ComplianceNIST 800-53 control

NIST-SA-24 Design For Cyber Resiliency

Official page ↗
Framework
NIST SP 800-53 rev5 (5.2.0)
Family
SA System and Services Acquisition
Control
SA-24

Control statement

a. Design organizational systems, system components, or system services to achieve cyber resiliency by: 1. Defining the following cyber resiliency goals: [Assignment: cyber resiliency goals]. 2. Defining the following cyber resiliency objectives: [Assignment: cyber resiliency objectives]. 3. Defining the following cyber resiliency techniques: [Assignment: cyber resiliency techniques]. 4. Defining the following cyber resiliency implementation approaches: [Assignment: cyber resiliency implementation approaches]. 5. Defining the following cyber resiliency design principles: [Assignment: cyber resiliency design principles]. b. Implement the selected cyber resiliency goals, objectives, techniques, implementation approaches, and design principles as part of an organizational risk management process or systems security engineering process.

Discussion

Cyber resiliency is critical to ensuring the survivability of mission critical systems and high value assets. Cyber resiliency focuses on limiting the damage from adversity or the conditions that can cause a loss of assets. Damage can affect: (1) organizations (e.g., loss of reputation, increased existential risk); (2) missions or business functions (e.g., decreased capability to complete current missions and to accomplish future missions); (3) security (e.g., decreased capability to achieve security objectives or to prevent, detect, and respond to cyber incidents); (4) systems (e.g., unauthorized use of system resources or decreased capability to meet system requirements); or (5) specific system elements (e.g., physical destruction; corruption, modification, or fabrication of information). Cyber resiliency goals are intended to help organizations maintain a state of informed preparedness for adversity, continue essential mission or business functions despite adversity, restore mission or business functions during and after adversity, and modify mission or business functions and their supporting capabilities in response to predicted changes in technical, operational, or threat environments. NIST SP 800-160, Volume 2 provides additional information on the Cyber Resiliency Engineering Framework to include detailed descriptions of cyber resiliency goals, objectives, techniques, implementation approaches, and design principles. NIST SP 800-160, Vol 1 provides additional information on achieving cyber resiliency as an emergent property of an engineered system.

Related

Related control · Compliance (65)

  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CP-10 System Recovery and Reconstitution NIST 800-53 control
  • NIST-CP-11 Alternate Communications Protocols NIST 800-53 control
  • NIST-CP-12 Safe Mode NIST 800-53 control
  • NIST-CP-13 Alternative Security Mechanisms NIST 800-53 control
  • NIST-CP-2 Contingency Plan NIST 800-53 control
  • NIST-CP-4 Contingency Plan Testing NIST 800-53 control
  • NIST-CP-9 System Backup NIST 800-53 control
  • NIST-IA-10 Adaptive Authentication NIST 800-53 control
  • NIST-IR-4 Incident Handling NIST 800-53 control
  • NIST-IR-5 Incident Monitoring NIST 800-53 control
  • NIST-PE-11 Emergency Power NIST 800-53 control
  • NIST-PE-17 Alternate Work Site NIST 800-53 control
  • NIST-PL-8 Security and Privacy Architectures NIST 800-53 control
  • NIST-PM-16 Threat Awareness Program NIST 800-53 control
  • NIST-PM-30 Supply Chain Risk Management Strategy NIST 800-53 control
  • NIST-PM-31 Continuous Monitoring Strategy NIST 800-53 control
  • NIST-PM-7 Enterprise Architecture NIST 800-53 control
  • NIST-RA-10 Threat Hunting NIST 800-53 control
  • NIST-RA-3 Risk Assessment NIST 800-53 control
  • NIST-RA-5 Vulnerability Monitoring and Scanning NIST 800-53 control
  • NIST-RA-9 Criticality Analysis NIST 800-53 control
  • NIST-SA-17 Developer Security and Privacy Architecture and Design NIST 800-53 control
  • NIST-SA-3 System Development Life Cycle NIST 800-53 control
  • NIST-SA-8 Security and Privacy Engineering Principles NIST 800-53 control
  • NIST-SA-9 External System Services NIST 800-53 control
  • NIST-SC-10 Network Disconnect NIST 800-53 control
  • NIST-SC-11 Trusted Path NIST 800-53 control
  • NIST-SC-29 Heterogeneity NIST 800-53 control
  • NIST-SC-3 Security Function Isolation NIST 800-53 control
Show all 65 ›

Referenced by Compliance · has member (1)

  • NIST-SA System and Services Acquisition NIST 800-53 family