NIST SP 800-190: every control, and what you already have

45 controls 233 frameworks share controls with it United States verified against its source document

Every control below is one this framework asks for. The right hand column counts how many other frameworks in our corpus carry the same control, which is the difference between doing this work once and doing it again for the next standard.

NIST SP 800-190 Application Container Security Evidence & Implementation Kit

45 controls is the documentation set somebody has to write. This is that set, already written: an adopt-ready artifact for every control in policy and procedure text you edit rather than draft, and the evidence checklist an auditor asks for against each.

See what is in it, $249

The same set every buyer of this kit receives. Nothing here is produced on request.

What you already have

Frameworks whose controls overlap this one, most first. If you run any of them, the count is roughly what you have already evidenced.

If you run	Shared controls
ISO 27017	19	measure it →
ISO 27018	19	measure it →
Singapore Government Instruction Manual on ICT&SS Management (IM8)	13	measure it →
South Korea ISMS-P	13	measure it →
NIST SP 800-53 Rev 5	13	measure it →
NIST Privacy Framework	13	measure it →
AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association)	12	measure it →
BSI IT-Grundschutz	12	measure it →
Oman National Cybersecurity Framework	12	measure it →
NIST SP 800-124 Revision 2	11	measure it →
NIST SP 800-82 Revision 3: Guide to Industrial Control Systems (ICS) Security	11	measure it →
TISAX	11	measure it →

Every control

Code	Control	Also in
`NIST190-01`	Shared responsibility model definition	120
`NIST190-02`	Cloud security policy and strategy	10
`NIST190-03`	Cloud risk assessment	95
`NIST190-04`	Regulatory compliance for cloud services	35
`NIST190-05`	Cloud security roles and responsibilities	10
`NIST190-06`	Cloud identity management	24
`NIST190-07`	Multi-factor authentication for cloud	56
`NIST190-08`	Privileged access in cloud environments	50
`NIST190-09`	Federation and single sign-on	0
`NIST190-10`	API security and access tokens	0
`NIST190-11`	Data classification for cloud	89
`NIST190-12`	Encryption of cloud-stored data	109
`NIST190-13`	Data residency and sovereignty	0
`NIST190-14`	Data backup and recovery in cloud	53
`NIST190-15`	Secure data deletion in cloud	64
`NIST190-16`	Virtual network segmentation	41
`NIST190-17`	Container and serverless security	0
`NIST190-18`	Cloud workload protection	0
`NIST190-19`	Image and template hardening	37
`NIST190-20`	Cloud configuration management	37
`NIST190-21`	Cloud security monitoring and logging	65
`NIST190-22`	Incident response in cloud	84
`NIST190-23`	Cloud vulnerability management	40
`NIST190-24`	Cloud change management	29
`NIST190-25`	Service level agreement management	0
`SP800-190-3.1`	Container Image Vulnerability Management	0
`SP800-190-3.10`	Network Segmentation Between Pods	0
`SP800-190-3.11`	Mixed Sensitivity Workload Isolation	0
`SP800-190-3.12`	Container Runtime Hardening	0
`SP800-190-3.13`	Host Operating System Minimization	0
`SP800-190-3.14`	Host Patch Management	0
`SP800-190-3.15`	Container File System Integrity	0
`SP800-190-3.16`	Container Logging and Visibility	0
`SP800-190-3.17`	Runtime Threat Detection	0
`SP800-190-3.18`	Incident Response for Containers	0
`SP800-190-3.19`	Supply Chain Risk for Third Party Images	0
`SP800-190-3.2`	Image Configuration Hardening	0
`SP800-190-3.20`	Secrets Management at Runtime	0
`SP800-190-3.3`	Embedded Secrets in Images	0
`SP800-190-3.4`	Image Trust and Provenance	0
`SP800-190-3.5`	Registry Authentication and Authorization	0
`SP800-190-3.6`	Registry Image Freshness	0
`SP800-190-3.7`	Orchestrator Authentication	0
`SP800-190-3.8`	Orchestrator Authorization with RBAC	0
`SP800-190-3.9`	Pod Security Standards	0

Tell me when NIST SP 800-190 files something new

One email when a public company newly discloses something this framework governs, naming the company and what our corpus says it puts in scope. Nothing else, and one click to stop.

What an auditor will ask you to produce

The artefacts named on the failure modes this framework speaks to.

IAM policy
MFA enforcement report
Federation configuration
API token inventory
Kerberos/OAuth/FIDO2 configuration
session token settings
scan tool configuration
sample selection rationale
scan report with CVSS scores
remediation evidence

How programmes fail on this

Failure modes named by this framework and others. Each opens the full record.

Long-lived tokens named by 5 frameworks
unauthenticated scans only named by 3 frameworks

What this page is

A control-level reference for NIST SP 800-190, drawn from our framework corpus. Control codes and titles are references to the standard, not reproductions of it. The overlap counts and the auditor artefacts are our own work and are the part you will not find elsewhere.

Measure this against what you already run · All frameworks · Today's edition