NIST Consulting

US buyers, GCCs, and federal-style questionnaires rarely ask Indian firms for “an ISO stamp on NIST.” They ask whether you can show a current profile against a named NIST publication. Ace implements the four publications that actually show up in those RFPs: NIST CSF 2.0, SP 800-53, SP 800-171, and the AI Risk Management Framework.

NIST documents are voluntary public frameworks (except where a contract names them). They are not IAF management-system certificates. Ace does not issue a NIST certificate, a CISA attestation, or a CMMC status. We build the target profile, close gaps against your live ISO 27001 / SOC work, and leave an evidence pack a customer or independent assessor can review.

NIST CSF 2.0 — the language most questionnaires use

The Cybersecurity Framework 2.0 is how boards and US customers talk about cyber risk. Version 2.0 added Govern to the original five functions. The six functions are:

• Govern — strategy, roles, supply-chain cyber, oversight. This is what was missing when CSF was only a technical cycle.
• Identify — assets, data, suppliers, and risks you actually have, not a generic asset dump.
• Protect — access, awareness, data security, platform hardening, maintenance.
• Detect — anomalies, continuous monitoring, security logs you can produce in an incident.
• Respond — playbooks, communications, analysis, mitigation.
• Recover — restoration, improvements after incidents, communications to customers.

CSF 2.0 is adaptable. A 40-person SaaS company and a multi-site manufacturer both use the same functions with different profiles. It does not “ensure legal compliance” by itself. It organises how you manage risk so ISO 27001, SOC 2, DPDP, and customer riders have a common spine.

NIST SP 800-171 — CUI on non-federal systems

SP 800-171 is for organisations that store, process, or transmit Controlled Unclassified Information (CUI) for the US government outside federal systems. Indian IT, engineering, and manufacturing suppliers hit it when a prime contractor’s DFARS or flow-down clause names 800-171. Confidentiality of that CUI is the centre of gravity.

Requirements are grouped in 14 families: access control; awareness and training; audit and accountability; configuration management; identification and authentication; incident response; maintenance; media protection; personnel security; physical protection; risk assessment; security assessment; system and communications protection; system and information integrity. Ace implements the families that apply to your CUI scope — we do not paste all 110+ requirements onto a firm that never sees CUI.

800-171 is not ISO 27001 and not CMMC. CMMC uses 800-171 as a control base for some levels; a CMMC assessment is a separate US programme. Ace does not claim CMMC-AB status.

NIST SP 800-53 — the control catalogue

SP 800-53 (currently Rev. 5) is a catalogue of security and privacy controls used to build baselines for federal information systems and for contractors who are told to “use 800-53 moderate.” Systems are typically categorised (low / moderate / high) and a baseline is selected, then tailored. That is not the same as CSF’s six functions. CSF tells you what outcomes to manage; 800-53 gives you which controls to pick. Mixing those two (a common competitor error) produces a pretty page and a useless gap report.

Indian GCCs and SaaS vendors see 800-53 in US federal, FFRDC, and large-bank questionnaires. We map your ISO 27001 Annex A / SOC TSC set to the requested 800-53 families instead of rewriting the ISMS from scratch.

NIST AI RMF — Govern, Map, Measure, Manage

The AI Risk Management Framework (AI RMF 1.0, January 2023) is voluntary guidance for risks to people, organisations, and society from AI. Core functions are Govern, Map, Measure, Manage — not CSF’s six. Trustworthy-AI characteristics include validity, safety, security, accountability, explainability, privacy, and fairness with harmful bias managed. NIST also published a generative AI profile (NIST-AI-600-1) and playbook/crosswalk material. A critical-infrastructure AI profile is in development; we will use the published text, not rumours.

AI RMF is not a certification and not a substitute for ISO/IEC 42001. Use AI RMF to structure risk work; use 42001 when a customer wants an auditable AI management system. Ace implements both on the same inventory so you do not keep two AI registers.

Which publication do you actually need?

• Customer cyber questionnaire / board language — start with CSF 2.0, usually as an overlay on ISO 27001.
• US government CUI / DFARS flow-down — 800-171 scoped to the CUI environment.
• “Implement 800-53 moderate/high” in a US federal or prime contract — 800-53 baseline, tailored.
• AI products, copilots, models — AI RMF plus ISO 42001 if they want a CB audit.