Search xOps School
18 results for “NIST”
NIST SP 800-53Cybersecurity, Information Security and AI ManagementNIST SP 800-53 Revision 5 is the US government's free catalogue of security and privacy controls, also widely used by private organisations. This free course explains its 20 control families, how controls are structured, how baselines are s
NIST SP 800-61 Rev.3Advanced Cybersecurity, Privacy and Supply-Chain SecurityNIST SP 800-61 Revision 3 (April 2025) is NIST's free incident response guidance, written as a CSF 2.0 Community Profile that builds incident response into cybersecurity risk management. This free course explains its life cycle model, key t
NIST SP 800-161 Rev.1Advanced Cybersecurity, Privacy and Supply-Chain SecurityNIST SP 800-161 Rev. 1 is NIST's guidance on managing cybersecurity risks that come from suppliers, products and services. This free course explains its three-level approach, the frame-assess-respond-monitor process, the SP 800-53 control o
NIST SP 800-171 Rev.3Advanced Cybersecurity, Privacy and Supply-Chain SecurityNIST SP 800-171 Revision 3 sets the security requirements for protecting Controlled Unclassified Information in nonfederal systems such as those of contractors and universities. This free course explains CUI and scoping, the 97 requirements
NIST Privacy FrameworkAdvanced Cybersecurity, Privacy and Supply-Chain SecurityThe NIST Privacy Framework is a free, voluntary tool from the US National Institute of Standards and Technology for managing privacy risks that arise when organisations process data about people. This free course explains its model of priva
NIST Cybersecurity Framework (CSF)Cybersecurity, Information Security and AI ManagementThe NIST Cybersecurity Framework (CSF) 2.0 is a free, voluntary framework that describes the cybersecurity outcomes any organisation should aim for. This free course explains its six Functions from Govern to Recover, the Core structure, Cur
NIST AI 600-1 (Generative AI Profile)AI Governance and Data ManagementNIST AI 600-1 is the free, voluntary Generative AI Profile of the NIST AI Risk Management Framework, published in July 2024. This free course explains its twelve generative AI risks, how its suggested actions map to Govern, Map, Measure and
NIST SP 800-207 (Zero Trust Architecture)Advanced Cybersecurity, Privacy and Supply-Chain SecurityNIST SP 800-207 is the vendor-neutral NIST guideline that defines zero trust and the logical architecture used to apply it. This free course explains the seven tenets, the policy engine, administrator and enforcement point, trust algorithms
NIST SP 800-37 (Risk Management Framework)Advanced Cybersecurity, Privacy and Supply-Chain SecurityNIST SP 800-37 Revision 2 defines the Risk Management Framework, the seven-step process US agencies and many other organisations use to manage security and privacy risk for their systems. This free course explains Prepare, Categorize, Selec
NIST AI Risk Management Framework (AI RMF)AI Governance and Data ManagementThe NIST AI Risk Management Framework is a free, voluntary guide from the US National Institute of Standards and Technology for managing the risks AI systems pose to people, organisations and society. This free course explains trustworthy A
NIST SP 800-218 (Secure Software Development Framework)Secure Development and Agile MethodsNIST SP 800-218, the Secure Software Development Framework (SSDF), is a set of outcome-based practices that reduce vulnerabilities and supply-chain risk in any development life cycle. This free course explains its four practice groups, task
ISO/IEC 23894Secure Development and Agile MethodsISO/IEC 23894:2023 is the international guidance standard for managing AI-related risk, built on ISO 31000. This free course explains its principles, framework and process, the AI objectives, risk sources and life cycle annexes, how to asse
ISO/IEC 27036 SeriesAdvanced Cybersecurity, Privacy and Supply-Chain SecurityISO/IEC 27036 is a four-part ISO/IEC series on information security in supplier relationships and ICT supply chains. This free course explains each part, the supplier relationship lifecycle from planning to termination, how to scale assuran
OpenSSF OSPS BaselineAdvanced Cybersecurity, Privacy and Supply-Chain SecurityThe OpenSSF Open Source Project Security (OSPS) Baseline is a free catalogue of security controls for open-source projects, grouped into eight families and three maturity levels. This course explains the current version, how to read control
OWASP API Security Top 10Advanced Cybersecurity, Privacy and Supply-Chain SecurityThe OWASP API Security Top 10 (2023 edition, still current) is OWASP's free awareness list of the ten most critical risks specific to APIs. This free course explains each risk with examples and prevention, the three levels of authorization,
CSA Cloud Controls Matrix (CCM)Advanced Cybersecurity, Privacy and Supply-Chain SecurityThe CSA Cloud Controls Matrix (CCM) v4.1 is the Cloud Security Alliance's free catalogue of 207 cloud security and privacy controls in 17 domains. This free course explains its structure, the CAIQ questionnaire, shared security responsibili
CIS Critical Security Controls v8.1Advanced Cybersecurity, Privacy and Supply-Chain SecurityThe CIS Critical Security Controls v8.1 are a free, prioritised set of 18 Controls and 153 Safeguards from the Center for Internet Security for defending against common cyber attacks. This free course explains Implementation Groups, asset c
OWASP SAMM (Software Assurance Maturity Model)Secure Development and Agile MethodsOWASP SAMM (version 2, current model release 2.2.0) is a free, open maturity model for measuring and improving software security practices across governance, design, implementation, verification and operations. This free course explains its