Protecting controlled unclassified information in nonfederal systems and organizations

Abstract

This publication has been developed by NIST to further its statutory responsibilities under the Federal Information Security Modernization Act (FISMA), 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems. Such information security standards and guidelines shall not apply to national security systems without the express approval of the appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, OMB Director, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis, and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST.

National Cybersecurity Online Informative References (OLIR) Program

“…Reference Document (e.g., NIST SP 800-171 [8]) and create an Informative Reference to the Cybersecurity Framework.…”

“…The examples below are extended explanations of the Relationships described in Section 3.2.5. The 779 examples were taken from NIST SP 800-171, and all Reference Document elements are referenced 780 as described in that publication [8]. All Cybersecurity Framework element examples are taken from 781 version 1.1 of the Cybersecurity Framework [4].…”

Security Guidelines for Storage Infrastructure

“…In many regards, physical security requirements for storage infrastructure are identical to those of other infrastructure elements like computers and network equipment (e.g., facility security, surveillance, transportation, etc.). These are well covered by multiple publications, including NIST SP 800-53 [28], Rev5 [NIST SP 800-171 [34]. Additional valuable discussion regarding media disposal and destruction is available in ISO 27040 ( [10]), and NIST SP 800-88 Rev.…”

Security Guidelines for Storage Infrastructure

“…In many regards, physical security requirements for storage infrastructure are identical to those of other infrastructure elements like computers and network equipment (e.g., facility security, surveillance, transportation, etc.). These are well covered by multiple publications, including NIST SP 800-171 [34]. Additional valuable discussion regarding media disposal and destruction is available in ISO 27040 ( [10]).…”