In this article, we are going to discuss controls in the context of any variation of the NIST 800-53 and NIST 800-171 requirements. NIST SP 800-53 provides us with a fundamental understanding of how government and many commercial organizations structure control language. If you work within the government sector, you have most likely come across NIST 800-53 in different forms such as CNSSI 1253, internal DoD A&A Process, industry-wide FedRAMP, and even the emerging A&A processes around cATO, cRMF, FastATO, Accelerated ATO, and our very own micro layered ATO for the cloud. These are all derivative works of NIST SP 800-53. We can take it even one step further as many of the industry frameworks such as PCI-DSS, HITRUST, FFIEC-CAT, etc. essentially look to NIST as the industry authority when it comes to defining information security structures, strategy, and information assurance systems.
If you work within Defense Industry Base (DIBs) and you have to comply with CMMC 2.0, NIST-171, and/or DoDAM guidance, understanding the control structure and assessment procedure anatomy is important to prepare yourself for an external audit.
Therefore, it is key for Compliance-as-Code Professionals, developers, compliance professionals, and cyber professionals to really understand controls at a foundational level. A control has two main parts, the control itself and the test or assessment procedures associated with the control.
Control families are the starting point. All controls are part of their respective control family. These families are the same for the NIST SP 800-53, NIST SP-171, and CMMC 2.0 Frameworks.
The NIST SP 800-53 Rev 5 has 20 control families. These families provide the basic context on the control language.
The second part, and many times the most often forgotten part, are the test cases or assessment procedures. This is sometimes referred to as the “Alpha” document because all the test cases are documented within the NIST SP 800-53 A or NIST SP 800 171 A special publications.
The assessment guide contains assessment procedures. The assessment procedures all start with “Determine if:” The language here is very similar to the control language itself except that it has been converted into an audit and assessment question through the use of determination statements.
Assessment Methods and Objects provide the auditor with a view into what type of documentation to examine, who to potentially interview, and what type of technical tests to conduct as evidence of compliance.
A fundamental difference between NIST 800-53 controls and ALL the other frameworks out there is that NIST forces measurements directly into the control structure and assessment procedures, whereas other frameworks utilize outside supplementary guidance or bake it into procedural documents. These measurement criteria are normally captured within the {Organizational Parameters} area. This is unique to the NIST 800-53 way of describing control language. Organizations (public and private) leverage some, or all parts of these controls, in different ways when organizing their risk management processes.
Why Is NIST 800-53 So Important?
NIST 800-53 is important because it was designed to keep information safe and secure for governmental agencies. Everything from global viruses to increasingly sophisticated hacking plots have made it necessary to create and implement extensive security measures. NIST 800-53 focuses on the central idea of building information systems correctly and then providing continuous monitoring. If these two basic steps are taken, risks to information systems are significantly lowered. There are several specific reasons why following the guidelines is important.
How Do You Implement NIST 800-53?
Before knowing the requirements and how to implement them, it’s important to understand how NIST 800-53 is categorized. First, there are three different security control levels. These include the following impact levels: High Impact Baseline, Medium Impact Baseline, and Low Impact Baseline. There are also three types, and this includes the following:
The following are the specific steps that need to be taken when implementing NIST 800-53.
The requirements for NIST 800-53 in these guidelines cover over 200 controls in 18 specific areas. Each of these areas is known as “control families.” Each of the 18 areas has acronyms such as AC for Access Control and CP for Contingency Planning. According to the NIST websites, the following are each of the 18 areas and some of the control requirements in each category.
Is it ok to use a password manager?
While using a password manager for your personal online accounts is a terrific way to stay secure, remember to check your company’s policies before using any software at work.
Password managers can help you to store your passwords as well as help you to generate unique ones for each site. However, keeping all your passwords in one place is risky. It’s important to understand how your passwords are protected and if they are encrypted. There are various commercial products available that work with multiple devices and browsers, so do your research to find one that best meets your needs.
A fundamental difference between NIST 800-53 controls and ALL the other frameworks out there is that NIST forces measurements directly into the control structure and assessment procedures, whereas other frameworks utilize outside supplementary guidance or bake it into procedural documents. These measurement criteria are normally captured within the {Organizational Parameters} area. This is unique to the NIST 800-53 way of describing control language. Organizations (public and private) leverage some, or all parts of these controls, in different ways when organizing their risk management processes.
In this article, we are going to discuss controls in the context of any variation of the NIST 800-53 and NIST 800-171 requirements. NIST SP 800-53 provides us with a fundamental understanding of how government and many commercial organizations structure control language. If you work within the government sector, you have most likely come across NIST 800-53 in different forms such as CNSSI 1253, internal DoD A&A Process, industry-wide FedRAMP, and even the emerging A&A processes around cATO, cRMF, FastATO, Accelerated ATO, and our very own micro layered ATO for the cloud. These are all derivative works of NIST SP 800-53. We can take it even one step further as many of the industry frameworks such as PCI-DSS, HITRUST, FFIEC-CAT, etc. essentially look to NIST as the industry authority when it comes to defining information security structures, strategy, and information assurance systems.
The assessment guide contains assessment procedures. The assessment procedures all start with “Determine if:” The language here is very similar to the control language itself except that it has been converted into an audit and assessment question through the use of determination statements.
If you work within Defense Industry Base (DIBs) and you have to comply with CMMC 2.0, NIST-171, and/or DoDAM guidance, understanding the control structure and assessment procedure anatomy is important to prepare yourself for an external audit.
Control families are the starting point. All controls are part of their respective control family. These families are the same for the NIST SP 800-53, NIST SP-171, and CMMC 2.0 Frameworks.
FAQ
What are the NIST 800-53 technical controls?
How many controls are there in NIST 800-53 moderate?
- Access Control. …
- Awareness and Training. …
- Audit and Accountability. …
- Assessment, Authorization and Monitoring. …
- Configuration Management. …
- Contingency Planning. …
- Identification and Authentication. …
- Incident Response.
How many controls does 800-53 have?
