ISO/IEC 27001:2022
The international standard for an ISMS.
FRAMEWORKS · NIST SP 800-53
NIST SP 800-53 Rev. 5: controls by protection requirements.
Special Publication 800-53 of the National Institute of Standards and Technology describes security and privacy controls for information systems. Varmo includes the complete catalog and applies it to each asset according to its protection requirements.
Platform framework from the Pro plan
The framework
All current controls and control enhancements of Revision 5 (release 5.2.0), without withdrawn ones, in the original wording. The source is NIST’s public OSCAL data.
Baselines under SP 800-53B
- LOW, MODERATE and HIGH
- PRIVACY for personal data
- Organisation-wide controls (PM family) for the organisation as a whole
Per asset by protection requirements
In the security procedure, each asset is subject to the baseline that matches its protection requirements: normal LOW, high MODERATE, very high HIGH, plus PRIVACY if personal data is processed. Individual controls can be assigned in addition.
Related
NIST CSF 2.0
NIST’s Cybersecurity Framework.
Frequently asked questions
Do I have to work through all 1,014 controls?
No. Each asset is only subject to the baseline that matches its protection requirements; a system with normal protection requirements receives the LOW baseline. You assign further controls individually as needed.
Are there mappings to ISO/IEC 27001?
Yes, to ISO/IEC 27001:2022 Annex A and to NIST CSF 2.0. Both come from NIST: from the catalogue of Online Informative References and from the Informative References of CSF 2.0. We mapped most of the controls that NIST does not map to the CSF ourselves; a few without any relation to the CSF, such as pure privacy obligations, remain unmapped. All mappings are reviewed: where a requirement is equivalent to or included in a fulfilled one, it automatically counts as fulfilled; the others only overlap and show where one implementation also covers requirements of the other frameworks. Mappings and coverage are included from the Pro plan.
FREE · ABOUT 5 MINUTES
How far along is your ISMS? Take the ISO 27001 self-assessment.
A traffic light per clause, your next steps and the right plan. No sign-up; your answers stay in your browser.
How close are you to ISO/IEC 27001?
In a personal demo, we show you the way to the readiness report, with no obligation. Or try it free for 30 days with every feature.