Infosec Frameworks & Certification

Under NIST SP 800-37 task A-6, the plan of action and milestones lists each deficiency's remediation tasks, resources, milestones and scheduled completion dates. The authorizing official reviews it, and control CA-5 requires it to be updated from assessments, audits and continuous monitoring.

The missing review is an exception: that instance of the control did not operate. The team must not recreate backdated evidence; it discloses the gap, performs the review now with a true date, checks what access changed during the gap and fixes the cause.

Under NIST SP 800-53 CM-6 the organization picks a common secure configuration such as a CIS Benchmark, sets the most restrictive settings consistent with operations, and identifies, documents and approves every deviation. CM-2 keeps the resulting baseline current under configuration control.

STIGs are Security Technical Implementation Guides published by the Defense Information Systems Agency for Defense Department systems; CIS Benchmarks are consensus configuration guides anyone may adopt. A contractor follows STIGs because its contract or customer requires them.

Stage 1 checks readiness: scope, documents, risk method, Statement of Applicability, and that internal audit and management review have run. Stage 2 checks the ISMS operates effectively. Major nonconformities block certification until closed; minors need an accepted plan. Surveillance audits follow, then recertification.

Internal audit checks at planned intervals, by objective auditors, that the ISMS conforms and works; management review has top management weigh performance, audit results, risks and changes and decide improvements. Auditors expect programmes, records, decisions and closed corrective actions.

SP 800-171 sets confidentiality requirements for CUI in nonfederal systems. CMMC is DoD's verification: a subcontractor handling CUI needs at least Level 2, whose 110 requirements are those of SP 800-171 Revision 2, not Revision 3.

Under SP 800-37 Rev. 2, an agency's authorizing official reviews the service's authorization package and accepts the residual risk. For cloud services the agency can issue an authorization to use, relying on a provider authorization such as FedRAMP's instead of reassessing from scratch.

Under PCI DSS v4.0.1, a compensating control answers a documented constraint within the defined approach, via Appendix C's worksheet. The customized approach is a chosen design meeting a requirement's objective, backed by Requirement 12.3.2's targeted risk analysis and ROC validation.

Risk appetite is the broad amount and type of risk leadership is willing to take in pursuit of objectives; risk tolerance turns it into measurable limits. A residual risk beyond tolerance is escalated to whoever owns the appetite, to re-treat or explicitly accept.

FAIR splits the scenario into loss event frequency and loss magnitude, estimates each as a calibrated range, and simulates them into an annual loss distribution. The board gets a median and a severe-year figure, not one number or a colour.

Read the auditor's opinion, management's assertion, the system description (scope, categories, subservice organizations, CUECs) and the tests and results. Exceptions matter when they hit controls you rely on; a qualified or adverse opinion means criteria were not met.