It is a security compliance standard created by the US Department of Commerce and the National Institute of Standards and Technology is NIST SP 800 53.
NIST SP 800-53 is mandatory for all US federal information systems, except those that are related to national security. It provides a terrific framework for organizations to stay compliant with their comprehensive privacy and security controls.
NIST SP 800 53 helps federal agencies and contractors meet the requirements set by the Federal Information Security Management Act (FISMA).
The purpose of NIST 800 53’s security and privacy controls are the following:
It is mandatory for federal information systems, organizations, and agencies. Organizations that work with the federal government are required to adhere to the NIST 800 53 controls spreadsheet protocols.
It also provides a strong suite of processes and frameworks for businesses to develop, maintain and improve information security practices.
The NIST framework is popularly regarded as the gold standard for organizations to safeguard their information systems. It is also a solid guide for SMBs and enterprises.
Being compliant with NIST SP 800 53 will also help organizations in improving their compliance with other regulatory requirements such as PCI DSS, GDPR, HIPAA, FISMA, FedRAMP, DFARS, IL 2-6, and many others.
The data that is present on federal networks might include sensitive information that is pivotal to the day-to-day operations of the US government. The data could also include personally identifiable information of users, and that needs to be protected too.
The NIST SP 800 53 framework protects the data of the following systems:
Since organizations have diverse systems, most controls are either neutral or flexible.
By providing organizations with a catalog of security controls to be compliant with, NIST SP 800 53 helps organizations strengthen their risk management processes.
The 1,000+ controls are comprehensive and cover every aspect that information systems should consider.
It will improve the resilience of the organization’s systems and help them secure against data breaches. NIST SP 800 53 protects information systems from threats such as privacy breaches, cybersecurity threats, malware attacks, and human errors.
The cybersecurity environment is changing rapidly and organizations should do everything within their power to protect themselves against unnecessary threats.
Being compliant with NIST SP 800 53 guidelines is one of the best ways to keep your organization protected. Even if you are not legally required to be compliant with NIST 800 53, doing so will enable you to bridge cybersecurity gaps.
Organizations have to implement the relevant NIST SP 800 53 controls as a part of the risk assessment process.
There is a long list of compliance measures that you can take to be compliant with NIST SP 800 53 since it is a part of the annual FISMA reporting requirements.
Failing the FISMA audit brings its own set of penalties. If a government agency gets a low FISMA score, they would be censured and it will result in a loss of jobs.
If a private contractor fails the audit, it will result in a loss of federal funding and they will be excluded from future government contracts.
Following the below steps will put you in the right direction to becoming NIST SP 800 53 compliant:
When you are developing a plan to be compliant with NIST SP 800 53, the first step is to look for sensitive data in your network and applications.
You need to know where your sensitive data is, otherwise, your IT team will find it difficult to manage the breach.
The next step is to map out your data and note down who has access to them. Categorize your data based on its value and how sensitive it is to the organization.
Assign an impact value for the data (low, medium, or high) for each security objective (confidentiality, integrity, and availability).
Assign relevant security categories and how they can impact your organization, including how they relate to your goals and business objectives.
While doing so, organizations should ensure that access to sensitive data is only given to a restricted set of employees.
Ensure that you automate the discovery and mapping process so that you can streamline the process to get consistent results.
If you want to restrict access, it is important that you not only understand who can access data but also find out how and where they can access it.
You need to ensure that multi-factor authentication is turned on for those who access highly sensitive data. Assuming that a user’s credentials are compromised, having an extra layer of authentication reduces the chances of a breach.
Limit access to your files and data through public web servers.
For organizations that want to be compliant with NIST SP 800 53, it is critical that they put in place systems that monitor company data, files, and activity across the entire network.
If there are anomalies with respect to data access, such as an activity in your network from another country or if there is a login from a different place, controls should be put in place to restrict access.
Make sure that your employees are educated on access governance and are aware of the best practices of cybersecurity, right from day one.
They should be taught how to identify malware. The employees should also be educated on the steps that they should take when they find malware, including the reporting process.
After your organization has been made compliant with the NIST 800-53 checklist, ensure that you do regular audits to maintain compliance.
If there has been a security incident of late, then increase the frequency of the audits. Deploy security assessment tools in such a way that you have real-time information about your security.
The NIST special publication 800 53 offers a suite of security and privacy controls and guidance for selection. The organizations should choose controls based on the requirements for protection in various content types.
The Federal Information Processing Standards (FIPS) defines the impact levels:
The above three categories provide a baseline for the security control selection process based on the security category and its impact level on the information systems.
The security controls that are a part of the NIST SP 800 53 are organized into 18 families.
Each of the security controls is related to the security of the family. These 18 families of controls provide operational, technical, and regulatory safeguards to ensure the integrity, privacy, and security of information systems.
There are 18 security control families and the below table speaks about each of them.
|AC||Access Control||Separation of duties; account management; account monitoring|
|AT||Awareness and Training||User training for security threats; Technical education for privileged users|
|AU||Audit and Accountability||Audit records; analysis and reporting; record retention|
|CA||Assessment, Authorization and Monitoring||Connections to public networks/ external systems; penetration testing|
|CM||Configuration Management||Configuration change control|
|CP||Contingency Planning||Business continuity strategies; testing|
|IA||Identification and Authentication||Authentication for users, devices, services;|
|SC||System and Communications Protection||Covers protection of system boundaries; Ongoing management of systems|
|IR||Incident Response||Incident response training; incident monitoring and reporting|
|MA||Maintenance||System, personnel and tool maintenance|
|MP||Media Protection||Access, storage, transportation, sanitization, and media use|
|SI||System and Information Integrity||Maintaining the integrity of the information system; Offers protection from malicious code and spam; System-wide monitoring|
|PE||Physical and Environment Protection||Physical access, fire protection, temperature control|
|PL||Planning||Social media networking restrictions; in-depth security architecture|
|PM||Program Management||Risk management strategy; insider threat program|
|PS||Personnel Security||People screening; termination and transfer; sanctions; external personnel|
|RA||Risk Assessment||Privacy impact assessment; Risk Assessment; Vulnerability Scanning|
|SA||System and Services Acquisition||Acquisition Process; Supply Chain Risk Management; System Development Lifecycle|
The 800 53 rev 5 of the framework was revised in September 2020, and it has resulted in significant changes.
First and foremost, there were a lot of changes in the terminology. The terms federal and information have been taken off, thereby opening the framework for all organizations and types of systems.
The revised NIST controls 800 53 framework emphasizes more on privacy. It integrates privacy into security controls, thereby resulting in a comprehensive set of controls for all organizations.
It also offers an extra level of operational flexibility since there are no stringent rules about having to stick to a specific set of tools or technologies.
Version 5 doesn’t have any set guidelines on password length or its complexity. The only mandate is that there should be an effective password.
In version 5, the control separation process is separate from the actual controls. Therefore, these controls can be accessed by different groups such as software developers, systems engineers, business owners, and enterprise architects.
It is believed that these changes will make it more accessible to private and non-federal organizations, thereby more organizations will use the standards and guidelines.
For organizations that work with the federal government, being compliant with NS 800 53 is mandatory.
If you do not do business with the federal government, staying compliant with it will still give you a robust foundation for being compliant with a wide range of regulations.
By promoting a level of independence, you assess all your data, thereby protecting your internal security.
When trying to become fully compliant, the entire company has to focus on it and also make sure that the data is protected at all times.
The NIST SP 800 53 is a flexible framework that improves risk management among organizations. Now you know the importance of complying with NIST SP 800-53, so what are you waiting for? Let us get you compliant.
Circa Las Vegas
Thurs. Aug 5th
Cybersecurity Reunion Pool Party at BlackHat 2021