Control Objectives for Information Technologies — SP 800-53 Coverage
How well do NIST SP 800-53 Rev 5 controls address each COBIT 2019 requirement? This analysis maps from framework clauses back to SP 800-53, with expert coverage weightings and gap identification.
Clause-by-Clause Analysis
Sorted by clauseAPO01 Managed I&T Management Framework
Rationale
PM-01/PL-01 establish security management framework; PM-02 roles; PM-03 resources; PL-09 (new in Rev 5) central management provides a mechanism for unified control administration that supports I&T framework operations.
Gaps
COBIT APO01 covers full I&T management framework including organizational design, process management, and continuous improvement. SP 800-53 addresses security management only. PL-09 improves central management but doesn't address IT organizational design.
APO02 Managed Strategy
Rationale
PM-01 security program; PM-07 enterprise architecture; PM-08 critical infrastructure; PM-11 mission processes.
Gaps
Major gap. COBIT APO02 covers enterprise IT strategy, digital transformation, and strategic alignment. SP 800-53 addresses security strategy as a component but not IT strategic planning.
APO03 Managed Enterprise Architecture
Rationale
PM-07 enterprise architecture; PL-08 security architecture; SA-08/SA-17 security engineering and design.
Gaps
SP 800-53 covers security architecture well. COBIT APO03 covers full enterprise architecture (business, data, application, technology layers). Security architecture is one view.
APO04 Managed Innovation
APO05 Managed Portfolio
APO06 Managed Budget and Costs 25%
Rationale
PM-03 addresses security resource allocation.
Gaps
Major gap. COBIT APO06 covers full IT budgeting, cost management, and financial planning. SP 800-53 only addresses security resource allocation.
Mapped Controls
APO07 Managed Human Resources
Rationale
PM-13 security workforce; PS family personnel security including PS-09 (new in Rev 5) position descriptions which defines security responsibilities in role descriptions; AT family training including AT-06 (new in Rev 5) training feedback for measuring training effectiveness. These additions strengthen HR coverage by linking security to job roles and measuring training outcomes.
Gaps
SP 800-53 covers security-related HR (screening, training, roles). PS-09 and AT-06 improve role definition and training measurement. COBIT APO07 covers full IT HR management including skills planning, career development, and resource acquisition for all IT roles — not just security roles.
APO08 Managed Relationships
APO09 Managed Service Level Agreements
Rationale
SA-04 acquisition requirements; SA-09 external service agreements; CA-03 information exchange agreements.
Gaps
SP 800-53 covers security aspects of service agreements. COBIT APO09 covers full SLA management including service catalog, service level definition, and performance monitoring.
APO10 Managed Vendors
Rationale
SA-04/SA-09 acquisition and service requirements; SR family supply chain. Security vendor management well covered.
Gaps
SP 800-53 comprehensively covers security aspects of vendor management. COBIT APO10 also covers commercial management, contract negotiation, and vendor performance optimization beyond security.
APO11 Managed Quality
Rationale
SA-11 developer testing; SA-15 development standards; CM-04 impact analysis; CA-02 assessments.
Gaps
SP 800-53 covers security testing quality. COBIT APO11 covers enterprise quality management system, QA standards, and continuous improvement for all IT services.
APO12 Managed Risk
Rationale
RA family comprehensive risk assessment; RA-07 (new in Rev 5) risk response provides explicit risk treatment; RA-08 (new in Rev 5) privacy impact assessments extend risk to privacy domain; RA-09 (new in Rev 5) criticality analysis strengthens risk-based prioritization; PM-09/PM-28 risk strategy/framing; CA-05 remediation. Security and privacy risk management now very strong.
Gaps
SP 800-53 is strong on security/privacy risk. COBIT APO12 extends to IT operational risk, project risk, and enterprise risk integration. RA-07/RA-08/RA-09 close significant gaps from v1.0 but SP 800-53 remains focused on information security/privacy risk.
APO13 Managed Security
Rationale
PM-01 program plan; PM-02 roles; PM-03 resources; PM-06 performance; PM-09 risk strategy; PL-01/PL-02 planning; PL-09 (new in Rev 5) central management enables unified ISMS-style control governance; PL-10 (new in Rev 5) baseline selection; PL-11 (new in Rev 5) baseline tailoring; RA-01/RA-03 risk assessment; CA-02/CA-07 assessment and monitoring; AT-02 awareness. PL-09/10/11 together provide the governance-select-tailor cycle that mirrors ISMS planning.
Gaps
Minor: COBIT APO13 requires an ISMS approach. SP 800-53 now provides stronger ISMS-compatible controls with PL-09/10/11 for central management, baseline selection, and tailoring. The remaining gap is that SP 800-53 provides controls for security management but isn't itself an ISMS standard (that's NIST RMF).
APO14 Managed Data
Rationale
AC-04 data flow; MP family media protection; SC-28 data at rest; SI-12 data management; RA-02 data categorization; PT family privacy; CM-12 (new in Rev 5) information location identifies where sensitive data resides; CM-13 (new in Rev 5) data action mapping documents data processing flows; SI-18 (new in Rev 5) PII quality operations addresses data quality for personal information. These three new controls meaningfully improve data management coverage.
Gaps
SP 800-53 addresses data security and privacy. CM-12/CM-13/SI-18 close gaps in data location, data flow mapping, and PII quality. COBIT APO14 covers full data management (governance, quality, lifecycle, architecture, metadata). SP 800-53 still doesn't cover master data management, data architecture design, or enterprise data governance beyond security/privacy.
BAI01 Managed Programs and Projects
Rationale
SA-03 system development lifecycle; PM-07 enterprise architecture; PM-11 mission processes.
Gaps
Major gap. COBIT BAI01 covers IT program and project management methodology. SP 800-53 addresses security in development but not program/project management discipline.
BAI02 Managed Requirements Definition
Rationale
SA-04 security requirements; SA-08 security engineering; PL-02 security plan; PL-07 concept of operations; PL-08 security architecture.
Gaps
SP 800-53 covers security requirements definition well. COBIT BAI02 covers all IT requirements (functional, technical, security). Security requirements are a subset.
BAI03 Managed Solutions Identification and Build
Rationale
SA family covers security in solution development; SA-03 SDLC; SA-10 configuration management; SA-11 testing; SA-20 (new in Rev 5) customized development of critical components addresses bespoke development for high-assurance needs; SA-21 (new in Rev 5) developer screening adds personnel vetting for development teams.
Gaps
SP 800-53 is strong on security in development. SA-20/SA-21 add critical component development and developer vetting. COBIT BAI03 covers full solution design, build, and quality assurance beyond security aspects including solution architecture and data conversion.
BAI04 Managed Availability and Capacity
Rationale
CP family continuity and recovery; SC-05 availability protection (denial of service); AU-04 audit storage capacity; SI-13 (new in Rev 5) predictive maintenance enables proactive failure prevention through monitoring component reliability and predicting failures.
Gaps
SP 800-53 addresses availability through continuity and protection. SI-13 predictive maintenance adds proactive capacity/availability management. COBIT BAI04 covers proactive capacity planning, performance monitoring, and resource optimization for all IT services — broader than security availability.
BAI05 Managed Organizational Change
Rationale
CM-03/CM-04 configuration change control; PM-01 program updates.
Gaps
Major gap. COBIT BAI05 covers organizational change management (people, process, culture change). SP 800-53 CM controls address technical configuration changes, not organizational change management methodology (stakeholder readiness, training plans, resistance management).
BAI06 Managed IT Changes
Rationale
CM-03 configuration change control; CM-04 impact analysis; CM-05 access restrictions for change; CM-09 configuration management plan; CM-14 (new in Rev 5) signed components verifies integrity of software/firmware changes through cryptographic signatures; SA-10 developer change management.
Gaps
SP 800-53 CM family is strong on IT change management from a security perspective. CM-14 adds change integrity verification. COBIT BAI06 includes change scheduling, prioritization, release coordination, and emergency change procedures beyond security scope.
BAI07 Managed IT Change Acceptance and Transitioning
Rationale
CM-03/CM-04 change control and analysis; SA-11 testing; CA-02 assessment.
Gaps
SP 800-53 covers security testing and acceptance. COBIT BAI07 covers full change acceptance testing, implementation planning, early production support, and post-implementation review.
BAI08 Managed Knowledge
Rationale
AT family training and awareness; AT-06 (new in Rev 5) training feedback measures training effectiveness and captures lessons learned; PM-13 workforce development; SA-05 system documentation.
Gaps
AT-06 improves knowledge feedback loops. Major gap remains: COBIT BAI08 covers enterprise knowledge management including knowledge repositories, tacit knowledge capture, and knowledge sharing platforms. SP 800-53 addresses security training and documentation but not systematic knowledge management.
BAI09 Managed Assets
Rationale
CM-08 component inventory; CM-12 (new in Rev 5) information location tracks where information resides, strengthening asset-data linkage; PM-05 system inventory; MP family media assets; SA-22 unsupported components.
Gaps
CM-12 improves asset-to-data mapping. SP 800-53 covers IT asset inventory and media management. COBIT BAI09 covers full IT asset lifecycle management including financial tracking, license management, and asset optimization.
BAI10 Managed Configuration
Rationale
CM family comprehensive for configuration management: baselines (CM-02), change control (CM-03), settings (CM-06), inventory (CM-08), plan (CM-09); CM-12 (new in Rev 5) information location ties data to configuration items; CM-13 (new in Rev 5) data action mapping documents processing flows across configured components; CM-14 (new in Rev 5) signed components ensures configuration integrity through cryptographic verification.
Gaps
SP 800-53 CM family now aligns very well with COBIT BAI10. CM-12, CM-13, and CM-14 close previous gaps. Minor remaining gap: COBIT includes CMDB/configuration repository management and broader IT service configuration item relationships.
BAI11 Managed IT Projects
Rationale
SA-03 system development lifecycle provides project integration; PM-07 enterprise architecture aligns projects to architecture; PM-10 authorization process gates project delivery; PM-11 mission alignment ensures projects support business processes; CA-05 plan of action and milestones tracks project security deliverables.
Gaps
Major gap. COBIT BAI11 covers IT project management methodology, project governance, stakeholder management, project scope/schedule/resource management, and quality/risk management within projects. SP 800-53 doesn't have project management controls; it addresses security within projects but not project management discipline itself (scheduling, resource allocation, milestone tracking, earned value management).
DSS01 Managed Operations
Rationale
PE family physical/environmental including PE-21 (new in Rev 5) electromagnetic pulse protection, PE-22 (new in Rev 5) component marking for physical identification, PE-23 (new in Rev 5) facility location for physical security siting; MA family maintenance including MA-07 (new in Rev 5) field maintenance for off-site equipment servicing; SI-04 monitoring; CA-07 continuous monitoring. New PE and MA controls expand facilities and maintenance coverage.
Gaps
SP 800-53 covers security operations including expanded physical and maintenance controls. COBIT DSS01 covers all IT operations (job scheduling, output management, facilities management, capacity monitoring, environmental management) beyond security scope. PE-21/22/23 and MA-07 add depth but don't address operational management disciplines.
DSS02 Managed Service Requests and Incidents
Rationale
IR family is comprehensive for security incident management; IR-09 (new in Rev 5) information spillage response adds specific handling for data breach/spillage incidents which is increasingly important.
Gaps
SP 800-53 covers security incidents comprehensively. IR-09 adds spillage-specific response. COBIT DSS02 covers all IT service requests and incidents (not just security). Service desk, request fulfillment, and non-security incident management remain gaps.
DSS03 Managed Problems
Rationale
IR-04/IR-05 incident handling/monitoring; SI-02 flaw remediation; CA-05 POA&M.
Gaps
Major gap. COBIT DSS03 covers ITIL-style problem management (root cause analysis, known error database, proactive problem identification). SP 800-53 addresses incident response and flaw remediation but not formal problem management methodology.
DSS04 Managed Continuity
Rationale
CP family comprehensively covers IT contingency planning, BIA, testing, recovery, alternate sites and processing.
Gaps
SP 800-53 CP family aligns well. Minor gap: COBIT DSS04 includes business continuity (not just IT), crisis communication, and post-resumption review beyond IT contingency scope.
DSS05 Managed Security Services
Rationale
SP 800-53 comprehensively covers security services: network protection (SC-07), malware protection (SI-03), monitoring (SI-04), access control (AC family), identity (IA family), physical (PE family). New Rev 5 additions: SC-24 fail in known state for resilient security services; SC-44 detonation chambers (sandboxing) for malware analysis; SC-41 port and I/O device access; SI-16 memory protection (DEP/ASLR); CM-14 signed components for software integrity.
Gaps
SP 800-53 is very strong here. SC-24/SC-44/SI-16/CM-14 add depth to security service capabilities. Minor gap: COBIT DSS05 frames security as a service management function with specific security service definitions and service-level expectations.
Mapped Controls
DSS06 Managed Business Process Controls
Rationale
AC family access controls; AU family audit; SI-10 (information input validation) adds application-level input verification that supports business process control integrity; SI-15 (information output filtering) provides output controls for data leaving systems.
Gaps
SI-10/SI-15 add input validation and output filtering that partially address business process controls. COBIT DSS06 covers business process controls including transaction processing integrity, input/output controls, and business process assurance. SP 800-53 addresses system-level controls but not business process design, segregation of business duties, or transaction-level reconciliation.
EDM01 Ensured Governance Framework Setting and Maintenance
Rationale
PM-01 program plan; PM-02 roles; PM-03 resources; PM-09 risk strategy; PL-09 (new in Rev 5) central management of security controls strengthens governance framework; PL-10 (new in Rev 5) baseline selection supports governance-level decisions on control standards. SP 800-53 addresses security governance but COBIT EDM01 covers IT governance broadly.
Gaps
COBIT EDM01 encompasses enterprise IT governance framework, governance system design, and optimization. SP 800-53 is security-focused and doesn't address broader IT governance structure, value delivery, or stakeholder transparency. PL-09/PL-10 improve central governance capability but don't close the enterprise IT governance gap.
EDM02 Ensured Benefits Delivery
Rationale
PM-01 program objectives; PM-03 resources; PM-06 measures of performance.
Gaps
Significant gap. SP 800-53 doesn't address IT benefits delivery, value optimization, or portfolio management. Security is one component of IT value; COBIT covers full business value lifecycle.
EDM03 Ensured Risk Optimization
Rationale
PM-09 risk management strategy; RA-01 risk assessment policy; RA-03 risk assessment; PM-28 risk framing; RA-07 (new in Rev 5) risk response adds explicit risk treatment actions; RA-09 (new in Rev 5) criticality analysis identifies critical components for risk prioritization. Together these strengthen the risk optimization lifecycle.
Gaps
SP 800-53 comprehensively addresses security risk. COBIT EDM03 covers enterprise-wide IT risk optimization including risk appetite, risk tolerance levels, and business-aligned risk management beyond security. RA-07/RA-09 improve response and criticality but enterprise risk aggregation across all IT remains a gap.
EDM04 Ensured Resource Optimization
Rationale
PM-03 security resources; PM-13 workforce; SA-03 lifecycle resources.
Gaps
Significant gap. COBIT EDM04 covers all IT resource optimization (people, technology, data). SP 800-53 addresses security resources only, not enterprise IT resource planning and optimization.
EDM05 Ensured Stakeholder Engagement
Rationale
PM-01 program plan communicates to stakeholders; PM-02 assigns stakeholder roles.
Gaps
Major gap. COBIT EDM05 covers stakeholder communication, transparency, and engagement across all IT activities. SP 800-53 doesn't address stakeholder engagement methodology or IT reporting to business.
MEA01 Managed Performance and Conformance Monitoring
Rationale
CA-07 continuous monitoring; PM-06 measures of performance; AU-06 audit review; SI-04 system monitoring.
Gaps
SP 800-53 covers security performance monitoring. COBIT MEA01 covers all IT performance and conformance monitoring including non-security KPIs, service level achievement, and process performance.
MEA02 Managed System of Internal Control
Rationale
CA-02 security assessments; CA-07 continuous monitoring; PM-06 performance measures; AU-06 audit review.
Gaps
SP 800-53 covers security control assessment. COBIT MEA02 covers the full internal control system for IT (SOX compliance, control self-assessment, gap remediation). Broader than security controls.
MEA03 Managed Compliance with External Requirements
Rationale
CA-02 compliance assessment; PM-01 program compliance; PL-04 rules of behavior; SA-04 contractual requirements.
Gaps
SP 800-53 addresses security compliance. COBIT MEA03 covers all external IT compliance (regulatory, contractual, standards) including compliance program management and impact assessment.
MEA04 Managed Assurance
Rationale
CA-01 assessment policy; CA-02 security assessments; CA-07 continuous monitoring; CA-08 penetration testing; CA-09 (new in Rev 5) internal system connections authorizes and monitors internal connections, supporting assurance of interconnection integrity.
Gaps
CA-09 adds internal connection assurance. SP 800-53 provides security assurance capabilities. COBIT MEA04 covers enterprise-wide IT assurance planning, independent assurance reviews, and assurance reporting for all IT objectives — broader than security assurance.
Methodology and Disclaimer
This coverage analysis maps from COBIT 2019 clauses/requirements back to NIST SP 800-53 Rev 5 controls, assessing how well the SP 800-53 control set addresses each framework requirement.
Coverage weighting represents an informed estimate based on control-objective alignment, not a definitive compliance determination. Weightings consider whether SP 800-53 controls address the intent of each framework requirement, even where terminology and structure differ.
This analysis should be validated by qualified assessors for use in compliance or audit activities. The authoritative source for any compliance determination is always the framework itself.