NIST SP 800-124 Revision 2: every control, and what you already have

34 controls 241 frameworks share controls with it United States verified against its source document

Every control below is one this framework asks for. The right hand column counts how many other frameworks in our corpus carry the same control, which is the difference between doing this work once and doing it again for the next standard.

There is no implementation kit for this framework yet. The control list and the overlap above are free and complete.

What you already have

Frameworks whose controls overlap this one, most first. If you run any of them, the count is roughly what you have already evidenced.

If you run	Shared controls
ISO 27002:2022	15	measure it →
AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association)	10	measure it →
ISO/IEC 27043:2015	10	measure it →
ISO/SAE 21434	10	measure it →
MITRE ATT&CK	10	measure it →
NIST SP 800-115 (Technical Guide to Information Security Testing and Assessment)	10	measure it →
NIST SP 800-123	10	measure it →
NIST SP 800-137	10	measure it →
NIST SP 800-61	10	measure it →
NIST SP 800-63-4	10	measure it →
NIST SP 800-88	10	measure it →
NIST SP 800-92	10	measure it →

Every control

Code	Control	Also in
`800-124r2-2.1`	Mobile Device Threat Model	0
`800-124r2-2.2`	Mobile Device Policy	1
`800-124r2-3.1`	Enterprise Mobility Management Deployment	1
`800-124r2-3.2`	Device Authentication and Enrollment	1
`800-124r2-3.3`	Device Hardening Baselines	1
`800-124r2-3.4`	Mobile Application Vetting	1
`800-124r2-3.5`	Mobile Application Allow and Deny Lists	1
`800-124r2-4.1`	Data Protection on Mobile Devices	1
`800-124r2-4.2`	Data Communication Protection	1
`800-124r2-4.3`	Lost or Stolen Device Procedures	1
`800-124r2-5.1`	Mobile Threat Defense Monitoring	1
`800-124r2-5.2`	Mobile Operating System Updates	1
`800-124r2-5.3`	User Awareness for Mobile Risks	1
`800-124r2-6.1`	BYOD Considerations	1
`800-124r2-6.2`	Corporate Owned Device Models	0
`800-124r2-7.1`	Mobile Device Lifecycle Management	1
`800-124r2-7.2`	Mobile Device Decommissioning	1
`800-124r2-8.1`	Identity and Access Integration	0
`800-124r2-8.2`	Continuous Compliance Reporting	0
`MD124-CTL-01`	Device Authentication and Lock	66
`MD124-CTL-02`	Device Encryption	102
`MD124-CTL-03`	Remote Wipe Capability	0
`MD124-CTL-04`	OS and Application Updates	130
`MD124-CTL-05`	Jailbreak/Root Detection	0
`MD124-CTL-06`	Network Security for Mobile	52
`MD124-POL-01`	Mobile Device Security Policy	37
`MD124-POL-02`	BYOD Policy	135
`MD124-POL-03`	Mobile Data Protection Policy	199
`MD124-POL-04`	Mobile Device Lifecycle Management	154
`MD124-TECH-01`	Enterprise Mobility Management (EMM)	0
`MD124-TECH-02`	Mobile Threat Defense (MTD)	0
`MD124-TECH-03`	Mobile Application Vetting	28
`MD124-TECH-04`	Mobile Application Management (MAM)	0
`MD124-TECH-05`	VPN and Secure Communication	103

Tell me when NIST SP 800-124 Revision 2 files something new

One email when a public company newly discloses something this framework governs, naming the company and what our corpus says it puts in scope. Nothing else, and one click to stop.

What this page is

A control-level reference for NIST SP 800-124 Revision 2, drawn from our framework corpus. Control codes and titles are references to the standard, not reproductions of it. The overlap counts and the auditor artefacts are our own work and are the part you will not find elsewhere.

Measure this against what you already run · All frameworks · Today's edition