VoraPrep
Start Free Trial
NIST SP 800-37ISACA / NIST / SOC 2cisaVerified 2026-11-12

NIST SP 800-37: COSO, NIST, and the IS Auditor's Role

Authoritative Rule Summary (NIST SP 800-37)

Under NIST SP 800-37 (ISACA / NIST / SOC 2), cOSO, NIST, and the IS Auditor's Role establishes the authoritative rules tested on the ISACA CISA. Go beyond definitions to master the application of key risk management frameworks. VoraPrep verifies every threshold, worked table, and practice question below against the current ISACA CISA blueprint.

Key Risk Frameworks at a Glance

FrameworkPrimary FocusKey AudienceCore Concept
COSO ERM 2017Strategic, enterprise-wide riskBoard, Senior ManagementIntegrating risk management with strategy and performance to create value.
COSO ICIF 2013Effectiveness of internal controlsManagement, Internal/External AuditorsA structured, five-component model for designing and evaluating internal controls.
NIST RMFInformation security & privacy risk for systemsCIO, CISO, System Owners, IS AuditorsA structured, six-step lifecycle for managing security risk in information systems.
NIST CSF 2.0Cybersecurity risk management outcomesAll levels of managementA voluntary framework of best practices to manage cybersecurity risk, structured around functions: Govern, Identify, Protect, Detect, Respond, Recover.
Test Yourself on NIST SP 800-37 in 30 Seconds (No Login)ISACA CISA · medium

An IS auditor is reviewing an IT risk management program where risk assessments are performed for individual IT systems, and controls are implemented based on these siloed assessments. However, the results are not aggregated or analyzed to provide a consolidated view of risk to senior management. What is the IS auditor's GREATEST concern with this approach?

Worked Practitioner Scenario

Worked Example: Applying the NIST RMF at FinSecure

Scenario: FinSecure, a regional bank, is developing a new mobile banking application. An IS auditor is tasked with reviewing the risk management process for the project. The auditor will evaluate how well FinSecure follows the NIST RMF.

  1. Step 1: Categorize Management, in consultation with legal and compliance, classifies the mobile app as a high-impact system because it processes sensitive financial data (PII). A breach could have severe adverse effects on the organization's assets, operations, and individuals.
  2. Step 2: Select Based on the high-impact categorization, the security team selects an initial baseline of security controls from NIST SP 800-53. This includes controls like multi-factor authentication (MFA), end-to-end encryption, and secure coding standards.
  3. Step 3: Implement The development team implements the selected controls within the application's architecture and code. They document how each control is implemented.
  4. Step 4: Assess This is a critical step for the IS auditor. The auditor (or an independent assessor) tests the implemented controls to determine if they are operating as intended. For example, the auditor would perform penetration testing and review code scan results to verify the effectiveness of secure coding controls.
Common wrong answer. If you picked an answer suggesting the IS auditor's primary role is to grant the Authorization to Operate (ATO), you're likely focusing on the auditor's critical input into the authorization decision. The auditor's assessment report is arguably the most important document reviewed by the Authorizing Official, and it directly influences the go/no-go decision. This makes it seem like the auditor holds the final authority. However, this confuses providing assurance with making a business decision. The IS auditor's duty is to provide an independent, objective assessment of risk and control effectiveness. The Authorizing Official, a member of senior management, is responsible for accepting the residual risk on behalf of the organization. Granting the ATO is a management function that would severely impair the auditor's independence if they performed it. Therefore, the auditor's correct role is to provide the necessary findings for management to make an informed risk-based decision, not to make the decision for them.
Exam Watchouts & Statutory Boundaries

Common ISACA CISA Distractors on NIST SP 800-37

  • 1Use this decision framework to dissect exam questions about risk management frameworks.
  • 2Step 1: Identify the Core Problem. Is the question about high-level business strategy and risk appetite, or is it about specific operational controls for a system? This is the most critical distinction.
  • 3Step 2: Check the Scope. Is the scope enterprise-wide (involving the board and strategic objectives) or is it focused on a specific IT system, project, or department?
  • 4Step 3: Match the Problem and Scope to a Framework.
  • 5Strategic + Enterprise-wide? Think COSO ERM. The board is concerned about alignment with business goals.

Frequently Asked Questions: NIST SP 800-37

What is the core rule under NIST SP 800-37 (COSO, NIST, and the IS Auditor's Role)?

Under NIST SP 800-37 (ISACA / NIST / SOC 2), cOSO, NIST, and the IS Auditor's Role establishes the authoritative rules tested on the ISACA CISA. Go beyond definitions to master the application of key risk management frameworks. VoraPrep verifies every threshold, worked table, and practice question below against the current ISACA CISA blueprint.

How is NIST SP 800-37 tested on the ISACA CISA?

Use this decision framework to dissect exam questions about risk management frameworks. Step 1: Identify the Core Problem. Is the question about high-level business strategy and risk appetite, or is it about specific operational controls for a system? This is the most critical distinction.

Where can I practice ISACA CISA questions on COSO, NIST, and the IS Auditor's Role?

Test yourself instantly with the free playable ISACA CISA question on this page, or launch VoraPrep's full ISACA CISA adaptive question bank, interactive lessons, and 1:1 exam simulator at voraprep.com/cisa.

Master NIST SP 800-37 Across the VoraPrep Platform

ISACA CISA Full Review CourseISACA CISA Study Guide HubFree CISA Audio LessonsFree CISA Score & Study CalculatorISACA CISA Continuing Education (VoraCE)SOC 2 Type II & ITGC Audit Lab (Free Module 1)

Related Statutory & Regulatory Rules

All Rules →
ISO/IEC 27001
Information Security Program Lifecycle
GDPR
Risk-Based IS Audit Planning
SOC 2
Cloud Acquisition: TCO, Shared Responsibility, and Audit Strategy
COSO ERM
Enterprise Risk Management (ERM) for Internal Auditors