Related Standards & Frameworks

Reference · Ioannis Alexander Konstas

The CCIE and CISSP material doesn't exist in a vacuum — most of it is a practitioner's-eye view of standards that government and industry already formalized. This page maps the ones most worth knowing by name to the domain or topic they back up, with a link to the primary source rather than a summary.

Governance, risk, and the RMF

• NIST SP 800-37 Rev. 2 — the Risk Management Framework itself: categorize, select, implement, assess, authorize, monitor. → CISSP Domain 1
• NIST SP 800-30 Rev. 1 — how to actually conduct a risk assessment; pairs with the SLE/ALE/ARO math. → CISSP Domain 1
• FIPS 199 — standardizes security categorization (low/moderate/high impact) that RMF categorization is built on. → CISSP Domain 1
• FIPS 200 — minimum security requirements that map to an SP 800-53 control baseline. → CISSP Domain 1
• NIST Cybersecurity Framework (CSF) — the widely adopted Identify/Protect/Detect/Respond/Recover structure for organizing a security program. → CISSP Domain 1

Controls and secure architecture

• NIST SP 800-53 Rev. 5 — the actual control catalog; what a "baseline" in Domain 2 concretely consists of. → CISSP Domains 1–3
• NIST SP 800-53A Rev. 5 — the assessment procedures for those controls: how you actually verify a control is implemented, not just documented. → CISSP Domain 6
• Common Criteria (ISO/IEC 15408) — the evaluation standard behind Protection Profiles and EAL ratings. → CISSP Domain 3
• NIST SP 800-207 — Zero Trust Architecture, the formal version of "never trust, always verify." → CISSP Domains 3–4
• NIST SP 800-171 Rev. 3 — protecting Controlled Unclassified Information on non-federal systems; the standard defense contractors are assessed against. → CISSP Domains 1–3

Cryptography and network security

The direct overlap between the two tracks — the same crypto/IPsec material shows up as exam-topic detail on the CCIE side and as design principle on the CISSP side.

• FIPS 140-3 — security requirements for cryptographic modules; the standard behind "FIPS-validated" crypto claims. → CISSP Domain 3 · CCIE 1.5/3.3 (crypto, IPsec/IKEv2)
• NIST SP 800-77 Rev. 1 — Guide to IPsec VPNs: AH vs. ESP, transport vs. tunnel mode, IKE negotiation. → CISSP Domain 4 · CCIE 3.3 (DMVPN, IPsec/IKEv2)

Asset and data handling

• NIST SP 800-88 Rev. 1 — the clear/purge/destroy sanitization standard referenced directly in the domain notes. → CISSP Domain 2

Identity and access

• NIST SP 800-63-4 — Digital Identity Guidelines: identity proofing, authenticator assurance levels, and federation assurance levels behind any serious MFA/IAM design. → CISSP Domain 5

Operations, monitoring, and incident response

• NIST SP 800-61 Rev. 2 — the Computer Security Incident Handling Guide the domain notes' incident lifecycle is aligned to. → CISSP Domain 7
• NIST SP 800-137 — Information Security Continuous Monitoring; the formal basis for "detective controls" as an ongoing program, not a one-time audit. → CISSP Domain 7

Software development

• NIST SP 800-218 — the Secure Software Development Framework (SSDF): practices for building security into the SDLC rather than testing for it afterward. → CISSP Domain 8

DoD-specific

• DoD Cybersecurity Policy Chart — a single-page map of the entire DoD cybersecurity policy landscape (strategy, RMF, ICAM, CND, acquisition, workforce), color-coded by originating authority with direct links to each source document. This page's DoD/NIST picks above were selected against it; it's the better starting point for anything not already listed here. Maintained by DoDIAC/CSIAC, updated regularly (last updated April 2025).
• DoD 8140.01 (Cyberspace Workforce Management, superseding the older DoD 8570.01-M) — the policy that names CISSP as an approved baseline certification for IAM Level II/III and IASAE workforce roles. It's the actual reason CISSP shows up as a hard requirement in DoD/defense-contractor job postings, and it's on the chart above under workforce policy. The DoD Cyber Workforce Framework tool that applies it to specific roles sits behind CAC/PKI authentication, so it isn't independently linkable from a public page.
• public.cyber.mil — DoD Cyber Exchange, the public-facing index of current DoD cybersecurity policy, instructions, and STIGs.

← Back to Information Security