::PR.IP-9PR.IP-9: Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed

Maintenance (PR.MA) – NIST Cybersecurity Framework 1.0

2 controls
Controls in the Maintenance (PR.MA) – NIST Cybersecurity Framework 1.0 domain of NIST Cybersecurity Framework 1.0 — 2 controls
CodeTitle
nist-cybersecurity-framework-1-0::PR.MA-1PR.MA-1: Maintenance and repair of organizational assets is performed and logged in a timely manner, with approved and controlled tools
nist-cybersecurity-framework-1-0::PR.MA-2PR.MA-2: Remote maintenance of organizational assets is approved, logged, and performed in a manner that prevents unauthorized access

Mitigation (RS.MI) – NIST Cybersecurity Framework 1.0

3 controls
Controls in the Mitigation (RS.MI) – NIST Cybersecurity Framework 1.0 domain of NIST Cybersecurity Framework 1.0 — 3 controls
CodeTitle
nist-cybersecurity-framework-1-0::RS.MI-1RS.MI-1: Incidents are contained
nist-cybersecurity-framework-1-0::RS.MI-2RS.MI-2: Incidents are mitigated
nist-cybersecurity-framework-1-0::RS.MI-3RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks

Protective Technology (PR.PT) – NIST Cybersecurity Framework 1.0

4 controls
Controls in the Protective Technology (PR.PT) – NIST Cybersecurity Framework 1.0 domain of NIST Cybersecurity Framework 1.0 — 4 controls
CodeTitle
nist-cybersecurity-framework-1-0::PR.PT-1PR.PT-1: Audit/log records are determined, documented, implemented, and reviewed in accordance with policy
nist-cybersecurity-framework-1-0::PR.PT-2PR.PT-2: Removable media is protected and its use restricted according to policy
nist-cybersecurity-framework-1-0::PR.PT-3PR.PT-3: Access to systems and assets is controlled, incorporating the principle of least functionality
nist-cybersecurity-framework-1-0::PR.PT-4PR.PT-4: Communications and control networks are protected

Recovery Planning (RC.RP) – NIST Cybersecurity Framework 1.0

1 controls
Controls in the Recovery Planning (RC.RP) – NIST Cybersecurity Framework 1.0 domain of NIST Cybersecurity Framework 1.0 — 1 controls
CodeTitle
nist-cybersecurity-framework-1-0::RC.RP-1RC.RP-1: Recovery plan is executed during or after an event

Response Planning (RS.RP) – NIST Cybersecurity Framework 1.0

1 controls
Controls in the Response Planning (RS.RP) – NIST Cybersecurity Framework 1.0 domain of NIST Cybersecurity Framework 1.0 — 1 controls
CodeTitle
nist-cybersecurity-framework-1-0::RS.RP-1RS.RP-1: Response plan is executed during or after an event

Risk Assessment (ID.RA) – NIST Cybersecurity Framework 1.0

6 controls
Controls in the Risk Assessment (ID.RA) – NIST Cybersecurity Framework 1.0 domain of NIST Cybersecurity Framework 1.0 — 6 controls
CodeTitle
nist-cybersecurity-framework-1-0::ID.RA-1ID.RA-1: Asset vulnerabilities are identified and documented
nist-cybersecurity-framework-1-0::ID.RA-2ID.RA-2: Threat and vulnerability information is received from information sharing forums and sources
nist-cybersecurity-framework-1-0::ID.RA-3ID.RA-3: Threats, both internal and external, are identified and documented
nist-cybersecurity-framework-1-0::ID.RA-4ID.RA-4: Potential business impacts and likelihoods are identified
nist-cybersecurity-framework-1-0::ID.RA-5ID.RA-5: Threats, vulnerabilities, likelihoods, and impacts are used to determine risk
nist-cybersecurity-framework-1-0::ID.RA-6ID.RA-6: Risk responses are identified and prioritized

Risk Management Strategy (ID.RM) – NIST Cybersecurity Framework 1.0

3 controls
Controls in the Risk Management Strategy (ID.RM) – NIST Cybersecurity Framework 1.0 domain of NIST Cybersecurity Framework 1.0 — 3 controls
CodeTitle
nist-cybersecurity-framework-1-0::ID.RM-1ID.RM-1: Risk management processes are established, managed, and agreed to by organizational stakeholders
nist-cybersecurity-framework-1-0::ID.RM-2ID.RM-2: Organizational risk tolerance is determined and clearly expressed
nist-cybersecurity-framework-1-0::ID.RM-3ID.RM-3: The organization's determination of risk tolerance is informed by its role in critical infrastructure and sector specific risk analysis

Security Continuous Monitoring (DE.CM) – NIST Cybersecurity Framework 1.0

8 controls
Controls in the Security Continuous Monitoring (DE.CM) – NIST Cybersecurity Framework 1.0 domain of NIST Cybersecurity Framework 1.0 — 8 controls
CodeTitle
nist-cybersecurity-framework-1-0::DE.CM-1DE.CM-1: The network is monitored to detect potential cybersecurity events
nist-cybersecurity-framework-1-0::DE.CM-2DE.CM-2: The physical environment is monitored to detect potential cybersecurity events
nist-cybersecurity-framework-1-0::DE.CM-3DE.CM-3: Personnel activity is monitored to detect potential cybersecurity events
nist-cybersecurity-framework-1-0::DE.CM-4DE.CM-4: Malicious code is detected
nist-cybersecurity-framework-1-0::DE.CM-5DE.CM-5: Unauthorized mobile code is detected
nist-cybersecurity-framework-1-0::DE.CM-6DE.CM-6: External service provider activity is monitored to detect potential cybersecurity events
nist-cybersecurity-framework-1-0::DE.CM-7DE.CM-7: Monitoring for unauthorized personnel, connections, devices, and software is performed
nist-cybersecurity-framework-1-0::DE.CM-8DE.CM-8: Vulnerability scans are performed

Maps to 1 other framework

98 total controls
NIST Cybersecurity Framework 2.0
98 source controls mapped|72 target controls covered
100%
Compare NIST Cybersecurity Framework 1.0 with NIST Cybersecurity Framework 2.0

Coverage is not the same as your position

This page shows what NIST Cybersecurity Framework 1.0 overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.

The Compliance Position Diagnostic, $5,000 fixed, ten business days

What is NIST Cybersecurity Framework 1.0 and who does it apply to?

NIST Cybersecurity Framework 1.0 is a compliance framework from United States (NIST); used internationally with 22 domains and 98 controls. NIST's Framework for Improving Critical Infrastructure Cybersecurity, Version 1.0 (February 2014): the five Functions, 22 Categories and 98 Subcategories in the Version 1.0 wording, each marked as kept or reworded in Version 1.1. Superseded in April 2018; kept for historic assessments and contracts that cite it. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does NIST Cybersecurity Framework 1.0 actually require?

NIST Cybersecurity Framework 1.0 has 98 controls organised across 22 domains. The largest domains are Information Protection Processes and Procedures (PR.IP) – NIST Cybersecurity Framework 1.0 (12 controls), Security Continuous Monitoring (DE.CM) – NIST Cybersecurity Framework 1.0 (8 controls), Data Security (PR.DS) – NIST Cybersecurity Framework 1.0 (7 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of NIST Cybersecurity Framework 1.0 do I already cover?

NIST Cybersecurity Framework 1.0 maps to 1 other compliance frameworks. The top mapping partners are NIST Cybersecurity Framework 2.0 (100% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I implement NIST Cybersecurity Framework 1.0?

Start your NIST Cybersecurity Framework 1.0 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about NIST Cybersecurity Framework 1.0 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 98 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 849 frameworks.

Get Started Free →

Free forever — no credit card required