NIST SP 800-181

United States

vRevision 1 (November 2020), components v1.0.0 (March 2024)

7 domains

52 controls

Workforce Framework for Cybersecurity (NICE Framework). Defines the cybersecurity work of an organization as Work Roles built from Task, Knowledge and Skill statements. This node models the 52 Work Roles across 7 Work Role Categories published in NICE Framework Components v1.0.0, the enumerated list referenced by SP 800-181r1.

Verified

NIST SP 800-181 is a compliance framework from United States with 7 domains and 52 controls that map to 18 other frameworks. The largest domains are Oversight and Governance (OG) (16 controls), Design and Development (DD) (8 controls), Cyberspace Effects (CE) (7 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (7)

Cyberspace Effects (CE)

7 controls

Controls in the Cyberspace Effects (CE) domain of NIST SP 800-181 — 7 controls
Code	Title	Description
NICE-CE-WRL-001	Cyberspace Operations	Conducts operations to gather evidence on hostile entities and to counter real-time or potential threats.
NICE-CE-WRL-002	Cyber Operations Planning	Develops cyber operations plans, contributes to target selection and validation, and integrates the effort across partne...
NICE-CE-WRL-003	Exploitation Analysis	Identifies access and collection gaps that could be met through cyber collection and prepares the way to close them.
NICE-CE-WRL-004	Mission Assessment	Builds assessment plans and performance measures and judges whether cyber activity actually achieved its effect.
NICE-CE-WRL-005	Partner Integration Planning	Advances cooperation across organizational and national boundaries between cyber operations partners.
NICE-CE-WRL-006	Target Analysis	Conducts target development at system, component and entity level and maintains the supporting target records.
NICE-CE-WRL-007	Target Network Analysis	Conducts advanced analysis of collection and open-source data to profile targets and maintain continuity of understandin...

Cyberspace Intelligence (CI)

5 controls

Controls in the Cyberspace Intelligence (CI) domain of NIST SP 800-181 — 5 controls
Code	Title	Description
NICE-CI-WRL-001	All-Source Analysis	Analyses information from multiple sources to prepare the operational picture and answer intelligence requests.
NICE-CI-WRL-002	All-Source Collection Management	Identifies collection authorities and environment and drives priority requirements into collection strategy.
NICE-CI-WRL-003	All-Source Collection Requirements Management	Evaluates collection operations and builds effects-based requirement strategies from what is actually available.
NICE-CI-WRL-004	Cyber Intelligence Planning	Develops the intelligence plans that satisfy cyber operation requirements and levies requirements onto collection.
NICE-CI-WRL-005	Multi-Disciplined Language Analysis	Applies language and cultural expertise alongside technical knowledge to process and analyse intelligence material.

Design and Development (DD)

8 controls

Controls in the Design and Development (DD) domain of NIST SP 800-181 — 8 controls
Code	Title	Description
NICE-DD-WRL-001	Cybersecurity Architecture	Ensures security requirements are carried into enterprise architecture, reference models and solution designs.
NICE-DD-WRL-002	Enterprise Architecture	Maintains the business, systems and information architecture that the organization builds to, and the rules that govern...
NICE-DD-WRL-003	Secure Software Development	Builds and maintains applications and utility software with security properties established during construction rather t...
NICE-DD-WRL-004	Secure Systems Development	Designs, develops and tests systems securely and evaluates system security across the development life cycle.
NICE-DD-WRL-005	Software Security Assessment	Analyses applications and utility software for security weakness and delivers findings that can actually be acted on.
NICE-DD-WRL-006	Systems Requirements Planning	Translates business need into system requirements and makes sure security policy lands inside those requirements.
NICE-DD-WRL-007	Systems Testing and Evaluation	Plans and runs system tests and reports results honestly against specification and requirement.
NICE-DD-WRL-008	Technology Research and Development	Researches and engineers new capability with security integrated from the outset rather than retrofitted.

Implementation and Operation (IO)

7 controls

Controls in the Implementation and Operation (IO) domain of NIST SP 800-181 — 7 controls
Code	Title	Description
NICE-IO-WRL-001	Data Analysis	Analyses data from disparate sources to produce cybersecurity and privacy insight, including building the algorithms tha...
NICE-IO-WRL-002	Database Administration	Administers databases and data management systems so that data is stored, queried and protected reliably.
NICE-IO-WRL-003	Knowledge Management	Manages the processes and tools by which the organization captures and finds its own intellectual capital.
NICE-IO-WRL-004	Network Operations	Plans, implements and operates network services and systems across physical and virtual environments.
NICE-IO-WRL-005	Systems Administration	Sets up and maintains systems and their components in line with organizational security policy and procedure.
NICE-IO-WRL-006	Systems Security Analysis	Analyses how security integrates through system integration, testing, operation and maintenance, and manages that securi...
NICE-IO-WRL-007	Technical Support	Provides technical support to users on client hardware and software within established policy, and is a first line for s...

Investigation (IN)

2 controls

Controls in the Investigation (IN) domain of NIST SP 800-181 — 2 controls
Code	Title	Description
NICE-IN-WRL-001	Cybercrime Investigation	Investigates intrusion incidents and crimes using the full investigative tradecraft, to a standard that supports action.
NICE-IN-WRL-002	Digital Evidence Analysis	Identifies, collects, examines and preserves digital evidence under controlled and documented technique.

Oversight and Governance (OG)

16 controls

Controls in the Oversight and Governance (OG) domain of NIST SP 800-181 — 16 controls
Code	Title	Description
NICE-OG-WRL-001	Communications Security (COMSEC) Management	Owns the organization's COMSEC holdings and the accounting, handling and destruction discipline that keeps keying materi...
NICE-OG-WRL-002	Cybersecurity Policy and Planning	Writes and maintains the cybersecurity policy and strategy set and keeps it aligned to organizational direction and exte...
NICE-OG-WRL-003	Cybersecurity Workforce Management	Plans the cybersecurity workforce: what capability is needed, what exists, and how the gap is closed through hiring and...
NICE-OG-WRL-004	Cybersecurity Curriculum Development	Designs the content, methods and assessment for cybersecurity awareness, training and education, grounded in what the ro...
NICE-OG-WRL-005	Cybersecurity Instruction	Delivers cybersecurity awareness, training and education and is accountable for whether learners can actually do the thi...
NICE-OG-WRL-006	Cybersecurity Legal Advice	Provides legal advice on cybersecurity matters and tracks the legislation and regulation that changes what the organizat...
NICE-OG-WRL-007	Executive Cybersecurity Leadership	Sets direction and holds accountability for cybersecurity across the organization, including its effect on physical as w...
NICE-OG-WRL-008	Privacy Compliance	Runs the privacy compliance programme, including the assessments and records that show personal information is handled l...
NICE-OG-WRL-009	Product Support Management	Plans and manages the support strategy that keeps a fielded capability sustainable, including its security sustainment o...
NICE-OG-WRL-010	Program Management	Leads a defined programme end to end and is accountable for its outcome, including keeping it aligned to organizational...
NICE-OG-WRL-011	Secure Project Management	Manages technology projects and is accountable for cybersecurity being built in rather than added after delivery.
NICE-OG-WRL-012	Security Control Assessment	Independently assesses management, operational and technical controls and reports whether they are actually working.
NICE-OG-WRL-013	Systems Authorization	Decides whether a system may operate at the residual risk it carries, and owns that decision.
NICE-OG-WRL-014	Systems Security Management	Manages the day-to-day cybersecurity of a defined system, programme or enclave and is the accountable point for it.
NICE-OG-WRL-015	Technology Portfolio Management	Manages the portfolio of technology investment so that what is funded matches mission and enterprise priority.
NICE-OG-WRL-016	Technology Program Auditing	Audits technology programmes or their components against published standards and reports the compliance position.

Protection and Defense (PD)

7 controls

Controls in the Protection and Defense (PD) domain of NIST SP 800-181 — 7 controls
Code	Title	Description
NICE-PD-WRL-001	Defensive Cybersecurity	Analyses output from defensive tooling and turns it into risk reduction rather than an alert backlog.
NICE-PD-WRL-002	Digital Forensics	Analyses digital evidence from security incidents to establish what happened, in a way that survives scrutiny.
NICE-PD-WRL-003	Incident Response	Investigates, analyses and responds to incidents on the network and drives them to genuine closure.
NICE-PD-WRL-004	Infrastructure Support	Tests, deploys, maintains and administers the infrastructure that the cybersecurity capability itself runs on.
NICE-PD-WRL-005	Insider Threat Analysis	Identifies and assesses insider threat activity and produces the findings that start a response.
NICE-PD-WRL-006	Threat Analysis	Collects, processes and analyses threat information and turns it into indicators the organization can defend against.
NICE-PD-WRL-007	Vulnerability Analysis	Assesses systems and networks for deviation from acceptable configuration and policy and measures how effective the defe...

Your Compliance Coverage

If you comply with NIST SP 800-181, you already cover:

NIST SP 800-53 Rev 5

17%

9 controls mapped

Compare →

PCI DSS 4.0

13%

7 controls mapped

Compare →

FedRAMP High

12%

6 controls mapped

Compare →

+ 15 more: NIST SP 800-53 Revision 5.1 HIGH (12%), FedRAMP Moderate (12%)

See all 18 mapped frameworks ↓

Maps to 18 other frameworks

52 total controls

NIST SP 800-53 Rev 5

9 source controls mapped|12 target controls covered

17%

PCI DSS 4.0

7 source controls mapped|6 target controls covered

13%

FedRAMP High

6 source controls mapped|4 target controls covered

12%

NIST SP 800-53 Revision 5.1 HIGH

6 source controls mapped|4 target controls covered

12%

FedRAMP Moderate

6 source controls mapped|4 target controls covered

12%

NIST SP 800-53 Rev 5 MODERATE

6 source controls mapped|4 target controls covered

12%

NIST SP 800-53 Rev 5 LOW

6 source controls mapped|4 target controls covered

12%

CIS Controls v8

6 source controls mapped|5 target controls covered

12%

ISO 27002:2022

6 source controls mapped|3 target controls covered

12%

ISO 27001:2022

6 source controls mapped|3 target controls covered

12%

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1

6 source controls mapped|4 target controls covered

12%

SOC 2

5 source controls mapped|2 target controls covered

10%

NIST Cybersecurity Framework 2.0

5 source controls mapped|6 target controls covered

10%

HIPAA Security Rule

5 source controls mapped|2 target controls covered

10%

NIST SP 800-66 Rev 2

5 source controls mapped|2 target controls covered

10%

CMMC 2.0

4 source controls mapped|3 target controls covered

NIST SP 800-171 Rev 3

4 source controls mapped|3 target controls covered

Azure Security Benchmark

3 source controls mapped|1 target controls covered

Compare NIST SP 800-181 with NIST SP 800-53 Rev 5

What is NIST SP 800-181 and who does it apply to?

NIST SP 800-181 is a compliance framework from United States with 7 domains and 52 controls. Workforce Framework for Cybersecurity (NICE Framework). Defines the cybersecurity work of an organization as Work Roles built from Task, Knowledge and Skill statements. This node models the 52 Work Roles across 7 Work Role Categories published in NICE Framework Components v1.0.0, the enumerated list referenced by SP 800-181r1. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does NIST SP 800-181 actually require?

NIST SP 800-181 has 52 controls organised across 7 domains. The largest domains are Oversight and Governance (OG) (16 controls), Design and Development (DD) (8 controls), Cyberspace Effects (CE) (7 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of NIST SP 800-181 do I already cover?

NIST SP 800-181 maps to 18 other compliance frameworks. The top mapping partners are NIST SP 800-53 Rev 5 (17% coverage), PCI DSS 4.0 (13% coverage), FedRAMP High (12% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I implement NIST SP 800-181?

Start your NIST SP 800-181 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about NIST SP 800-181 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 52 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 686 frameworks.

Get Started Free →

Free forever — no credit card required