NIST Cybersecurity Framework (1.1, legacy) control library
Every control CMDash tracks for NIST Cybersecurity Framework (1.1, legacy), in the order the standard itself uses. Each one is a row in the product with an owner, a status, evidence and its own history — this page is the public index of what those rows are.
108 controls5 families78 mapped to other frameworks108 with authoritative text
Families
Identify (ID) · 29
| ID.AM-1 | Physical devices and systems inventoried Maps to CIS Controls v8.1, CMMC Level 3, DORA +5 more |
| ID.AM-2 | Software platforms and applications inventoried Maps to CIS Controls v8.1, CMMC Level 3, NIST Cybersecurity Framework 2.0 |
| ID.AM-3 | Organizational communication and data flows mapped Maps to NIST Cybersecurity Framework 2.0 |
| ID.AM-4 | External information systems catalogued Maps to NIST Cybersecurity Framework 2.0 |
| ID.AM-5 | Resources prioritized based on classification and value Maps to CIS Controls v8.1, HITRUST CSF v11, ISO/IEC 27001:2022 +2 more |
| ID.AM-6 | Cybersecurity roles and responsibilities established Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
| ID.BE-1 | Organization role in supply chain identified Maps to NIST Cybersecurity Framework 2.0 |
| ID.BE-2 | Organization place in critical infrastructure identified Maps to NIST Cybersecurity Framework 2.0 |
| ID.BE-3 | Priorities for mission and objectives established Maps to NIST Cybersecurity Framework 2.0 |
| ID.BE-4 | Dependencies and critical functions established Maps to NIST Cybersecurity Framework 2.0 |
| ID.BE-5 | Resilience requirements established Maps to NIST Cybersecurity Framework 2.0 |
| ID.GV-1 | Organizational cybersecurity policy established Maps to DORA, GDPR, HITRUST CSF v11 +5 more |
| ID.GV-2 | Cybersecurity roles and responsibilities coordinated Maps to NIST Cybersecurity Framework 2.0 |
| ID.GV-3 | Legal and regulatory requirements understood Maps to NIST Cybersecurity Framework 2.0 |
| ID.GV-4 | Governance and risk management processes address cybersecurity risks Maps to DORA, NIST Cybersecurity Framework 2.0 |
| ID.RA-1 | Asset vulnerabilities identified and documented Maps to CMMC Level 2, FedRAMP Moderate, NIST Cybersecurity Framework 2.0 |
| ID.RA-2 | Cyber threat intelligence received Maps to CMMC Level 3, ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
| ID.RA-3 | Threats identified and documented Maps to CMMC Level 3, NIST Cybersecurity Framework 2.0 |
| ID.RA-4 | Potential business impacts identified Maps to CMMC Level 3, NIST Cybersecurity Framework 2.0 |
| ID.RA-5 | Threats, vulnerabilities, likelihoods, and impacts used for risk Maps to CMMC Level 2, CMMC Level 3, DORA +7 more |
| ID.RA-6 | Risk responses identified and prioritized Maps to CMMC Level 2, CMMC Level 3, FedRAMP Moderate +4 more |
| ID.RM-1 | Risk management processes established Maps to NIST Cybersecurity Framework 2.0 |
| ID.RM-2 | Organizational risk tolerance determined Maps to NIST Cybersecurity Framework 2.0 |
| ID.RM-3 | Risk tolerance informed by role in critical infrastructure Maps to NIST Cybersecurity Framework 2.0 |
| ID.SC-1 | Supply chain risk management processes established Maps to CMMC Level 3, DORA, ISO/IEC 27001:2022 +2 more |
| ID.SC-2 | Suppliers and partners identified and assessed Maps to CMMC Level 3, HITRUST CSF v11, NIST Cybersecurity Framework 2.0 +1 more |
| ID.SC-3 | Supply chain contracts reflect cybersecurity requirements Maps to HITRUST CSF v11, NIST Cybersecurity Framework 2.0, TISAX (VDA ISA v6) |
| ID.SC-4 | Suppliers and partners routinely assessed Maps to NIST Cybersecurity Framework 2.0, TISAX (VDA ISA v6) |
| ID.SC-5 | Response and recovery planning and testing with suppliers Maps to NIST Cybersecurity Framework 2.0 |
Protect (PR) · 39
| PR.AC-1 | Identities and credentials issued and managed Maps to CIS Controls v8.1, CMMC Level 2, CMMC Level 3 +7 more |
| PR.AC-2 | Physical access managed and protected Maps to CMMC Level 2, HIPAA Security Rule, HITRUST CSF v11 +4 more |
| PR.AC-3 | Remote access managed Maps to CMMC Level 2, CMMC Level 3, FedRAMP Moderate +3 more |
| PR.AC-4 | Access permissions and authorizations managed Maps to CMMC Level 2, FedRAMP Moderate, HIPAA Security Rule +6 more |
| PR.AC-5 | Network integrity protected Maps to CMMC Level 2, CMMC Level 3, FedRAMP Moderate +6 more |
| PR.AC-6 | Identities proofed and bound to credentials Maps to NIST Cybersecurity Framework 2.0 |
| PR.AC-7 | Users, devices, and assets authenticated Maps to CIS Controls v8.1, CMMC Level 2, CMMC Level 3 +9 more |
| PR.AT-1 | All users informed and trained Maps to CIS Controls v8.1, CMMC Level 2, CMMC Level 3 +6 more |
| PR.AT-2 | Privileged users understand responsibilities Maps to CMMC Level 2, CMMC Level 3, NIST Cybersecurity Framework 2.0 |
| PR.AT-3 | Third-party stakeholders understand responsibilities |
| PR.AT-4 | Senior executives understand responsibilities |
| PR.AT-5 | Physical and cybersecurity personnel adequately trained |
| PR.DS-1 | Data-at-rest protected Maps to CIS Controls v8.1, CMMC Level 2, FedRAMP Moderate +6 more |
| PR.DS-2 | Data-in-transit protected Maps to CMMC Level 2, FedRAMP Moderate, GDPR +5 more |
| PR.DS-3 | Assets managed through removal and transfers Maps to CMMC Level 2 |
| PR.DS-4 | Adequate capacity maintained |
| PR.DS-5 | Protections against data leaks implemented Maps to CIS Controls v8.1, CMMC Level 2, FedRAMP Moderate +2 more |
| PR.DS-6 | Integrity checking used to verify software and information Maps to CMMC Level 3 |
| PR.DS-7 | Development and testing environments separate |
| PR.DS-8 | Integrity checking used for hardware |
| PR.IP-1 | Baseline configuration created and maintained Maps to CIS Controls v8.1, CMMC Level 2, CMMC Level 3 +5 more |
| PR.IP-2 | System development life cycle managed Maps to GDPR, ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 +2 more |
| PR.IP-3 | Configuration change control in place Maps to CMMC Level 2, FedRAMP Moderate, HITRUST CSF v11 +2 more |
| PR.IP-4 | Backups conducted and tested Maps to CIS Controls v8.1, DORA, FedRAMP Moderate +6 more |
| PR.IP-5 | Policy and regulations for physical operating environment met |
| PR.IP-6 | Data destroyed according to policy Maps to CMMC Level 2, HIPAA Security Rule |
| PR.IP-7 | Protection processes improved |
| PR.IP-8 | Effectiveness of protection technologies shared |
| PR.IP-9 | Response and recovery plans in place Maps to DORA, FedRAMP Moderate, HIPAA Security Rule +5 more |
| PR.IP-10 | Response and recovery plans tested Maps to HITRUST CSF v11, TISAX (VDA ISA v6) |
| PR.IP-11 | Cybersecurity included in human resources practices Maps to CMMC Level 3, ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
| PR.IP-12 | Vulnerability management plan developed Maps to CMMC Level 2, FedRAMP Moderate, HITRUST CSF v11 |
| PR.MA-1 | Maintenance performed and logged Maps to CMMC Level 2 |
| PR.MA-2 | Remote maintenance approved and monitored Maps to CMMC Level 2 |
| PR.PT-1 | Audit/log records per policy Maps to CIS Controls v8.1, CMMC Level 2, FedRAMP Moderate +6 more |
| PR.PT-2 | Removable media protected and restricted Maps to CMMC Level 2 |
| PR.PT-3 | Least functionality principle incorporated Maps to CMMC Level 2, ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
| PR.PT-4 | Communications and control networks protected |
| PR.PT-5 | Mechanisms implemented for resilience Maps to GDPR |
Detect (DE) · 18
| DE.AE-1 | Baseline of operations and data flows established Maps to SOC 2 Type II |
| DE.AE-2 | Detected events analyzed Maps to CMMC Level 2, FedRAMP Moderate, HIPAA Security Rule +2 more |
| DE.AE-3 | Event data collected and correlated Maps to CIS Controls v8.1, CMMC Level 2, CMMC Level 3 +1 more |
| DE.AE-4 | Impact of events determined |
| DE.AE-5 | Incident alert thresholds established Maps to CMMC Level 2 |
| DE.CM-1 | Network monitored for cybersecurity events Maps to CIS Controls v8.1, CMMC Level 2, CMMC Level 3 +7 more |
| DE.CM-2 | Physical environment monitored Maps to CMMC Level 2, ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
| DE.CM-3 | Personnel activity monitored |
| DE.CM-4 | Malicious code detected Maps to CIS Controls v8.1, CMMC Level 2, FedRAMP Moderate +6 more |
| DE.CM-5 | Unauthorized mobile code detected |
| DE.CM-6 | External service provider activity monitored |
| DE.CM-7 | Monitoring for unauthorized personnel and connections Maps to CMMC Level 2 |
| DE.CM-8 | Vulnerability scans performed Maps to CIS Controls v8.1, CMMC Level 2, FedRAMP Moderate +6 more |
| DE.DP-1 | Detection roles and responsibilities defined |
| DE.DP-2 | Detection activities comply with requirements |
| DE.DP-3 | Detection processes tested Maps to CIS Controls v8.1, DORA, GDPR |
| DE.DP-4 | Event detection information communicated Maps to CMMC Level 2 |
| DE.DP-5 | Detection processes continuously improved Maps to CMMC Level 2, CMMC Level 3, FedRAMP Moderate |
Respond (RS) · 16
Recover (RC) · 6
| RC.RP-1 | Recovery plan executed Maps to DORA, GDPR, HIPAA Security Rule +2 more |
| RC.IM-1 | Recovery plans incorporate lessons learned |
| RC.IM-2 | Recovery strategies updated |
| RC.CO-1 | Public relations managed |
| RC.CO-2 | Reputation repaired after incident |
| RC.CO-3 | Recovery activities communicated to stakeholders Maps to NIST Cybersecurity Framework 2.0 |
Where this comes from
Control identifiers, families and titles are the rows CMDash’s own seed data writes for NIST Cybersecurity Framework (1.1, legacy) 1.1, published from a build-time export rather than read from any customer’s workspace. Control text is quoted verbatim from NIST Cybersecurity Framework (CSF) 1.1, which is in the public domain. Cross-framework mappings are CMDash’s own, and each one is shown on both frameworks it connects.
Track these controls in CMDash
Every control on this page becomes a row with an owner, a status, evidence and an audit trail — with the crosswalks already wired, so evidence mapped once counts in more than one framework.