Explain how to perform a basic security control mapping to NIST SP 800-53 controls in the context of DSAC Annex F.

• A. Randomly map to NIST controls
• B. Map each Annex F control to relevant NIST 800-53 controls, verify coverage, identify gaps, and adjust implementation
• C. Ignore NIST mapping
• D. Map only high-level controls without verification

Answer: (B)

The essential idea is to create a traceable mapping from every Annex F security control to the relevant NIST SP 800-53 controls and to verify that all Annex F requirements are covered, with gaps identified and remediation planned. Start by listing all Annex F controls that apply to the system or environment you’re evaluating. For each one, identify the most appropriate NIST SP 800-53 control(s) that provide equivalent or supporting requirements, and document why that NIST control is a fit. This creates a clear justification that the Annex F need is satisfied by established, auditable controls.

Next, build a mapping record that shows Annex F control, mapped NIST control IDs, the rationale for the mapping, the implementation status, and the available evidence. Then assess coverage: ensure every Annex F requirement has at least one NIST control mapped to it and that the mapped controls are actually implemented and tested in your environment. If a requirement isn’t fully addressed, identify gaps, propose corrective actions, and adjust the implementation plan or add compensating controls as needed. This approach not only ensures alignment with a widely used standard but also provides a clear, auditable trail for assessments and continuous monitoring.

Why this approach is the best choice is that it yields defensible, repeatable coverage of Annex F using a well-established control catalog, makes traceability explicit for auditors, and supports risk-based decision making. It avoids the pitfalls of random or incomplete mapping, and it goes beyond a surface alignment by requiring verification and evidence. Mapping only at a high level without checking implementation or updating evidence can leave gaps, and ignoring the mapping altogether misses the opportunity to demonstrate control effectiveness.