Cyber Engineering, Risk & Governance: CERG Framework

How to read this matrix: Each row represents a security intent, the underlying goal that multiple frameworks are all trying to achieve. The regulatory and NIST columns show where each framework addresses that intent. Where multiple frameworks align to one row, a single control effort satisfies all of them. Items marked ⚠ Unique have requirements that don’t fully overlap with the other frameworks and warrant dedicated attention.

Table of Contents

1. Know what you own: maintain an authoritative asset inventory
2. Identify and remediate known vulnerabilities on a defined schedule
3. Control who can access what: enforce least privilege
4. Authenticate users and systems: verify identity before granting access
5. Harden systems: remove what isn’t needed, lock down what is
6. Protect data in transit and at rest: encryption as a baseline control
7. Segment networks: limit lateral movement and blast radius
8. Manage vendor and third-party risk: extend controls beyond the perimeter
9. Control and log privileged/remote access: know who did what, when
10. Conduct adversarial testing: find what scanners miss
11. Train and background-check personnel with access to sensitive systems
12. Write and maintain policies: define what good looks like
13. Manage configuration changes: track drift, prevent unauthorized changes
14. Collect, protect, and retain audit evidence: prove controls are working
15. Assess your own security posture: periodic internal evaluation
16. Manage risk formally: document, accept, or treat identified risks
17. Protect physical access to critical systems: cyber starts at the door
18. Monitor threats continuously: detect what vulnerability scans miss
19. Plan and practice incident response: know what to do before it happens
20. Manage recovery: restore operations and capture lessons learned
21. Manage accounts throughout their lifecycle: provisioning through termination
22. Define and enforce a compliance calendar: no surprises at audit time
23. Quick Reference: Pillar Summary
24. Key Consolidation Opportunities
25. Document Control

1. Know what you own: maintain an authoritative asset inventory

Primary Pillar: Engineering Regulations: NERC-CIP · CMMC · · NIST

What “done” looks like: Living asset register with classification, owner, and regulatory designation (BES/CUI). Engineering produces at project handoff; Risk validates via scan coverage.

2. Identify and remediate known vulnerabilities on a defined schedule

Primary Pillar: Risk Regulations: NERC-CIP · CMMC · · SOX · NIST

What “done” looks like: Continuous scan coverage across IT and OT; prioritized finding register with SLA tracking; deviation/exception process for OT-constrained systems.

3. Control who can access what: enforce least privilege

Primary Pillar: Engineering Regulations: NERC-CIP · CMMC · · SOX · NIST

What “done” looks like: Role-based access model implemented; privileged access managed separately; access reviews on defined cycle; MFA enforced for remote and privileged access.

4. Authenticate users and systems: verify identity before granting access

Primary Pillar: Engineering Regulations: NERC-CIP · CMMC · · SOX · NIST

What “done” looks like: MFA deployed for all remote and privileged access; default/shared credentials eliminated; password policy enforced by technical control, not just policy.

5. Harden systems: remove what isn’t needed, lock down what is

Primary Pillar: Engineering Regulations: NERC-CIP · CMMC · · NIST

What “done” looks like: Secure configuration baselines (CIS benchmarks or equivalent) documented and enforced for each platform class; deviation from baseline requires documented exception.

6. Protect data in transit and at rest: encryption as a baseline control

Primary Pillar: Engineering Regulations: NERC-CIP · CMMC · · NIST

What “done” looks like: Encryption standards defined and applied to all CUI/BCSI environments; key management process documented; TLS enforced on all external-facing interfaces.

7. Segment networks: limit lateral movement and blast radius

Primary Pillar: Engineering Regulations: NERC-CIP · CMMC · · NIST

What “done” looks like: Documented network zones with access control lists; OT/ICS and CUI environments isolated; ESP/EAP documented for all BES Cyber Systems.

8. Manage vendor and third-party risk: extend controls beyond the perimeter

Primary Pillar: Risk Regulations: NERC-CIP · CMMC · · NIST

What “done” looks like: Vendor risk assessment program with tiered review depth; contract security requirements (right-to-audit, incident notification, data handling); supply chain risk management plan.

9. Control and log privileged/remote access: know who did what, when

Primary Pillar: Engineering Regulations: NERC-CIP · CMMC · · SOX · NIST

What “done” looks like: All privileged and remote sessions logged; session recordings for high-risk access; log retention per regulatory requirement; log review process defined and tracked.

10. Conduct adversarial testing: find what scanners miss

Primary Pillar: Risk Regulations: CMMC · · NIST ⚠ Unique: No direct NERC-CIP analog

What “done” looks like: Annual minimum pen test schedule; scope includes internal, external, and (where applicable) OT/ICS targets; findings tracked to closure with Engineering review of architectural impacts.

11. Train and background-check personnel with access to sensitive systems

Primary Pillar: Governance Regulations: NERC-CIP · CMMC · · NIST

What “done” looks like: Role-based training program with completion tracking; background check process for privileged users; CIP-004 training records maintained per regulatory retention requirement.

12. Write and maintain policies: define what good looks like

Primary Pillar: Governance Regulations: NERC-CIP · CMMC · · SOX · NIST

What “done” looks like: Policy library version-controlled and reviewed on defined cycle; each policy mapped to regulatory citation; senior leader approval documented; implementation guidance published for each policy.

13. Manage configuration changes: track drift, prevent unauthorized changes

Primary Pillar: Engineering Regulations: NERC-CIP · CMMC · · SOX · NIST

What “done” looks like: All changes to in-scope systems go through documented change process; baseline comparison before/after; unauthorized change detection via config monitoring; SOX change tickets retained as audit evidence.

14. Collect, protect, and retain audit evidence: prove controls are working

Primary Pillar: Governance Regulations: NERC-CIP · CMMC · · SOX · NIST

What “done” looks like: Evidence library organized by control and regulatory citation; retention periods enforced per framework (NERC-CIP: per standard, CMMC: available for assessment, SOX: per audit retention requirements); pre-audit evidence review process.

15. Assess your own security posture: periodic internal evaluation

Primary Pillar: Risk Regulations: NERC-CIP · CMMC · · SOX · NIST

What “done” looks like: Annual security assessment cycle with documented scope, findings, and remediation plan; self-assessment results feed risk register and POA&M; Governance tracks findings to closure.

16. Manage risk formally: document, accept, or treat identified risks

Primary Pillar: Governance Regulations: NERC-CIP · CMMC · · SOX · NIST

What “done” looks like: Risk register maintained with owner, severity, treatment status, and target closure date; POA&M current and leadership-reviewed quarterly; risk acceptance documented with CISO or VP sign-off per policy.

17. Protect physical access to critical systems: cyber starts at the door

Primary Pillar: Governance Regulations: NERC-CIP · · NIST ⚠ Unique: NERC-CIP most prescriptive, CIP-006/CIP-014 unique to BES environments

What “done” looks like: Physical access controls documented for all in-scope locations; access lists maintained and reviewed; visitor logs retained; NERC-CIP deviation process invoked when physical security controls are temporarily impaired.

18. Monitor threats continuously: detect what vulnerability scans miss

Primary Pillar: Risk Regulations: NERC-CIP · CMMC · · NIST

What “done” looks like: SIEM or equivalent collecting logs from in-scope systems; defined alert thresholds; analyst review cadence; threat intelligence feeds integrated; OT monitoring via passive methods where active scanning would introduce operational risk.

19. Plan and practice incident response: know what to do before it happens

Primary Pillar: Governance Regulations: NERC-CIP · CMMC · · NIST

What “done” looks like: Documented IR plan with roles, escalation paths, and regulatory notification requirements; tabletop exercise at least annually; CIP-008 reporting timelines documented and practiced; lessons learned feed risk register.

20. Manage recovery: restore operations and capture lessons learned

Primary Pillar: Governance Regulations: NERC-CIP · CMMC · · NIST ⚠ Unique: CIP-009 unique to BES, highly prescriptive on testing cadence

What “done” looks like: Recovery plans documented, tested, and updated annually; backup and restoration tested; post-incident review drives updates to Engineering architecture, Risk assessments, and Governance playbooks.

21. Manage accounts throughout their lifecycle: provisioning through termination

Primary Pillar: Engineering Regulations: NERC-CIP · CMMC · · SOX · NIST

What “done” looks like: Automated provisioning/deprovisioning tied to HR system; access reviews on defined cycle; privileged account inventory; shared/service account governance documented.

22. Define and enforce a compliance calendar: no surprises at audit time

Primary Pillar: Governance Regulations: NERC-CIP · CMMC · · SOX · NIST ⚠ Unique: Governance operational discipline, no direct technical control analog

What “done” looks like: Master compliance calendar covering all frameworks; activities assigned to owners in CERG; upcoming deadlines visible to CISO; evidence collection treated as ongoing, not pre-audit scramble.

Quick Reference: Pillar Summary

Key Consolidation Opportunities

These control areas produce evidence satisfying four or more frameworks simultaneously. One team effort, multiple checkboxes.

1. Asset inventory, CIP-002 + CMMC CM + NIST CM-8
2. Access management, CIP-004/005/007 + CMMC AC + SOX ITGC
3. Configuration change management, CIP-010 + CMMC CM + SOX ITGC
4. Audit evidence and log retention, all CIP standards + CMMC AU + SOX
5. Exposure management, CIP-007/010 + CMMC RM/SI + SOX patch risk
6. Policy and standards, CIP-003 + CMMC (all 14 domains) + SOX ITGC

23. Document Control

Revision History

Review Triggers

• Framework version change (NIST 800-53, NIST 800-171, CMMC, NERC-CIP)
• New regulatory requirement
• Material change to organizational scope
• Direction from the CISO

Related Documents

Source: governance/CERG-GOV-CMX-001_Compliance_Matrix.md · Download .md · View on GitHub