KCSA — NIST & Industry Standards
NIST & Industry Standards
Multiple industry standards and frameworks apply to Kubernetes environments. For the KCSA exam, you must understand what each standard covers, which organizations publish them, and how they relate to Kubernetes security controls.
NIST Overview
The National Institute of Standards and Technology (NIST) is a US federal agency that develops security standards, guidelines, and best practices. NIST publications are widely adopted globally — not just in US government environments.
NIST publishes several document series relevant to Kubernetes security:
| Publication | Title | Relevance to Kubernetes |
|---|---|---|
| SP 800-190 | Application Container Security Guide | Directly addresses container and orchestrator security |
| SP 800-53 | Security and Privacy Controls | Comprehensive control catalog used across industries |
| Cybersecurity Framework (CSF) | Framework for Improving Critical Infrastructure Cybersecurity | High-level risk management framework |
For the KCSA, NIST SP 800-190 is the most directly relevant publication. Know it well.
NIST SP 800-190 — Application Container Security Guide
NIST SP 800-190 is the foundational NIST document for container security. Published in 2017, it identifies security concerns across the entire container technology stack and provides specific recommendations for each layer.
Five Key Areas of Container Security
NIST SP 800-190 organizes container security risks and countermeasures across five areas:
| Area | Security Concerns | Key Recommendations |
|---|---|---|
| Images | Vulnerabilities in base images, embedded secrets, misconfigured images | Scan images in CI/CD, use trusted base images, don’t embed secrets |
| Registries | Unauthorized access, stale images, insecure connections | Use private registries with TLS, implement access control, scan on push |
| Orchestrators | Unrestricted network access, unauthorized API access, insecure workload configs | Enable RBAC, enforce network policies, use admission controllers |
| Containers | Runtime vulnerabilities, rogue containers, privilege escalation | Drop capabilities, use read-only filesystems, run as non-root |
| Host OS | Large attack surface, shared kernel, unpatched OS | Use minimal OS (container-optimized), patch regularly, harden kernel |
Mapping NIST SP 800-190 to Kubernetes Controls
| NIST 800-190 Recommendation | Kubernetes Control |
|---|---|
| Scan images for vulnerabilities | Image scanning with Trivy, Grype in CI/CD; admission controller to block unscanned images |
| Use trusted base images | Pod Security Admission; OPA/Gatekeeper policies restricting image sources |
| Encrypt data in transit | TLS for API server, etcd peer communication, service mesh (mTLS) |
| Implement network segmentation | Kubernetes Network Policies, CNI-level enforcement |
| Control access to orchestrator API | RBAC, OIDC authentication, API server audit logging |
| Run containers as non-root | Pod Security Standards (restricted profile), securityContext.runAsNonRoot: true |
| Limit container capabilities | securityContext.capabilities.drop: ["ALL"] |
| Use read-only filesystems | securityContext.readOnlyRootFilesystem: true |
NIST SP 800-190 focuses on what to secure. Kubernetes provides the how through its native features and ecosystem tools.
NIST SP 800-53 — Security and Privacy Controls
NIST SP 800-53 is a comprehensive catalog of security and privacy controls for federal information systems. While primarily targeted at US government agencies, it is widely adopted across industries as a reference for security program design.
Relevant Control Families
NIST SP 800-53 organizes controls into families. The following families are most relevant to Kubernetes environments:
| Family | Code | Description | Kubernetes Mapping |
|---|---|---|---|
| Access Control | AC | Restrict system access to authorized users | RBAC, service accounts, OIDC, API server authentication |
| Audit and Accountability | AU | Record and examine system events | Kubernetes audit logging, Falco, log aggregation |
| Configuration Management | CM | Establish and maintain system configurations | CIS Benchmarks, kube-bench, GitOps, admission controllers |
| Identification and Authentication | IA | Verify identity of users and processes | X.509 certificates, OIDC tokens, service account tokens |
| System and Communications Protection | SC | Protect communications and system integrity | TLS everywhere, Network Policies, encryption at rest |
| System and Information Integrity | SI | Detect and respond to flaws and attacks | Image scanning, runtime monitoring, vulnerability management |
Example: Access Control (AC) Family in Kubernetes
| NIST Control | Description | Kubernetes Implementation |
|---|---|---|
| AC-2 Account Management | Manage user accounts through lifecycle | RBAC Roles and RoleBindings, ServiceAccount management |
| AC-3 Access Enforcement | Enforce approved authorizations | RBAC authorization mode, admission controllers |
| AC-6 Least Privilege | Restrict privileges to minimum needed | Granular RBAC, Pod Security Standards, drop capabilities |
| AC-17 Remote Access | Authorize and monitor remote access | API server authentication, kubectl access control, audit logs |
NIST Cybersecurity Framework (CSF)
The NIST Cybersecurity Framework provides a high-level, risk-based approach to managing cybersecurity. It is organized around five core functions:
| Function | Purpose | Kubernetes Examples |
|---|---|---|
| Identify | Know your assets, risks, and governance | Cluster inventory, namespace mapping, asset tagging |
| Protect | Implement safeguards for critical services | RBAC, Network Policies, Pod Security Standards, encryption |
| Detect | Identify cybersecurity events in real time | Audit logging, Falco runtime detection, monitoring alerts |
| Respond | Take action on detected events | Incident response procedures, automated policy enforcement |
| Recover | Restore capabilities after an incident | Backup/restore (Velero), disaster recovery, post-mortem process |
The CSF is not prescriptive — it provides a structure for organizing your security program. The specific controls come from frameworks like NIST SP 800-53 or CIS Benchmarks.
NIST CSF in Practice
A practical way to think about the CSF for Kubernetes:
┌──────────────────────────────────────────────────────────┐
│ NIST CSF Functions │
├────────────┬───────────┬──────────┬──────────┬───────────┤
│ IDENTIFY │ PROTECT │ DETECT │ RESPOND │ RECOVER │
├────────────┼───────────┼──────────┼──────────┼───────────┤
│ Asset │ RBAC │ Audit │ Incident │ Backup │
│ inventory │ NetPol │ Logging │ Response │ Restore │
│ Risk │ PSS │ Falco │ Auto │ Disaster │
│ assessment │ TLS │ Alerts │ Remediate│ Recovery │
└────────────┴───────────┴──────────┴──────────┴───────────┘
ISO 27001 — Information Security Management System
ISO 27001 is an international standard published by the International Organization for Standardization (ISO). It specifies requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS).
Key Characteristics
| Aspect | Details |
|---|---|
| Publisher | ISO (International Organization for Standardization) |
| Scope | Organization-wide information security management |
| Certification | Organizations can be independently audited and certified |
| Structure | Management system requirements + Annex A controls |
| Focus | Risk management approach to information security |
ISO 27001 Annex A Controls Relevant to Kubernetes
| Control Area | ISO 27001 Annex A | Kubernetes Mapping |
|---|---|---|
| Access control | A.9 | RBAC, authentication mechanisms |
| Cryptography | A.10 | TLS, encryption at rest, Secret management |
| Operations security | A.12 | Change management (GitOps), logging, monitoring |
| Communications security | A.13 | Network Policies, service mesh mTLS |
| System acquisition and development | A.14 | Secure CI/CD, image scanning, admission control |
| Supplier relationships | A.15 | Third-party image vetting, supply chain security |
ISO 27001 is about process and governance, not specific technical controls. It defines what an organization must do to manage security — the technical implementation (like Kubernetes RBAC) is how you fulfill those requirements.
SOC 2 Trust Service Principles
SOC 2 (System and Organization Controls 2) is an auditing standard developed by the American Institute of Certified Public Accountants (AICPA). It evaluates service organizations against five Trust Service Criteria.
| Principle | Description | Kubernetes Relevance |
|---|---|---|
| Security | Protection against unauthorized access | RBAC, Network Policies, encryption, admission controllers |
| Availability | System is operational and accessible | High availability configuration, resource limits, monitoring |
| Processing Integrity | System processing is complete, valid, and accurate | Admission controllers, validation webhooks, audit logging |
| Confidentiality | Confidential information is protected | Secret management, encryption at rest and in transit, RBAC |
| Privacy | Personal information is collected, used, retained, and disclosed properly | Namespace isolation, data residency controls, access logging |
SOC 2 Type I vs Type II
| Type | What It Evaluates | Duration |
|---|---|---|
| Type I | Design of controls at a specific point in time | Snapshot |
| Type II | Operating effectiveness of controls over a period (typically 6-12 months) | Continuous |
SOC 2 Type II is more rigorous because it verifies that controls work consistently over time, not just that they exist on paper.
Standards Comparison
Understanding the differences between these frameworks is essential for the exam.
| Standard | Publisher | Scope | Audience | Mandatory? | Focus |
|---|---|---|---|---|---|
| CIS Benchmarks | CIS | Specific platform configuration | Operations/Security teams | Voluntary | Technical configuration baselines |
| NIST SP 800-190 | NIST | Container security | Security architects | Mandatory for US federal; voluntary otherwise | Container-specific security guidance |
| NIST SP 800-53 | NIST | Comprehensive security controls | Compliance teams | Mandatory for US federal; voluntary otherwise | Broad security and privacy controls |
| NIST CSF | NIST | Cybersecurity risk management | Executives/Management | Voluntary | High-level risk management framework |
| ISO 27001 | ISO | Organization-wide ISMS | Entire organization | Voluntary (certifiable) | Security management process |
| SOC 2 | AICPA | Service organization controls | Service providers | Voluntary (customer-driven) | Trust and assurance for service organizations |
Quick Decision Guide
- “How should I configure my cluster?” → CIS Kubernetes Benchmark
- “How should I secure containers and orchestrators?” → NIST SP 800-190
- “What security controls should my organization have?” → NIST SP 800-53 or ISO 27001
- “How do I build a security program?” → NIST Cybersecurity Framework
- “How do I prove security to my customers?” → SOC 2
Common Exam Pitfalls
Students frequently confuse these frameworks. Use this table to disambiguate.
| Confusion | Clarification |
|---|---|
| CIS Benchmark vs NIST 800-190 | CIS = specific configuration checks (“set this flag”); NIST 800-190 = general guidance (“scan images for vulnerabilities”) |
| NIST 800-53 vs NIST CSF | 800-53 = detailed control catalog (hundreds of controls); CSF = high-level framework (5 functions) |
| ISO 27001 vs SOC 2 | ISO 27001 = certifiable management system; SOC 2 = auditor-issued report on controls |
| Mandatory vs Voluntary | NIST 800-53 is mandatory for US federal; everything else is voluntary (but often contractually required) |
| NIST 800-190 vs 800-53 | 800-190 is container-specific guidance; 800-53 is a broad control catalog applicable to any system |
Mapping Standards to Kubernetes Components
| Kubernetes Component | Relevant Standards |
|---|---|
| API Server | CIS Benchmark Section 1, NIST 800-53 AC/IA/SC |
| etcd | CIS Benchmark Section 2, NIST 800-53 SC (encryption) |
| RBAC | CIS Benchmark Section 5, ISO 27001 A.9, NIST 800-53 AC |
| Network Policies | CIS Benchmark Section 5, NIST 800-190 (orchestrator segmentation) |
| Image Scanning | NIST 800-190 (image security), CIS Docker Benchmark |
| Audit Logging | NIST 800-53 AU, ISO 27001 A.12, SOC 2 Security |
| Secrets | CIS Benchmark Section 2/5, NIST 800-53 SC, ISO 27001 A.10 |
The KCSA exam may ask you to identify which standard or framework addresses a specific concern. Use the mapping above to connect Kubernetes features to the right standard.
Real-World Adoption Patterns
Organizations rarely adopt a single framework. In practice, they combine multiple frameworks to cover different needs.
| Organization Type | Typical Framework Combination |
|---|---|
| US Federal Agency | NIST 800-53 + NIST CSF + FedRAMP + CIS Benchmarks |
| Healthcare Provider | HIPAA + NIST 800-53 + CIS Benchmarks |
| E-Commerce (Global) | PCI DSS + GDPR + SOC 2 + CIS Benchmarks |
| SaaS Startup | SOC 2 + CIS Benchmarks + ISO 27001 |
| Financial Services | PCI DSS + SOC 2 + NIST CSF + ISO 27001 |
CIS Benchmarks appear in nearly every combination because they provide the technical configuration baseline that other frameworks reference but do not specify.
Key Takeaways for the Exam
| Concept | What to Remember |
|---|---|
| NIST SP 800-190 | Container security guide covering images, registries, orchestrators, containers, and host OS |
| NIST SP 800-53 | Comprehensive security control catalog; control families include AC, AU, CM, IA, SC, SI |
| NIST CSF | Five functions: Identify, Protect, Detect, Respond, Recover |
| ISO 27001 | International ISMS standard — focuses on risk management process, not specific technology |
| SOC 2 | Five Trust Service Criteria: Security, Availability, Processing Integrity, Confidentiality, Privacy |
| Type I vs Type II | Type I = point-in-time; Type II = over a period (more rigorous) |
| CIS vs NIST vs ISO | CIS = configuration; NIST 800-190 = container guidance; NIST 800-53 = broad controls; ISO = management system |
| Mandatory vs Voluntary | NIST 800-53 is mandatory for US federal systems; CIS, ISO, SOC 2 are voluntary |
