> ## Documentation Index
> Fetch the complete documentation index at: https://docs.matproof.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Getting Started with NIST CSF and 800-53
> A practical guide to implementing NIST Cybersecurity Framework and NIST 800-53 security controls using Matproof.
# Getting Started with NIST CSF and 800-53
The National Institute of Standards and Technology (NIST) publishes two of the most widely referenced cybersecurity frameworks in the world:
* **NIST Cybersecurity Framework (CSF) 2.0** - A voluntary framework for managing and reducing cybersecurity risk, organized around six core functions. Used by organizations of all sizes and sectors.
* **NIST SP 800-53 Rev. 5** - A comprehensive catalog of security and privacy controls, primarily used by US federal agencies and their contractors. Increasingly adopted by private sector organizations seeking a rigorous control baseline.
Matproof supports both frameworks. CSF provides the strategic risk management structure, while 800-53 provides the detailed control catalog. Many organizations use CSF for governance and communication, then map specific controls from 800-53 for implementation.
Activate NIST CSF and/or NIST 800-53 under **Settings - Frameworks**. You can activate both - Matproof automatically maps controls between them so you avoid duplicate work.
***
## NIST CSF 2.0 - The Six Core Functions
CSF 2.0 (released February 2024) organizes cybersecurity activities into six functions:
Establish and monitor cybersecurity risk management strategy, expectations, and policy. New in CSF 2.0.
Understand your assets, business environment, risks, and supply chain to manage cybersecurity risk.
Implement safeguards to ensure delivery of critical services.
Identify the occurrence of cybersecurity events in a timely manner.
Take action regarding a detected cybersecurity incident.
Maintain plans for resilience and restore capabilities impaired by a cybersecurity incident.
CSF 2.0 added the **Govern** function to emphasize that cybersecurity risk management must be integrated into enterprise risk management and driven by leadership. Start with Govern if you are building a program from scratch.
***
## NIST 800-53 - Control Families
NIST SP 800-53 Rev. 5 contains over 1,000 controls organized into 20 families:
| Family | Code | Description |
| ----------------------------------------- | ---- | -------------------------------------------------------- |
| Access Control | AC | Access enforcement, least privilege, account management |
| Awareness and Training | AT | Security awareness, role-based training |
| Audit and Accountability | AU | Audit logging, review, analysis |
| Assessment, Authorization, and Monitoring | CA | Security assessments, system authorization |
| Configuration Management | CM | Baseline configuration, change control |
| Contingency Planning | CP | Backup, recovery, continuity |
| Identification and Authentication | IA | User identification, MFA, credential management |
| Incident Response | IR | Incident handling, reporting, monitoring |
| Maintenance | MA | System maintenance, tools, remote maintenance |
| Media Protection | MP | Media access, transport, sanitization |
| Physical and Environmental Protection | PE | Physical access, environmental controls |
| Planning | PL | Security planning, rules of behavior |
| Program Management | PM | Risk management strategy, enterprise architecture |
| Personnel Security | PS | Screening, termination, transfer |
| PII Processing and Transparency | PT | Privacy, consent, data processing |
| Risk Assessment | RA | Risk assessment, vulnerability scanning |
| System and Services Acquisition | SA | System development lifecycle, supply chain |
| System and Communications Protection | SC | Boundary protection, cryptography, transmission security |
| System and Information Integrity | SI | Flaw remediation, malicious code protection, monitoring |
| Supply Chain Risk Management | SR | Supply chain controls, component authenticity |
You do not need to implement all 1,000+ controls. Select a baseline (Low, Moderate, or High) based on your system's security categorization (FIPS 199), then tailor controls to your environment.
***
## Which Framework Should I Use?
| Use Case | Recommended Framework |
| --------------------------------------------- | ------------------------------------------------------------------------------- |
| Building a cybersecurity program from scratch | Start with CSF 2.0 for structure, add 800-53 controls for implementation detail |
| US federal agency or contractor (FISMA) | 800-53 is mandatory |
| FedRAMP cloud authorization | 800-53 Moderate or High baseline |
| Private sector, non-regulated | CSF 2.0 is typically sufficient |
| Mapping to multiple frameworks | CSF 2.0 maps well to ISO 27001, DORA, and other frameworks |
| Detailed technical controls needed | 800-53 provides the most granular control catalog available |
***
## Recommended Implementation Plan
### Step 1 - Establish governance (CSF: Govern)
1. Go to **Policies - Generate** and create your Cybersecurity Risk Management Policy
2. Define roles and responsibilities for cybersecurity governance
3. Establish your risk appetite and risk tolerance levels
4. Ensure leadership oversight of the cybersecurity program
5. Document supply chain risk management expectations
### Step 2 - Identify assets and risks (CSF: Identify)
1. Create an inventory of hardware, software, data, and services
2. Go to **Risk Management - New Risk Assessment**
3. Identify threats and vulnerabilities to your critical assets
4. Assess risks based on likelihood and impact
5. Prioritize risks for treatment based on your risk appetite
### Step 3 - Select your control baseline (800-53)
If using NIST 800-53:
1. Categorize your information systems using FIPS 199 (Low, Moderate, or High impact)
2. Select the corresponding 800-53 baseline
3. Matproof pre-populates the applicable controls based on your selection
4. Tailor the baseline - add or remove controls based on your specific environment, threats, and risk assessment
Most commercial organizations implementing 800-53 voluntarily choose the Moderate baseline. It provides strong security coverage without the full rigor of the High baseline required for national security systems.
### Step 4 - Implement protective controls (CSF: Protect)
Work through the controls in **Controls - NIST**:
* Access control and identity management (AC, IA)
* Security awareness and training (AT)
* Data protection and cryptography (SC)
* Configuration management and change control (CM)
* Maintenance and media protection (MA, MP)
For each control, document the implementation, assign an owner, and link evidence.
### Step 5 - Detection and monitoring (CSF: Detect)
1. Implement audit logging across systems in scope (AU)
2. Configure continuous monitoring for security events
3. Establish security event correlation and analysis processes
4. Define detection thresholds and alerting criteria
5. Link monitoring evidence to the relevant controls
### Step 6 - Incident response (CSF: Respond)
1. Go to **Incidents** and configure your incident response workflow
2. Define incident classification criteria and escalation procedures
3. Establish communication plans for internal teams, leadership, and external parties
4. Document lessons learned processes for post-incident improvement
5. Test your incident response plan at least annually
### Step 7 - Recovery planning (CSF: Recover)
1. Develop and document recovery plans for critical systems and services
2. Define recovery time objectives (RTOs) and recovery point objectives (RPOs)
3. Test recovery procedures regularly
4. Document improvements identified during recovery testing
5. Link recovery test results as evidence against the relevant controls
### Step 8 - Assessment and continuous improvement
1. Go to **Audit Programs - New Audit - NIST**
2. Assess your implementation against CSF functions and/or 800-53 controls
3. Document findings as Corrective Actions
4. Update your risk assessment based on findings
5. Establish a continuous monitoring program to maintain compliance over time
***
## CSF 2.0 Profiles and Tiers
### Profiles
CSF profiles describe your organization's current and target cybersecurity posture. Create two profiles in Matproof:
* **Current Profile** - where you are today (based on your control assessment results)
* **Target Profile** - where you need to be (based on risk appetite, business requirements, and regulatory obligations)
The gap between the two profiles drives your implementation roadmap.
### Tiers
CSF implementation tiers describe the degree of rigor in your cybersecurity risk management:
| Tier | Description |
| ---------------------- | ----------------------------------------------------------------------------------------------------------------------- |
| Tier 1 - Partial | Ad hoc, reactive. Limited awareness of cybersecurity risk. |
| Tier 2 - Risk Informed | Risk management practices are approved by management but may not be organization-wide. |
| Tier 3 - Repeatable | Risk management practices are formally established, regularly updated, and informed by threat landscape changes. |
| Tier 4 - Adaptive | Organization adapts cybersecurity practices based on lessons learned and predictive indicators. Continuous improvement. |
***
## Next Steps
* [Risk Management](/features/risk-management) - risk assessments aligned to NIST methodology
* [Controls](/features/controls) - working through CSF and 800-53 control sets
* [Incidents](/features/incidents) - incident response workflow configuration
* [Audit Programs](/features/audit-programs) - security assessments and continuous monitoring