Hi IFIN Folks,
I’ve been exploring how to map NIST 80053 with the exploration from a data science perspective.
The control framework permits the exploration of the control and the related controls.
But beyond just the related controls one could also search for the other considerations about controls, and documentation.
After you select that data you can export your query to python
control_data_next = control_datacontrol_data_next = control_data_next[["Related Controls", "Tags", "Last Updated", "Responsible Team"]]
At it’s core there’s 46 columns that allow documentation to articulate the architecture of the system and the components that can be applied to measure a metric and more clearly write detection engineering within the systems that are operating.
The catch 22 is that if you articulate these things, you should treat that document, and data with the impact it has to the organization if the data were compromised. You can also take the approach of always starting blank and using it as a calculator to make decisions and record the important aspects inside a document management system as prescribed by your institution or organization.
I have some data to clean up so that it’s easier to use, but wanted to get feedback from this group of what you’d like to see in a notebook tool.
This is easy to decorate with other frameworks like MITRE, or NICE if you are writing for a specific group of users and how they would interact with the data.
I’ve attached an html output of the marimo notebook, as a .zip
ControlFramework.zip (105.5 KB)