The Full NIST 800-53 Checklist: How to Prepare for an Audit

The NIST 800-53 Revision 5 provides a catalog of security and privacy controls for information systems and organizations to protect organizations and ultimately, the US from a diverse set of risks, including the following threats.

• hostile attacks
• human errors
• natural disasters
• structural failures
• foreign intelligence entities
• privacy risks

The NIST 800-53 controls are flexible and customizable and implemented as part of an organization-wide process to manage risk. The controls address diverse requirements derived from today’s business needs such as remote work settings and cloud security. The audit checklist provided below will help simplify the complexity of the NIST 800-53, the gold standard in information security. Following these guidelines represents a great step in building a mature cybersecurity program.

Purpose and Applicability

The implementation of the NIST 800-53 control catalog is mandatory for federal information systems under the Office of Management and Budget (OMB) and the provisions of FISMA, which requires the implementation of minimum controls to protect federal information and information systems

The report accomplishes this objective by providing a comprehensive and flexible catalog of security and privacy controls to meet current and future protection needs based on changing threats, vulnerabilities, requirements, and technologies. The publication also improves communication among organizations by providing a common lexicon that supports the discussion of security, privacy, and risk management concepts. 

How to Ensure NIST 800-53 Compliance: A Checklist

Select a Control Baseline

A control baseline is a collection of controls assembled to address the security needs of an organization. It provides a generalized set of controls that represents a starting point for the subsequent tailoring activities that are applied to the baseline to produce a targeted or customized security and privacy solution for the entity that the baseline is intended to serve.

The concept of a NIST security baseline is introduced to assist organizations in selecting a set of controls for their systems that is commensurate with their security and privacy risk. 

Control baselines are based on a variety of factors, including threat information, mission or business requirements, types of systems, sector-specific requirements, specific technologies, operating environments, organizational assumptions and constraints, individuals’ privacy interests, laws, executive orders, regulations, policies, directives, standards, or industry best practices. Tailoring activities are described in greater detail soon. 

• First determine the criticality and sensitivity of the information to be processed, stored, or transmitted by those systems. The process of determining information criticality and sensitivity is known as security categorization 
• In preparation for selecting and tailoring the appropriate security control baselines for organizational systems and their respective environments of operation, organizations determine the impact level of the system
• The impact level of the system, in turn, is used for the express purpose of selecting the applicable security control baseline from one of the three baselines.
• In addition to the three security control baselines, organizations must select an initial privacy control baseline for federal agencies to address privacy requirements and manage privacy risks that arise from the processing of PII based on privacy program responsibilities.

Tailor Control Baselines

After selecting an appropriate control baseline, organizations initiate a tailoring process to align the controls more closely with the specific security and privacy requirements identified by the organization. The tailoring process is part of an organization-wide risk management process that includes framing, assessing, responding to, and monitoring information security and privacy risks. The tailoring process can include but is not limited to the following activities:

• Identifying and designating common controls 
• Applying scoping considerations
• Selecting compensating controls
•  Assigning values to organization-defined control parameters via explicit assignment and selection operations 
• Supplementing baselines with additional controls and control enhancements
• Providing specification information for control implementation

Define Capabilities

As the number of controls in the NIST audit checklist grows in response to an increasingly sophisticated threat space, organizations need to have the ability to describe key capabilities needed to protect organizational missions and business functions, and to subsequently select controls that—if properly designed, developed, and implemented—produce such capabilities. The use of capabilities simplifies how the protection problem is viewed conceptually. Using the construct of a capability provides a method of grouping controls that are employed for a common purpose or to achieve a common objective.

Implement Controls

A significant challenge for organizations is selecting a set of security and privacy controls that can protect their mission and business functions and provide the capability to manage security and privacy risk. The selected controls, if correctly implemented and determined to be effective, meet security and privacy requirements defined by applicable laws.

There is no single set of controls that addresses all security and privacy concerns in every situation. However, choosing the most appropriate controls for a specific situation or system to adequately respond to risk requires a fundamental understanding of the organization’s mission and business priorities, the mission and business functions that the systems will support, and the environments in which the systems will operate.

With that understanding, organizations can demonstrate how to efficiently and cost-effectively assure the confidentiality, integrity, and availability of organizational information and systems, as well as the privacy of individuals in the context of supporting the organization’s mission and business functions. 

• Reference the Control Catalog

Controls are designed to be flexible, so make sure to consult the discussion section of each control. It contains additional information that helps with implementing or adapting controls in line with the organization’s requirements or risk. The control catalog will also reference which controls are reliant on, or connected to, others. This helps build a systematic approach to implementation.

• Record Evidence of Implementation

As with all security standards and frameworks, it is important to record the implementation of NIST SP 800-53 controls. Records and documentation should be collected as evidence of compliance with each control, helping to demonstrate overall compliance with NIST SP 800-53.

Flexibility in Control Implementation

The flexibility of NIST 800-53 controls is one of their strongest features. These controls are designed to be adaptable, allowing them to be tailored to fit a wide range of operational environments, technologies, and risk management needs.

By using the NIST 800-53 catalog, organizations can select the most relevant controls for their systems and environments, adjusting them as necessary. For example, an organization with a heavy reliance on cloud technologies might apply specific cloud security controls, whereas a more traditional on-premise environment may require a different set of priorities.

• Customization for Business Needs: Implementing controls requires organizations to assess how each control fits within the business’s overall mission and objectives. The flexibility in NIST 800-53 allows organizations to choose controls that meet their specific requirements, rather than following a rigid, one-size-fits-all approach.
  
• Adapting to Changing Threats: The threat landscape is constantly evolving. With the flexibility in NIST 800-53 controls, organizations can adjust their security posture as new risks emerge. This is particularly crucial in industries like finance and healthcare, where data privacy and security are constantly under scrutiny.

Assessment and Continuous Monitoring

Assess and monitor the security and controls in the information system ad environment of operation on an ongoing basis to determine control effectiveness, changes to the system/environment, and compliance with legislation, executive orders, directives, policies, regulations, and standards.

NIST 800-53 as a Catalyst for a FISMA Audit

Being NIST 800-53 compliant doesn’t automatically guarantee a FISMA ATO or FedRAMP authorization, but it is a great stepping stone toward a FISMA authorization. Organizations will need to implement the relevant NIST SP 800-53 controls determined as part of the risk assessment process and evidence compliance with these controls as part of the organization’s annual FISMA reporting requirements. Monitoring continuous compliance against the selected controls, as well as adapting to any new updates or revisions to the catalog, is crucial. 

If your organization is following the security recommendations laid out in NIST 800-53, you and your team will ultimately do less work preparing for a FISMA authorization.

Who Needs A FISMA Audit?

If you are a government agency you know you need to be FISMA compliant. However, if you are a private business that has a government contract, manages information on the government’s behalf, or maintains close relationships with any government agency, you may also be required to pass a FISMA audit. 

How to Prepare for a FISMA Audit

• Information System Catalog: All FISMA-compliant agencies must create and maintain a catalog of every information system used by said agency. 
• Risk Management: In the eyes of the government, not all information is created equal, unlike people. Agencies undergoing FISMA audits must create a risk management profile for their information and information systems.
• Security Plan: FISMA requires that businesses create a plan which sets forth how the information will be properly protected. The plan must detail security policies, controls, and contingency plans in case of a breach. 
• Security Controls: The catalog for FISMA security controls is extremely extensive. The NIST 800-53 lists the full scope of security controls. As previously noted,  not all of the security controls are required. Instead, agencies must pick and choose which security controls are relevant to their particular system. Once an institution has chosen the security controls, it must document them in its security plan. The security plan is then approved by FISMA during the audit.
• Risk Assessments: FISMA audits require risk assessments at every level of the organization. Every level of the organization means not only where the sensitive information is kept, but anywhere data is kept. 
• Continuous Monitoring:  FISMA expects organizations to perform security reviews each year. It may feel redundant to require continual risk assessments, on all levels of the organization and annual reviews.

Leveraging the Power of Centraleyes with your NIST 800-53 Compliance

Following our checklists will help structure your approach to NIST 800-53A compliance and a FISMA audit. If you’d like to read more about these important standards, see our related blog on NIST 800-53.

Using Centraleyes as your NIST 800-53 management platform will help you organize your compliance program by mapping controls to other standards as well. Our powerful platform automates control mapping of over 50 security and privacy standards!

Introduction of Online Introductory Courses for NIST SP 800-53:

In April 2024, the National Institute of Standards and Technology (NIST) launched a series of self-guided, online courses designed to enhance understanding and implementation of the NIST SP 800-53 security and privacy control catalog. These courses cover not only the core SP 800-53 but also the related SP 800- 53A and SP 800-53B, which focus on assessment and baselining, respectively. The courses are aimed at helping both new and experienced professionals navigate the complexities of implementing NIST controls in their organizations, providing an accessible and comprehensive training solution for various roles, from security practitioners to compliance managers.

The online training modules are structured to cater to different levels of expertise and can be accessed by anyone, making them ideal for organizations with limited resources or those in need of scalable, flexible learning options. Participants will have the opportunity to learn at their own pace, reviewing materials and completing interactive exercises that guide them through the key concepts of each document.

What Do the Courses Cover?

1. NIST SP 800-53: The core course covers the full catalog of security and privacy controls, offering a detailed look at the framework’s structure, control families, and guidance on applying the controls to federal and non-federal systems.
2. NIST SP 800-53A: This module focuses on the assessment of security controls, providing instructions on how to assess the effectiveness of controls that are part of the broader NIST 800-53 framework. It explains how to determine whether the controls function as intended to protect an organization’s assets.
3. NIST SP 800-53B: This course addresses the baseline security configurations and guidance for securing federal information systems. It highlights the importance of tailoring these baselines according to specific organizational needs and environments, making it an essential tool for system administrators and compliance officers.
   

How to Access the Courses

Organizations and individuals can easily access these courses via the NIST Computer Security Resource Center (CSRC) website. Each course is broken down into digestible modules, with downloadable materials and completion certificates provided upon finishing the course. For those interested in deeper learning, NIST also offers additional resources, including webinars, workshops, and in-depth tutorials.

These courses are a crucial step in bridging the skills gap and ensuring that a wide range of professionals have the expertise to properly implement and assess NIST 800-53 controls in real-world environments.