NIST SP 800-53, COBIT, and ITIL

 

1. NIST SP 800-53: Security and Privacy Controls 

Purpose: 

• Provides a comprehensive catalog of security and privacy controls for federal information systems and organizations. 

• Widely adopted outside government to establish robust cybersecurity controls. 

Key Features: 

• Control Families: 20 families covering access control, audit, contingency planning, identification & authentication, incident response, system & communications protection, etc. 

• Risk-based: Controls are selected based on system impact level (Low, Moderate, High). 

• Control Baselines: Predefined sets of controls for different risk levels. 

• Emphasizes continuous monitoring and assessment. 

Examples of Control Families: 

• Access Control (AC) — user permissions and account management. 

• Audit and Accountability (AU) — logging and monitoring. 

• Incident Response (IR) — planning and managing security incidents. 

• System and Communications Protection (SC) — network and data protection. 

Role in Security: 

• Acts as a framework for building security programs and ensuring compliance (e.g., FISMA). 

• Used for system accreditation and risk management. 

 

2. COBIT (Control Objectives for Information and Related Technologies) 

Purpose: 

• Provides a framework for IT governance and management. 

• Helps align IT processes and controls with business goals, risk management, and regulatory requirements. 

Key Components: 

• Domains and Processes: 

• APO (Align, Plan and Organize) – strategic IT planning. 

• BAI (Build, Acquire and Implement) – project and change management. 

• DSS (Deliver, Service and Support) – operational delivery and security services. 

• MEA (Monitor, Evaluate and Assess) – performance and compliance monitoring. 

• Focuses on risk management, value delivery, resource management, and performance measurement. 

Role in Security: 

• Integrates security controls into enterprise governance. 

• Guides security strategy, policy enforcement, and compliance oversight. 

• Supports defining and monitoring security metrics and performance. 

 

3. ITIL (Information Technology Infrastructure Library) 

Purpose: 

• Provides a set of best practices for IT service management (ITSM). 

• Focuses on delivering IT services aligned with business needs, including incident, problem, and change management. 

Key Components: 

• Service Lifecycle Stages: 

• Service Strategy 

• Service Design 

• Service Transition 

• Service Operation 

• Continual Service Improvement 

• Processes relevant to security include: 

• Incident Management – managing and resolving security incidents. 

• Change Management – controlling changes to IT environment, including security updates. 

• Problem Management – identifying root causes of incidents. 

• Service Continuity Management – ensuring availability and recovery. 

Role in Security: 

• Integrates security into day-to-day IT operations. 

• Ensures security incidents and changes are handled consistently. 

• Supports maintaining service availability while managing risk. 

 

Summary Table 

Framework	Focus	Primary Role in Security	Key Components / Processes
NIST SP 800-53	Security & privacy controls catalog	Framework for technical security controls & compliance	20 control families (e.g., AC, AU, IR, SC)
COBIT	IT governance and management	Aligns IT security with business strategy & risk management	Domains: APO, BAI, DSS, MEA
ITIL	IT service management best practices	Embeds security into IT operations & service delivery	Incident, Change, Problem, Continuity Mgmt