{"id":9061,"date":"2016-05-02T20:16:32","date_gmt":"2016-05-02T20:16:32","guid":{"rendered":"https:\/\/multiacademstg.wpengine.com\/27001academy\/?p=9061"},"modified":"2025-04-11T09:02:40","modified_gmt":"2025-04-11T09:02:40","slug":"how-to-use-the-nist-sp800-series-of-standards-for-iso-27001-implementation","status":"publish","type":"post","link":"https:\/\/staging.advisera.com\/27001academy\/blog\/2016\/05\/02\/how-to-use-the-nist-sp800-series-of-standards-for-iso-27001-implementation\/","title":{"rendered":"How to use the NIST SP800 series of standards for ISO 27001 implementation"},"content":{"rendered":"

Although\u00a0ISO 27001<\/a>, an international standard for information security management, provides control objectives and controls that cover a wide range of security issues, they are not exhaustive. Thus, ISO 27001 clauses 6.1.3 b) and c) note that an organization can go beyond the standard\u2019s controls to set proper security levels, by developing its own solutions or using other knowledge sources.<\/p>\n

This article will show you an alternative to\u00a0ISO 27002<\/a>\u00a0as guidance to support ISO 27001 controls implementation: the NIST SP 800 series. You will see what they are about and their general structure compared to those of ISO 27001 and ISO 27002.<\/p>\n

The NIST SP 800 series<\/strong><\/h3>\n

The NIST SP 800 series is a set of free-to-download documents from the United States federal government, describing computer security policies, procedures, and guidelines, published by the NIST (National Institute of Standards and Technology), containing more than 130 documents.<\/p>\n

\"NIST_documentation_structure_figure\"<\/p>\n

Figure:\u00a0NIST documentation structure<\/span><\/em><\/p>\n

NIST SP 800 series documents for information security management and risk assessment<\/strong><\/h2>\n

Like the ISO 27000 series, the SP 800 series provides information covering management and operational information security practices, but in a greater number of documents.<\/p>\n

To provide specific guidance for integrating information security risk management with organizational operations, the NIST 800 SP series has the document SP 800-39 – Managing Information Security Risk<\/strong>.<\/p>\n

For risk assessment, the SP 800 series has a documentation set created using a six-step risk methodology:<\/p>\n