← Frameworks / Qatar NIA / Control Mappings

Machine-readable: JSON API guide

Qatar National Information Assurance Policy v2.0

Mandatory information assurance policy for all Qatar government entities and critical infrastructure operators. 11 security domains modeled on ISO 27001 and NIST 800-53 with a 3-tier classification system (Basic, Advanced, Critical). Covers governance, risk management, asset management, HR security, physical security, communications, operations, access control, systems development, incident management, and business continuity.

Controls: 229
Total Mappings: 271
Publisher: National Cyber Security Agency (NCSA) Version: 2.0
Qatar NIA → SP 800-53 SP 800-53 → Qatar NIA Coverage Analysis
AC (23) AT (5) AU (15) CA (8) CM (14) CP (13) IA (12) IR (9) MP (8) PE (23) PL (6) PM (18) PS (9) RA (7) SA (15) SC (29) SI (8) SR (7)

AC Access Control

Control Name Qatar NIA References
AC-01 Policy and Procedures
AC
AC-02 Account Management
AC
AC-03 Access Enforcement
AC
AC-04 Information Flow Enforcement
ACCS
AC-05 Separation of Duties
AC
AC-06 Least Privilege
AC
AC-07 Unsuccessful Logon Attempts
AC
AC-08 System Use Notification
AC
AC-09 Previous Logon Notification
AC
AC-10 Concurrent Session Control
AC
AC-11 Device Lock
AC
AC-12 Session Termination
AC
AC-13 Supervision and Review — Access Control
AC
AC-14 Permitted Actions Without Identification or Authentication
AC
AC-16 Security and Privacy Attributes
ACAM
AC-17 Remote Access
ACCS
AC-18 Wireless Access
ACCS
AC-19 Access Control for Mobile Devices
AC
AC-20 Use of External Systems
ACCS
AC-21 Information Sharing
AC
AC-22 Publicly Accessible Content
AC
AC-24 Access Control Decisions
AC
AC-25 Reference Monitor
AC

AT Awareness and Training

Control Name Qatar NIA References
AT-01 Policy and Procedures
GVHR
AT-02 Literacy Training and Awareness
HR
AT-03 Role-based Training
HR
AT-04 Training Records
HR
AT-06 Training Feedback
HR

AU Audit and Accountability

Control Name Qatar NIA References
AU-01 Policy and Procedures
OS
AU-02 Event Logging
OS
AU-03 Content of Audit Records
OS
AU-04 Audit Log Storage Capacity
OS
AU-05 Response to Audit Logging Process Failures
OS
AU-06 Audit Record Review, Analysis, and Reporting
IMOS
AU-07 Audit Record Reduction and Report Generation
IMOS
AU-08 Time Stamps
OS
AU-09 Protection of Audit Information
OS
AU-10 Non-repudiation
OS
AU-11 Audit Record Retention
OS
AU-12 Audit Record Generation
OS
AU-13 Monitoring for Information Disclosure
OS
AU-14 Session Audit
OS
AU-16 Cross-organizational Audit Logging
OS

CA Security Assessment and Authorization

Control Name Qatar NIA References
CA-01 Policy and Procedures
GV
CA-02 Control Assessments
GVOSRMSD
CA-03 Information Exchange
CS
CA-05 Plan of Action and Milestones
GVRM
CA-06 Authorization
GV
CA-07 Continuous Monitoring
GVOSRM
CA-08 Penetration Testing
OS
CA-09 Internal System Connections
CS

CM Configuration Management

Control Name Qatar NIA References
CM-01 Policy and Procedures
OS
CM-02 Baseline Configuration
OSSD
CM-03 Configuration Change Control
OSSD
CM-04 Impact Analyses
OSSD
CM-05 Access Restrictions for Change
OSSD
CM-06 Configuration Settings
OS
CM-07 Least Functionality
OS
CM-08 System Component Inventory
AMOS
CM-09 Configuration Management Plan
OS
CM-10 Software Usage Restrictions
OS
CM-11 User-installed Software
OS
CM-12 Information Location
AMOS
CM-13 Data Action Mapping
AM
CM-14 Signed Components
OSSD

CP Contingency Planning

Control Name Qatar NIA References
CP-01 Policy and Procedures
BC
CP-02 Contingency Plan
BC
CP-03 Contingency Training
BC
CP-04 Contingency Plan Testing
BC
CP-05 Contingency Plan Update
BC
CP-06 Alternate Storage Site
BC
CP-07 Alternate Processing Site
BC
CP-08 Telecommunications Services
BC
CP-09 System Backup
BCOS
CP-10 System Recovery and Reconstitution
BCOS
CP-11 Alternate Communications Protocols
BC
CP-12 Safe Mode
BC
CP-13 Alternative Security Mechanisms
BC

IA Identification and Authentication

Control Name Qatar NIA References
IA-01 Policy and Procedures
AC
IA-02 Identification and Authentication (Organizational Users)
AC
IA-03 Device Identification and Authentication
AC
IA-04 Identifier Management
AC
IA-05 Authenticator Management
AC
IA-06 Authentication Feedback
AC
IA-07 Cryptographic Module Authentication
AC
IA-08 Identification and Authentication (Non-organizational Users)
AC
IA-09 Service Identification and Authentication
AC
IA-10 Adaptive Authentication
AC
IA-11 Re-authentication
AC
IA-12 Identity Proofing
AC

IR Incident Response

Control Name Qatar NIA References
IR-01 Policy and Procedures
IM
IR-02 Incident Response Training
IM
IR-03 Incident Response Testing
IM
IR-04 Incident Handling
IM
IR-05 Incident Monitoring
IM
IR-06 Incident Reporting
IM
IR-07 Incident Response Assistance
IM
IR-08 Incident Response Plan
IM
IR-09 Information Spillage Response
IM

MP Media Protection

Control Name Qatar NIA References
MP-01 Policy and Procedures
AM
MP-02 Media Access
AM
MP-03 Media Marking
AM
MP-04 Media Storage
AM
MP-05 Media Transport
AM
MP-06 Media Sanitization
AM
MP-07 Media Use
AM
MP-08 Media Downgrading
AM

PE Physical and Environmental Protection

Control Name Qatar NIA References
PE-01 Policy and Procedures
PS
PE-02 Physical Access Authorizations
HRPS
PE-03 Physical Access Control
PS
PE-04 Access Control for Transmission
PS
PE-05 Access Control for Output Devices
PS
PE-06 Monitoring Physical Access
PS
PE-07 Visitor Control
PS
PE-08 Visitor Access Records
PS
PE-09 Power Equipment and Cabling
PS
PE-10 Emergency Shutoff
PS
PE-11 Emergency Power
PS
PE-12 Emergency Lighting
PS
PE-13 Fire Protection
PS
PE-14 Environmental Controls
PS
PE-15 Water Damage Protection
PS
PE-16 Delivery and Removal
AMPS
PE-17 Alternate Work Site
PS
PE-18 Location of System Components
PS
PE-19 Information Leakage
PS
PE-20 Asset Monitoring and Tracking
PS
PE-21 Electromagnetic Pulse Protection
PS
PE-22 Component Marking
PS
PE-23 Facility Location
PS

PL Planning

Control Name Qatar NIA References
PL-01 Policy and Procedures
GV
PL-02 System Security and Privacy Plans
GVRM
PL-04 Rules of Behavior
GVHR
PL-09 Central Management
GV
PL-10 Baseline Selection
GVRM
PL-11 Baseline Tailoring
GV

PM Program Management

Control Name Qatar NIA References
PM-01 Information Security Program Plan
GV
PM-02 Information Security Program Leadership Role
GV
PM-03 Information Security and Privacy Resources
GV
PM-04 Plan of Action and Milestones Process
RM
PM-05 System Inventory
AMGV
PM-06 Measures of Performance
GV
PM-07 Enterprise Architecture
GV
PM-08 Critical Infrastructure Plan
BC
PM-09 Risk Management Strategy
GVRM
PM-10 Authorization Process
GV
PM-11 Mission and Business Process Definition
BC
PM-13 Security and Privacy Workforce
GV
PM-14 Testing, Training, and Monitoring
GVIM
PM-15 Security and Privacy Groups and Associations
GV
PM-28 Risk Framing
GVRM
PM-30 Supply Chain Risk Management Strategy
GV
PM-31 Continuous Monitoring Strategy
GV
PM-32 Purposing
GV

PS Personnel Security

Control Name Qatar NIA References
PS-01 Policy and Procedures
HR
PS-02 Position Risk Designation
HR
PS-03 Personnel Screening
HR
PS-04 Personnel Termination
HR
PS-05 Personnel Transfer
HR
PS-06 Access Agreements
HR
PS-07 External Personnel Security
HR
PS-08 Personnel Sanctions
HR
PS-09 Position Descriptions
GVHR

RA Risk Assessment

Control Name Qatar NIA References
RA-01 Policy and Procedures
GVRM
RA-02 Security Categorization
AMRM
RA-03 Risk Assessment
RM
RA-05 Vulnerability Monitoring and Scanning
OSRM
RA-07 Risk Response
OSRM
RA-09 Criticality Analysis
RM
RA-10 Threat Hunting
RM

SA System and Services Acquisition

Control Name Qatar NIA References
SA-01 Policy and Procedures
GVSD
SA-02 Allocation of Resources
GVSD
SA-03 System Development Life Cycle
SD
SA-04 Acquisition Process
SD
SA-05 System Documentation
SD
SA-08 Security and Privacy Engineering Principles
SD
SA-09 External System Services
SD
SA-10 Developer Configuration Management
SD
SA-11 Developer Testing and Evaluation
SD
SA-15 Development Process, Standards, and Tools
SD
SA-16 Developer-provided Training
SD
SA-17 Developer Security and Privacy Architecture and Design
SD
SA-20 Customized Development of Critical Components
SD
SA-21 Developer Screening
SD
SA-22 Unsupported System Components
SD

SC System and Communications Protection

Control Name Qatar NIA References
SC-01 Policy and Procedures
CS
SC-02 Separation of System and User Functionality
CS
SC-03 Security Function Isolation
CS
SC-04 Information in Shared System Resources
AMCS
SC-05 Denial-of-service Protection
CS
SC-07 Boundary Protection
CS
SC-08 Transmission Confidentiality and Integrity
CS
SC-10 Network Disconnect
CS
SC-11 Trusted Path
CS
SC-12 Cryptographic Key Establishment and Management
CS
SC-13 Cryptographic Protection
CS
SC-15 Collaborative Computing Devices and Applications
CS
SC-16 Transmission of Security and Privacy Attributes
CS
SC-17 Public Key Infrastructure Certificates
CS
SC-20 Secure Name/Address Resolution Service (Authoritative Source)
CS
SC-21 Secure Name/Address Resolution Service (Recursive or Caching Resolver)
CS
SC-22 Architecture and Provisioning for Name/Address Resolution Service
CS
SC-23 Session Authenticity
CS
SC-26 Decoys
CS
SC-28 Protection of Information at Rest
CS
SC-32 System Partitioning
CS
SC-36 Distributed Processing and Storage
CS
SC-37 Out-of-band Channels
CS
SC-38 Operations Security
CS
SC-39 Process Isolation
CS
SC-40 Wireless Link Protection
CS
SC-44 Detonation Chambers
CS
SC-46 Cross Domain Policy Enforcement
CS
SC-47 Alternate Communications Paths
CS

SI System and Information Integrity

Control Name Qatar NIA References
SI-02 Flaw Remediation
OS
SI-03 Malicious Code Protection
OS
SI-04 System Monitoring
IMOS
SI-05 Security Alerts, Advisories, and Directives
IMOS
SI-07 Software, Firmware, and Information Integrity
OS
SI-08 Spam Protection
CS
SI-13 Predictable Failure Prevention
BC
SI-16 Memory Protection
OS

SR Supply Chain Risk Management

Control Name Qatar NIA References
SR-01 Policy and Procedures
SD
SR-02 Supply Chain Risk Management Plan
SD
SR-03 Supply Chain Controls and Processes
SD
SR-04 Provenance
SD
SR-05 Acquisition Strategies, Tools, and Methods
SD
SR-06 Supplier Assessments and Reviews
SD
SR-12 Component Disposal
AM