Information SecurityUnited States

NIST SP 800-128

What is NIST SP 800-128?

Guide for Security-Focused Configuration Management. It comprises 39 controls organised across 10 domains, published by NIST, and applies in the United States.

How NIST SP 800-128 maps to other frameworks

All 39 controls, each one mapped to the equivalent requirement in other standards, with the evidence that carries across and the mappings that were judged and rejected shown alongside. No account needed to look.

See the control mappings →

The 10 domains NIST SP 800-128 groups its controls into

Monitoring

Controlling Configuration Changes

Identifying & Implementing Configurations

Planning

NIST SP 800-128: Access Control

Where NIST SP 800-128 overlaps with the standards you already hold

NIST SP 800-128 vs ISO 27001:2022View comparison →NIST SP 800-128 vs SOC 2View comparison →NIST SP 800-128 vs NIST CSF 2.0View comparison →NIST SP 800-128 vs GDPRView comparison →NIST SP 800-128 vs HIPAAView comparison →NIST SP 800-128 vs PCI DSS 4.0View comparison →

What NIST SP 800-128 means in your sector

NIST SP 800-128 for Healthcare→NIST SP 800-128 for Financial Services→NIST SP 800-128 for Technology→NIST SP 800-128 for Government→NIST SP 800-128 for Manufacturing→NIST SP 800-128 for Energy→NIST SP 800-128 for Retail→NIST SP 800-128 for Education→

What NIST SP 800-128 means for your job

NIST SP 800-128 for CISOs→NIST SP 800-128 for Compliance Officers→NIST SP 800-128 for Risk Managers→NIST SP 800-128 for IT Directors→NIST SP 800-128 for DPOs→NIST SP 800-128 for Auditors→

Questions people ask about NIST SP 800-128

What is NIST SP 800-128?

Guide for Security-Focused Configuration Management.

How many controls does NIST SP 800-128 have?

NIST SP 800-128 contains 39 controls organized across 10 domains.

Where does NIST SP 800-128 apply?

NIST SP 800-128 is applicable in United States. Organizations operating in or serving customers in this jurisdiction should evaluate its requirements.

What frameworks does NIST SP 800-128 map to?

NIST SP 800-128 has control-to-control mappings with 7 other compliance frameworks in our database. Use our compliance platform to explore these mappings interactively.

How do I get started with NIST SP 800-128 compliance?

Start by understanding the framework's key controls and domains. Our compliance platform provides AI-powered gap analysis and mapping tools to help you assess your current posture and build a remediation plan.

Query NIST SP 800-128 programmatically

NIST SP 800-128, its 39 controls and every mapping into other standards are available over a REST endpoint and an MCP server, so an agent can read them directly. The free tier is 10 calls a day and needs no signup.

NIST SP 800-128 API reference and MCP config →

What NIST SP 800-128 requires, control by control

Each page carries the requirement text for one NIST SP 800-128 control and what an assessor expects to see as evidence.

How ready are you for NIST SP 800-128?

Answer 25 questions and get a professional readiness report with gap analysis, maturity scores, and prioritised action items. Results in 5 minutes.

Explore Platform Free

Written and maintained by Gerard Blokdyk, The Art of Service.Last updated 31 May 2026.

Information SecurityUnited States

NIST SP 800-128

What is NIST SP 800-128?

Guide for Security-Focused Configuration Management. It comprises 39 controls organised across 10 domains, published by NIST, and applies in the United States.

How NIST SP 800-128 maps to other frameworks

See the control mappings →

The 10 domains NIST SP 800-128 groups its controls into

Monitoring

Controlling Configuration Changes

Identifying & Implementing Configurations

Planning

NIST SP 800-128: Access Control

Where NIST SP 800-128 overlaps with the standards you already hold

What NIST SP 800-128 means in your sector

What NIST SP 800-128 means for your job

NIST SP 800-128 for CISOs→NIST SP 800-128 for Compliance Officers→NIST SP 800-128 for Risk Managers→NIST SP 800-128 for IT Directors→NIST SP 800-128 for DPOs→NIST SP 800-128 for Auditors→

Questions people ask about NIST SP 800-128

What is NIST SP 800-128?

Guide for Security-Focused Configuration Management.

How many controls does NIST SP 800-128 have?

NIST SP 800-128 contains 39 controls organized across 10 domains.

Where does NIST SP 800-128 apply?

NIST SP 800-128 is applicable in United States. Organizations operating in or serving customers in this jurisdiction should evaluate its requirements.

What frameworks does NIST SP 800-128 map to?

NIST SP 800-128 has control-to-control mappings with 7 other compliance frameworks in our database. Use our compliance platform to explore these mappings interactively.

How do I get started with NIST SP 800-128 compliance?

Query NIST SP 800-128 programmatically

NIST SP 800-128 API reference and MCP config →

What NIST SP 800-128 requires, control by control

Each page carries the requirement text for one NIST SP 800-128 control and what an assessor expects to see as evidence.

How ready are you for NIST SP 800-128?

Answer 25 questions and get a professional readiness report with gap analysis, maturity scores, and prioritised action items. Results in 5 minutes.

Explore Platform Free

Written and maintained by Gerard Blokdyk, The Art of Service.Last updated 31 May 2026.