{"type":"rich","version":"1.0","provider_name":"Transistor","provider_url":"https://transistor.fm","author_name":"Secure Talk Podcast","title":"NIST's Victoria Yan Pillitteri: \"Compliance Won't Save You\" — Inside NIST 800-171","html":"","width":"100%","height":180,"duration":3179,"description":"\nShe helps write the rules the entire U.S. defense industrial base gets assessed against — and she's telling you compliance is the floor, not the finish line.\nVictoria Yan Pillitteri leads the Risk Management Framework/FISMA team at NIST and co-chairs the Joint Task Force uniting DoD, the Intelligence Community, and civilian agencies on one cybersecurity framework. In this episode, she and Justin Beals go inside how NIST actually builds SP 800-53 and 800-171 — what gets cut, what stays, and why \"just copy the control language\" is a losing strategy for anyone trying to pass an assessment.\nIn this episode:\nWhy 853 is \"the Cheesecake Factory menu\" of cybersecurity controls — and why that's a feature, not a bug\nThe real difference between NIST 800-171 Rev 2 and Rev 3, and why \"organization-defined parameters\" changed everything\nWhy writing your own control (not just quoting NIST's language) is the only way to actually pass an assessment\nHow FedRAMP 20x, OSCAL, and continuous monitoring are quietly replacing the point-in-time ATO\nNIST's upcoming AI control overlays for predictive, generative, and agentic AI systems\nChapters\n00:00 Introduction\n00:34 The purpose of NIST standards and measurement science\n02:24 Cybersecurity outcomes as a Rosetta Stone\n03:14 The challenge of measuring risk in cybersecurity\n04:55 Frameworks as operating systems for risk management\n06:58 The iterative process of developing cybersecurity standards\n08:11 Interpreting control statements for organizations\n09:36 The importance of tailoring controls to risk profiles\n12:30 The relationship between compliance and good risk management\n14:37 The development process of cybersecurity standards\n17:27 Differences between Rev2 and Rev3 of NIST 800-171\n20:01 Broad versus specific requirements in cybersecurity controls\n22:36 Supporting small businesses with guidance and tools\n27:23 The balance between prescriptive and flexible standards\n30:24 Cybersecurity in public-private partnerships\n34:53 Moving from...","thumbnail_url":"https://img.transistorcdn.com/FI5U-V5f7xdITFyeJIbD7DHq2VtWIj7V7SxzbEqbbTM/rs:fill:0:0:1/w:400/h:400/q:60/mb:500000/aHR0cHM6Ly9pbWct/dXBsb2FkLXByb2R1/Y3Rpb24udHJhbnNp/c3Rvci5mbS81NzRj/MTkwYWEwN2IzMjIw/ZjRhZTE0MGJiYjhi/N2YxMS5qcGc.webp","thumbnail_width":300,"thumbnail_height":300}