-: Is a requirement different than a control? 2 2
If they're not different 3 3
can we use those words interchangeably? 4 4
But if a requirement is different than a control 5 5
how is it different? 6 6
And does this difference matter when we're working with RMF? 7 7
You probably already know the words requirement and control 8 8
are two very overloaded terms. 9 9
They mean different things to different people 10 10
depending on the context. 11 11
And this has caused some confusion for RMF users. 12 12
So section 2.6 in RMF is where NIST 13 13
tries to get us all on the same page. 14 14
The term requirement as used in RMF 15 15
includes both legal and policy requirements 16 16
to protect systems and data. 17 17
In other words, a requirement in RMF 18 18
means all the protection that a system and its data 19 19
must have from any source. 20 20
And by source RMF means laws, executive orders, 21 21
directives, regulations, organizational policies, 22 22
standards, mission needs, business needs, 23 23
or the results of risk assessments. 24 24
Okay, that's a lot of places 25 25
where protection requirements can come from. 26 26
So you can think of the total list of requirements 27 27
as letting you know what protections a system 28 28
and its sensitive data will need 29 29
without getting into how to do any of the work. 30 30
Now, let's take a look at controls. 31 31
Controls are the safeguards and protective capabilities 32 32
that we put into place to meet our cybersecurity 33 33
and privacy objectives. 34 34
Controls are how we satisfy 35 35
the total list of protective requirements. 36 36
Controls are selected and implemented by the organization 37 37
and they can be technical, administrative, and physical 38 38
or any combination of those. 39 39
In addition, controls can also be sorted into 40 40
preventative, detective and corrective categories. 41 41
NIST Special Publication 800-53, 42 42
which is called Recommended Security Controls 43 43
for Federal Information Systems and Organizations, 44 44
contains hundreds of examples of controls of all types. 45 45
Now, let me give you an example of a requirement 46 46
along with a control from 800-53. 47 47
Let's suppose you have a headquarters policy that says, 48 48
sensitive data on your system must be destroyed 49 49
after 180 days of initial collection. 50 50
Okay? That's a requirement. 51 51
Going into special publication 800-53 52 52
there's a control that's called Media Sanitization 53 53
and it has the designation MP-6, 54 54
and you can find it on page 174 in Revision 5 of 800-53. 55 55
The control itself can be tailored to your system 56 56
and it can be enhanced to make the data destruction 57 57
more thorough and more reliable. 58 58
For example, in addition to using a robust algorithm 59 59
to delete data, you could build your control 60 60
so that two people must observe the data destruction 61 61
and that they both have to sign and date a pen and ink log 62 62
every time they destroy data together. 63 63
Okay, so that's how a requirement is different 64 64
than a control and why it's a big difference 65 65
when you're working with RMF.