bmad-plus 0.4.4 → 0.6.0

package/src/bmad-plus/packs/pack-shield/references/nis2/article-21-measures.md

@@ -0,0 +1,153 @@
+# NIS2 Article 21 — Cybersecurity Risk Management Measures
+
+Directive (EU) 2022/2555, Art. 21 requires essential and important entities to take "appropriate and proportionate technical, operational and organisational measures" to manage risks and protect network and information systems. Proportionality is assessed against the entity's size, exposure, and the severity of potential impact.
+
+---
+
+## Measure 1 — Risk Analysis & Information Security Policies
+
+**Requirement:** Documented policies covering risk analysis methodology and information security governance.
+
+**Implementation guidance:**
+- Adopt a formal risk management methodology (ISO 27005, NIST RMF, or equivalent)
+- Produce and maintain an asset inventory covering in-scope network and information systems
+- Define risk acceptance criteria aligned to business impact
+- Review risk assessments at least annually and after significant incidents or changes
+- Ensure the management body approves the risk management policy (Art. 20 link)
+
+---
+
+## Measure 2 — Incident Handling
+
+**Requirement:** Procedures for detection, analysis, containment, eradication, and recovery.
+
+**Implementation guidance:**
+- Maintain a written Incident Response Plan (IRP) covering all NIS2 significant incident scenarios
+- Define "significant incident" thresholds in line with Art. 23(3): substantial disruption to service delivery, financial loss to the entity, or material/non-material damage to other natural or legal persons
+- Establish 24h/72h/1-month reporting workflows with pre-drafted notification templates for the national CSIRT or competent authority
+- Conduct post-incident reviews; feed lessons learned back into risk assessment
+- Test IRP at least annually via tabletop exercises or simulations
+
+**Significant incident indicators (Art. 23(3)):**
+- Service disruption affecting a significant number of users
+- Duration > a few hours for critical services
+- Geographic spread affecting other Member States
+- Reputational, financial, or safety impact
+
+---
+
+## Measure 3 — Business Continuity, Backup & Disaster Recovery
+
+**Requirement:** Plans for service continuity, backup management, disaster recovery (DR), and crisis management during and after incidents.
+
+**Implementation guidance:**
+- Define Recovery Time Objective (RTO) and Recovery Point Objective (RPO) per critical service
+- Implement automated, encrypted, offsite backups; test restoration quarterly
+- Maintain DR runbooks and infrastructure failover playbooks
+- Define a crisis management structure with clear roles, decision authorities, and escalation paths
+- Test BCP/DR at least annually; involve management body in crisis management exercises
+
+---
+
+## Measure 4 — Supply Chain Security
+
+**Requirement:** Address security in supply chain relationships, including between entities and their direct suppliers and service providers.
+
+**Implementation guidance:**
+- Maintain a register of critical ICT suppliers and third-party service providers
+- Perform pre-onboarding security assessments (questionnaires, certifications, audits)
+- Include NIS2/security requirements as contractual obligations (right-to-audit, incident notification SLAs, minimum security baselines)
+- Assess supply chain risks as part of the annual risk assessment
+- Monitor ENISA and national authority supply chain risk assessments (Art. 26 coordinated risk assessments)
+- Apply enhanced due diligence to high-risk ICT vendors identified by Member States
+
+---
+
+## Measure 5 — Secure Acquisition, Development & Maintenance
+
+**Requirement:** Security in the acquisition, development, and maintenance of network and information systems, including vulnerability handling and disclosure.
+
+**Implementation guidance:**
+- Apply Secure SDLC practices: threat modelling, code review, SAST/DAST, penetration testing
+- Establish a vulnerability management programme with defined SLAs for patching by severity (e.g., critical ≤ 7 days, high ≤ 30 days)
+- Maintain a coordinated vulnerability disclosure (CVD) policy (aligned with ENISA CVD guidelines)
+- Track CVEs relevant to in-scope systems using threat intelligence feeds
+- Include security acceptance criteria in vendor contracts for purchased systems
+
+---
+
+## Measure 6 — Effectiveness Assessment
+
+**Requirement:** Policies and procedures to assess the effectiveness of cybersecurity risk management measures.
+
+**Implementation guidance:**
+- Define KPIs/KRIs for each Art. 21 measure (e.g., mean time to detect, patch compliance rate, training completion rate)
+- Conduct internal audits or management reviews at least annually
+- Engage independent third-party assessors or penetration testers as appropriate
+- Report effectiveness metrics to the management body
+- Map findings to the risk register and trigger remediation plans
+
+---
+
+## Measure 7 — Cyber Hygiene & Training
+
+**Requirement:** Basic cyber hygiene practices and cybersecurity training for staff.
+
+**Implementation guidance:**
+- Deploy mandatory security awareness training for all staff at least annually
+- Cover: phishing, social engineering, password hygiene, incident reporting, BYOD/remote working
+- Provide role-based training for IT/OT administrators, incident responders, and the management body
+- Management body must complete cybersecurity training specific to Art. 20 governance obligations
+- Track completion rates; address gaps before audit cycles
+
+---
+
+## Measure 8 — Cryptography & Encryption
+
+**Requirement:** Policies and procedures on the use of cryptography and, where appropriate, encryption.
+
+**Implementation guidance:**
+- Define approved cryptographic algorithms (AES-256 for data at rest, TLS 1.2+ for data in transit, SHA-256/SHA-384 for hashing)
+- Establish a key management lifecycle: generation, storage (HSM recommended for critical keys), rotation, and destruction
+- Require encryption of sensitive data stored in cloud environments and on portable media
+- Review cryptographic standards annually given evolving threats (e.g., post-quantum readiness)
+- Document exceptions and compensating controls where encryption is not feasible
+
+---
+
+## Measure 9 — Human Resources Security, Access Control & Asset Management
+
+**Requirement:** HR security, access control policies and asset management.
+
+**Implementation guidance:**
+- Apply least-privilege and need-to-know principles for system access
+- Implement role-based access control (RBAC); review permissions quarterly
+- Conduct background screening for roles with privileged access (subject to applicable employment law)
+- Maintain an authoritative asset inventory (hardware, software, data assets)
+- Enforce joiners/movers/leavers process with same-day revocation for leavers
+- Apply identity lifecycle management; disable dormant accounts after 30–90 days inactivity
+
+---
+
+## Measure 10 — MFA, Secure Communications & Emergency Systems
+
+**Requirement:** Use of multi-factor authentication (MFA) or continuous authentication solutions, secured voice, video, and text communications, and secured emergency communication systems.
+
+**Implementation guidance:**
+- Require MFA for all remote access, privileged accounts, and cloud management consoles
+- Apply phishing-resistant MFA (FIDO2/hardware tokens) for highest-privilege accounts
+- Enforce MFA for email access, VPN, and SaaS platforms holding sensitive data
+- Use end-to-end encrypted channels for sensitive internal communications (e.g., incident coordination)
+- Maintain a separate, documented emergency communication plan with out-of-band channels in case primary systems are compromised
+
+---
+
+## Proportionality Principle
+
+Art. 21(1) requires measures to be "appropriate and proportionate" taking into account:
+- The entity's exposure to risks
+- The entity's size
+- The likelihood and severity of incidents including societal and economic impact
+- The cost of implementation
+
+Essential Entities face more rigorous supervisory scrutiny (Art. 32 proactive) and should apply controls at the higher end of the proportionality spectrum. Important Entities are subject to reactive supervision (Art. 33) but face the same 10-measure obligations.

package/src/bmad-plus/packs/pack-shield/references/nis2/iso27001-nis2-mapping.md

@@ -0,0 +1,68 @@
+# ISO 27001:2022 to NIS2 Art. 21 Cross-Reference
+
+ISO/IEC 27001:2022 certification provides strong evidence of NIS2 compliance for many Art. 21 measures. However, ISO 27001 certification does NOT substitute NIS2 obligations — entities remain responsible for meeting Art. 21, Art. 20, and Art. 23 requirements directly.
+
+Key gaps where NIS2 goes beyond ISO 27001:
+- **Art. 21(2)(d)**: NIS2 explicitly mandates supply chain security obligations tied to ENISA coordinated risk assessments (Art. 26)
+- **Art. 21(2)(j)**: NIS2 explicitly mandates MFA — ISO 27001 Annex A.8.5 covers authentication but MFA is not universally required
+- **Art. 20**: Management body personal liability has no ISO 27001 equivalent
+- **Art. 23**: Incident reporting timelines (24h/72h/1 month) are more prescriptive than ISO 27001's general incident management controls
+
+---
+
+## Mapping Table
+
+| NIS2 Art. 21 Measure | NIS2 Requirement | ISO 27001:2022 Annex A Controls |
+|---|---|---|
+| **M1** Risk Analysis & Policies | Risk analysis methodology, IS policies | A.5.1 Policies; A.6.1 IS roles; A.8.8 Vuln mgmt; Clause 6.1 Risk assessment; Clause 8.2 IS risk assessment |
+| **M2** Incident Handling | Detection, response, recovery procedures | A.5.24 IS incident planning; A.5.25 Assessment of IS events; A.5.26 Response; A.5.27 Post-incident review; A.5.28 Evidence collection |
+| **M3** BCP / DR / Crisis | Backup, DR, crisis management | A.5.29 IS during disruption; A.5.30 ICT readiness; A.8.13 Backup; A.8.14 Redundancy |
+| **M4** Supply Chain Security | Supplier/service-provider risk | A.5.19 IS in supplier relationships; A.5.20 Supplier agreements; A.5.21 ICT supply chain; A.5.22 Supplier monitoring; A.5.23 Cloud services |
+| **M5** Secure Acquisition & Dev | SDLC security, vulnerability disclosure | A.8.25 Secure dev lifecycle; A.8.26 App security; A.8.27 Secure architecture; A.8.28 Secure coding; A.8.29 Testing; A.8.30 Outsourced dev; A.5.8 IS in PM |
+| **M6** Effectiveness Assessment | KPIs, audits, management review | A.5.35 Independent IS review; A.5.36 Policy compliance; Clause 9.1 Monitoring; Clause 9.2 Internal audit; Clause 9.3 Management review |
+| **M7** Cyber Hygiene & Training | Awareness and training | A.6.3 IS awareness/training; A.5.7 Threat intelligence; A.6.8 IS event reporting |
+| **M8** Cryptography | Crypto policies, key management | A.8.24 Use of cryptography |
+| **M9** HR, Access Control, Asset Mgmt | Least privilege, RBAC, asset inventory | A.5.9 Asset inventory; A.5.10 Asset use; A.5.11 Asset return; A.8.2 Privileged access; A.8.3 Access restriction; A.8.4 Source code; A.6.1 Screening; A.6.5 Responsibilities on termination |
+| **M10** MFA & Secure Comms | MFA, phishing-resistant auth, encrypted comms | A.8.5 Secure authentication; A.8.20 Network security; A.8.26 App security; A.8.24 Cryptography |
+
+---
+
+## ISO 27001 Controls With No Direct NIS2 Measure Equivalent
+
+The following ISO 27001:2022 Annex A controls are important for overall security posture but do not map to a specific Art. 21 measure. They may still be relevant for NIS2 governance and compliance evidence:
+
+- **A.5.2** IS roles and responsibilities
+- **A.5.31** Legal, statutory, regulatory, contractual requirements  
+- **A.5.32** Intellectual property rights
+- **A.5.33** Protection of records
+- **A.5.34** Privacy and PII protection (→ see also GDPR)
+- **A.6.4** Disciplinary process
+- **A.8.1** User endpoint devices
+- **A.8.9** Configuration management
+- **A.8.10** Information deletion
+
+---
+
+## NIS2 Requirements With Limited ISO 27001 Coverage
+
+| NIS2 Requirement | Gap vs ISO 27001 | Recommended Action |
+|---|---|---|
+| Art. 20 — Management body approval and personal liability | No ISO 27001 equivalent | Board cybersecurity policy; training records; documented approval minutes |
+| Art. 23 — 24h early warning | ISO 27001 A.5.24–5.26 cover incident management but not specific timelines | Pre-drafted CSIRT notification templates; automated alerting workflows |
+| Art. 23 — 72h notification | Same as above | Incident triage runbooks with timeline checkpoints |
+| Art. 23 — 1-month final report | Same as above | Post-incident review template with all Art. 23(4) required fields |
+| Art. 26 — ENISA supply chain risk assessments | ISO 27001 A.5.19–5.23 cover supplier security generally | Monitor ENISA and national authority supply chain advisories; integrate into supplier risk register |
+| Art. 21(2)(j) — MFA mandate | ISO 27001 A.8.5 covers authentication; MFA not universal | Deploy MFA for remote access, privileged accounts, cloud consoles as minimum |
+
+---
+
+## Practical Guidance for ISO 27001-Certified Entities
+
+If your organisation holds ISO 27001:2022 certification, you are well-positioned for NIS2 but should:
+
+1. **Confirm entity classification** — verify whether you are an EE or IE under Art. 3 and your Member State's transposition law
+2. **Address Art. 20 governance** — document board-level approval of cybersecurity measures and ensure training records are maintained
+3. **Implement the Art. 23 reporting workflow** — your IRP likely needs an explicit NIS2 notification track with pre-drafted CSIRT templates and 24h/72h/1-month checkpoints
+4. **Review supply chain coverage** — map your supplier security controls to Art. 21(2)(d) and integrate ENISA coordinated risk assessment outputs
+5. **Mandate MFA** — if not already universal, deploy MFA for remote access and privileged accounts
+6. **Register with your national competent authority** — most Member States require in-scope entities to self-register

package/src/bmad-plus/packs/pack-shield/references/nist-800-53/assessment-rmf.md

@@ -0,0 +1,349 @@
+# NIST SP 800-53 — Assessment, RMF, ConMon, and Framework Mapping Reference
+
+## SP 800-53A Rev 5 — Assessment Procedures
+
+### Purpose
+
+SP 800-53A Rev 5 (January 2022) provides **assessment procedures** for every control in SP 800-53 Rev 5. Each procedure specifies:
+
+1. **Objectives** — what the assessment must determine
+2. **Methods** — Examine, Interview, or Test
+3. **Objects** — what to examine/interview/test
+
+### The Three Assessment Methods
+
+| Method | Description | Examples |
+|--------|-------------|---------|
+| **Examine** | Review artifacts and documentation | Policy documents, SSP, configuration files, system logs, architecture diagrams, audit records, training records |
+| **Interview** | Discuss implementation with personnel | ISSO, system owner, help desk, IT administrators, end users, senior leaders |
+| **Test** | Exercise mechanisms directly | Vulnerability scans, penetration tests, configuration checks, firewall rule reviews, backup restoration tests |
+
+### Assessment Depth
+
+| Depth | Description | When Used |
+|-------|-------------|----------|
+| **Basic** | Check for existence of controls | Initial assessments; Low impact systems |
+| **Focused** | Evaluate implementation | Most common approach |
+| **Comprehensive** | Thorough, in-depth assessment | High impact systems; 3PAO assessments |
+
+### Security Assessment Report (SAR) Structure
+
+The SAR documents assessment results:
+
+1. **Executive Summary** — High-level findings and authorization recommendation
+2. **Assessment Scope** — Systems, components, controls assessed
+3. **Assessment Methodology** — Methods used, depth, timeframe
+4. **Findings** — Control-by-control results
+5. **Weaknesses and Deficiencies** — OTS (Other Than Satisfied) findings
+6. **Risk Exposure** — Risk ratings for identified weaknesses
+7. **Recommendations** — Remediation actions
+
+**Finding format:**
+```
+Control: AC-2(3)
+Objective: Determine if inactive accounts are disabled within the defined period.
+Status: Other Than Satisfied
+Finding: Audit of Active Directory accounts identified 47 accounts inactive for >120 days; 
+         ODV is 90 days. Automated account review process is not functioning correctly.
+Risk: Moderate — dormant accounts represent attack surface for credential-based attacks.
+Recommendation: Fix automated review process; immediately disable the 47 identified accounts.
+```
+
+---
+
+## Plan of Action and Milestones (POA&M)
+
+### POA&M Purpose
+
+The POA&M (CA-5) is a living document tracking all security weaknesses found during assessments, continuous monitoring, and self-assessment. Required for all federal systems.
+
+### POA&M Required Fields
+
+| Field | Description |
+|-------|-------------|
+| POA&M ID | Unique identifier |
+| Weakness/Deficiency | Description of the finding |
+| Source | How discovered (scan, audit, assessment, pen test) |
+| Control ID | Related SP 800-53 control |
+| Risk Level | Critical / High / Moderate / Low |
+| Scheduled Completion Date | When remediation will be complete |
+| Milestone Description | Steps to remediate with dates |
+| Resources Required | Staff, tools, budget |
+| Status | Open / Completed / Delayed / Risk Accepted |
+
+### POA&M Timelines (FedRAMP Guidance)
+
+| Risk Level | Remediation Deadline |
+|-----------|---------------------|
+| Critical | 30 days |
+| High | 90 days |
+| Moderate | 180 days |
+| Low | 1 year |
+| Operational Requirement | Risk accepted; ISSO/SO signature required |
+
+### Risk Acceptance
+
+When a weakness cannot be remediated within the standard timeline:
+- Document a **Risk Acceptance** with business justification
+- ISSO and System Owner must sign off
+- Authorizing Official (AO) may need to approve for High/Critical
+- Review at each ConMon cycle
+- Cannot be risk-accepted indefinitely for High/Critical findings
+
+---
+
+## Risk Management Framework (RMF) — SP 800-37 Rev 2
+
+### Step 1 — Prepare
+
+**Purpose:** Establish the organizational and system context for managing security and privacy risk.
+
+**Key tasks:**
+- Assign roles: Authorizing Official (AO), System Owner (SO), ISSO, Senior Agency IS Official (SAISO)
+- Develop or update organizational risk management strategy (PM-9)
+- Identify common controls (PM-10)
+- Conduct mission/business process analysis (PM-11)
+- Perform organization-level risk assessment (RA-3)
+- Establish information life cycle for the system
+
+**Output:** Risk management roles assigned; organization-level risk assessment completed; common control inventory established.
+
+### Step 2 — Categorize
+
+**Purpose:** Categorize the system and information processed, stored, and transmitted based on FIPS 199.
+
+**Key tasks:**
+- Describe the system (SSP Section 1 and 2)
+- Identify information types using SP 800-60
+- Determine impact levels for C, I, A
+- Determine overall system impact level (high-water mark)
+- Document in the Security Categorization document
+
+**Output:** System Security Categorization document (signed by AO and SO).
+
+### Step 3 — Select
+
+**Purpose:** Select, tailor, and document the controls for the system.
+
+**Key tasks:**
+- Select starting baseline from SP 800-53B (Low/Moderate/High)
+- Apply tailoring (common controls, scoping, ODVs, compensating controls)
+- Document all tailoring decisions in the SSP
+- Develop continuous monitoring strategy (CA-7)
+- Review and approve control selection (AO concurrence)
+
+**Output:** SSP with control selection; ConMon strategy.
+
+### Step 4 — Implement
+
+**Purpose:** Implement the controls and document how they are deployed in the operational environment.
+
+**Key tasks:**
+- Implement the selected controls
+- Document implementation in SSP (one narrative per control)
+- Document design and implementation information for developer controls (SA-4)
+- Identify and address supply chain risks (SR family)
+
+**Output:** Implemented controls; completed SSP implementation narratives.
+
+### Step 5 — Assess
+
+**Purpose:** Determine if the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting security and privacy requirements.
+
+**Key tasks:**
+- Develop Security Assessment Plan (SAP) using SP 800-53A
+- Select qualified assessors (independent for Moderate/High; 3PAO for FedRAMP)
+- Conduct assessments (examine, interview, test)
+- Document findings in SAR
+- Develop initial POA&M from SAR findings
+
+**Output:** SAP, SAR, initial POA&M.
+
+**Independence requirements:**
+- **Low systems:** Self-assessment permitted
+- **Moderate systems:** Independent assessor (different team from implementers)
+- **High systems / FedRAMP:** 3PAO required; must be accredited by A2LA/FedRAMP PMO
+
+### Step 6 — Authorize
+
+**Purpose:** Provide organizational accountability by requiring a senior official to determine if the security and privacy risk to organizational operations/assets is acceptable.
+
+**Authorization package contents:**
+1. System Security Plan (SSP)
+2. Security Assessment Report (SAR)
+3. Plan of Action and Milestones (POA&M)
+4. Executive Summary (for AO review)
+
+**Authorization decisions:**
+- **Authorization to Operate (ATO)** — risk is acceptable; typically granted for 3 years
+- **Common Control Authorization (CCA)** — for common control providers
+- **Denial of Authorization to Operate (DATO)** — risk is not acceptable; system must be shut down or remediated
+- **Authorization to Use (ATU)** — for external systems/services
+
+**Ongoing authorization:** Continuous authorization (preferred for Moderate/High) replaces periodic re-authorization with real-time risk management.
+
+### Step 7 — Monitor
+
+**Purpose:** Maintain ongoing situational awareness about the security and privacy posture of the system.
+
+**Key tasks:**
+- Implement ConMon strategy (CA-7)
+- Conduct ongoing assessments of selected controls
+- Respond to changes in system and threat environment
+- Report security status to AO
+- Update SSP, SAR, POA&M as changes occur
+- Conduct ongoing risk determination and acceptance
+
+**FedRAMP ConMon requirements:**
+- Monthly vulnerability scans (OS, databases, web apps)
+- Annual penetration test (conducted by 3PAO)
+- Monthly POA&M updates
+- Significant change request before major system changes
+- Annual security reviews
+
+---
+
+## Continuous Monitoring (ConMon) Strategy
+
+### ConMon Frequencies (SP 800-137 / CA-7)
+
+| Activity | Recommended Frequency | FedRAMP Frequency |
+|----------|----------------------|------------------|
+| Vulnerability scans (OS) | Monthly | Monthly |
+| Vulnerability scans (Web app) | Monthly | Monthly |
+| Vulnerability scans (Database) | Monthly | Weekly |
+| Control assessments (selected) | Ongoing/quarterly | Annually |
+| Security awareness training | Annual | Annual |
+| Contingency plan testing | Annual | Annual |
+| Full control assessment | Every 3 years / at reauthorization | Annual (3PAO) |
+| Penetration testing | Annual (Moderate+) | Annual (3PAO) |
+
+### ConMon Automation
+
+Support tools for ConMon implementation:
+- **SCAP (Security Content Automation Protocol)** — standardized vulnerability scanning
+- **CVE/CVSS** — common vulnerability scoring
+- **OVAL/XCCDF** — configuration checking
+- **NVD (National Vulnerability Database)** — NIST vulnerability repository
+- **CDM (Continuous Diagnostics and Mitigation)** — DHS/CISA program for federal agencies
+- **OSCAL** — machine-readable security control documentation
+
+---
+
+## OSCAL — Open Security Controls Assessment Language
+
+OSCAL (developed by NIST) provides machine-readable representations of SP 800-53 content:
+
+### OSCAL Layers
+
+| Layer | Purpose | Formats |
+|-------|---------|---------|
+| **Catalog** | Control definitions (SP 800-53 catalog) | JSON, XML, YAML |
+| **Profile** | Baseline selection and tailoring | JSON, XML, YAML |
+| **Component Definition** | Reusable component implementations | JSON, XML, YAML |
+| **System Security Plan** | SSP in machine-readable format | JSON, XML, YAML |
+| **Assessment Plan** | SAP in machine-readable format | JSON, XML, YAML |
+| **Assessment Results** | SAR findings in machine-readable format | JSON, XML, YAML |
+| **POA&M** | Plan of action in machine-readable format | JSON, XML, YAML |
+
+**FedRAMP OSCAL adoption:** FedRAMP has been moving toward OSCAL-based SSP submissions. Tools supporting OSCAL: Trestle (IBM), Xacta 360, Atlasity, Empower.
+
+---
+
+## Cross-Framework Mapping
+
+### SP 800-53 Rev 5 → ISO 27001:2022
+
+| SP 800-53 Family | ISO 27001:2022 Annex A Controls |
+|-----------------|-------------------------------|
+| AC (Access Control) | 5.15–5.18 (Access, privilege), 8.2–8.5 |
+| AT (Awareness & Training) | 6.3 (Security awareness) |
+| AU (Audit) | 8.15 (Logging), 8.16 (Monitoring) |
+| CA (Assessment) | 5.35 (IS review), 5.36 (Compliance) |
+| CM (Config Mgmt) | 8.8–8.9 (Vulnerability, config), 8.32 |
+| CP (Contingency) | 5.29 (BCP), 8.13 (Backup) |
+| IA (Authentication) | 5.17 (Authentication), 8.5 (MFA) |
+| IR (Incident Response) | 5.24–5.28 (Incident management) |
+| PE (Physical) | 7.1–7.14 (Physical controls) |
+| RA (Risk Assessment) | 5.1 (Risk treatment), 6.1 (Risk process) |
+| SC (Comms Protection) | 5.14 (Transfer), 8.20–8.26 (Network) |
+| SI (Integrity) | 8.7 (Malware), 8.8 (Vulnerability), 8.19 |
+| SR (Supply Chain) | 5.19–5.22 (Supplier security) |
+
+### SP 800-53 Rev 5 → NIST CSF 2.0
+
+The CSF 2.0 (February 2024) maps to SP 800-53:
+
+| CSF Function | Key SP 800-53 Families |
+|-------------|----------------------|
+| **GV (Govern)** | PM, PL, AT, RA |
+| **ID (Identify)** | RA, CA, CM, PM |
+| **PR (Protect)** | AC, AT, CM, IA, MA, MP, PE, SC, SI, SR |
+| **DE (Detect)** | AU, CA, IR, RA, SI |
+| **RS (Respond)** | IR, CA |
+| **RC (Recover)** | CP, IR |
+
+Full mapping: SP 800-53B Appendix B provides CSF subcategory → SP 800-53 control mapping.
+
+### SP 800-53 Rev 5 → CMMC 2.0
+
+CMMC 2.0 is based on **NIST SP 800-171 Rev 2**, which derives from SP 800-53:
+
+| CMMC Level | SP 800-53 Basis |
+|-----------|----------------|
+| Level 1 (Foundational) | Subset of 800-171 practices (17 practices from FAR clause) |
+| Level 2 (Advanced) | Full SP 800-171 Rev 2 (110 practices = ~320 SP 800-53 controls) |
+| Level 3 (Expert) | SP 800-171 + selected SP 800-172 controls |
+
+SP 800-171 Appendix D provides the mapping from each 800-171 requirement to the SP 800-53 source controls.
+
+### SP 800-53 Rev 5 → FedRAMP
+
+FedRAMP uses the SP 800-53 Moderate or High baseline with overlay parameters:
+
+| FedRAMP Difference | Detail |
+|-------------------|--------|
+| Specific ODV values | Defined in FedRAMP baseline documentation |
+| Additional requirements | Incident reporting to US-CERT; 3PAO requirement |
+| Cryptography | FIPS 140-2/140-3 validated modules explicitly required |
+| ConMon | Specific monthly/annual frequencies required |
+| SSP format | FedRAMP SSP template must be used |
+| Authorization types | Agency ATO or JAB P-ATO |
+
+---
+
+## Key Roles in the RMF / SP 800-53 Context
+
+| Role | Abbreviation | Responsibility |
+|------|-------------|---------------|
+| Authorizing Official | AO | Accepts risk; grants/denies ATO |
+| Authorizing Official Designated Representative | AODR | Acts on behalf of AO |
+| Chief Information Officer | CIO | Overall IT governance |
+| Senior Agency Information Security Official | SAISO | Agency-wide IS oversight |
+| Information System Security Officer | ISSO | Day-to-day security operations for system |
+| Information System Security Manager | ISSM | Manages multiple ISSOs |
+| System Owner | SO | Responsible for system operation |
+| Common Control Provider | CCP | Implements shared/inherited controls |
+| Security Control Assessor | SCA | Conducts independent assessment |
+| Privacy Officer / CPO | CPO | Privacy program lead |
+
+---
+
+## Key NIST Publications Related to SP 800-53
+
+| Publication | Title | Role |
+|-------------|-------|------|
+| SP 800-53 Rev 5 | Security and Privacy Controls | Main control catalog |
+| SP 800-53A Rev 5 | Assessing Security and Privacy Controls | Assessment procedures |
+| SP 800-53B | Control Baselines | Baseline definitions |
+| SP 800-37 Rev 2 | Risk Management Framework | RMF steps |
+| SP 800-60 Vol I/II | Information Types / Impact Levels | Categorization guidance |
+| SP 800-30 Rev 1 | Risk Assessment | Risk assessment methodology |
+| SP 800-137A | ConMon | Continuous monitoring |
+| SP 800-63 Rev 3 | Digital Identity | Authentication assurance |
+| SP 800-82 Rev 3 | OT Security | ICS/SCADA guide |
+| SP 800-88 Rev 1 | Media Sanitization | Media disposal |
+| SP 800-115 | Security Testing | Penetration testing methodology |
+| FIPS 199 | Security Categorization | Impact level determination |
+| FIPS 200 | Minimum Security Requirements | Baseline requirement |
+| FIPS 140-3 | Cryptographic Modules | Cryptography standard |