NIST 800-53

What is the NIST 800-53 Cybersecurity Framework?

NIST Special Publication 800-53, titled, Security and Privacy Control for Information Systems and Organizations, is a set of security and privacy families, containing related security controls, set forth as a framework for organizations.

Adherence to the NIST 800-53 security controls helps organizations focus on its IT risk and align their IT infrastructure to safeguard against the barrage of cybersecurity attacks. Any organization using information systems that process, store, and transmit data, will benefit by aligning with security protocols. The National Institute of Standards and Technology developed the NIST SP 800-53r5 published in September 2020 has a set of 20 security control families with input from associated cybersecurity organizations and professionals.

All federal government information systems must be able to demonstrate that the systems they employ to carry out their missions meet each of the security measures outlined in NIST SP 800-53 as a minimum. The requirement was established as a mandate from both the Office of Management and Budget (Circular A-130) and the Federal Information Security Modernization Act (FISMA) to ensure that federal systems protect all data within its IT infrastructure. This is a current requirement for all federal government information systems.

It should be highlighted that the framework of security controls does not describe how processes and procedures must be carried out, nor does it indicate what hardware and software architecture must be employed. Instead, the NIST 800-53 framework identifies the objectives for each security control that must be met, and each organization determines how best to align with the security control to meet the requirement and best limit their organization’s risk. For example, an information system in NAVSEA may not be configured in the same way as an information system in the Department of State, however, both IT systems may be successfully aligned to the NIST 800-53 standards.

By taking a risk management and proactive approach, the development of NIST 800-53, and the requirement for compliance by all federal agencies, establishes a solid foundation for protecting government assets and federal/contractor data security.

Conducting Cybersecurity Assessments: Why is it important?

Cybersecurity is at the forefront and has emerged as one of the most pressing issues confronting the federal government and its partner organizations. As the requirement for data and information sharing grows, the need for security and privacy safeguards increases. The best-laid strategies, however, are useless unless enterprises adhere to the standards they develop to avoid cybersecurity risk and breach. Federal agencies have recognized the significance of implementing cybersecurity processes, procedures, and behaviors, and have established cybersecurity standards for all systems within the federal agencies.

By means of the NIST 800-53 Security and Privacy Controls for Information Systems and Organizations as a method of reviewing and ensuring that a federal agency’s security and privacy goals are accomplished using the NIST 800-53A, titled, Assessing Security and Privacy Controls in Information Systems and Organizations. Assessors or auditors’ reference 800-53A to assess the controls’ effectiveness. SteelToad assesses an organization’s environment in relation to the NIST 800-53 security controls to acquire evidence demonstrating or disproving consistent implementation of these controls to ensure that the organization’s cybersecurity goals are being accomplished.

An assessment is a method of assisting an organization’s leaders, stakeholders, and collaborating organizations with feedback to determine the level of adherence to the set of cybersecurity standards in the NIST 800-53 model of security controls. An assessment collects data using a focused and organized process to determine whether the organization’s objectives have the evidence to assure operations are fulfilling those objectives. Utilizing the information gained from a NIST 800-53 Assessment allows stakeholders to see how well the organization is adhering to cyber standards, and to identify the weaknesses and strengths in processes, policies, procedures, and behaviors.

Performing an assessment provides critical information to an organization to determine the successful implementation of cybersecurity objectives. There are several advantages to conducting a cybersecurity assessment. While the 800-53 security controls are specified and consistent, the path to adopting a conforming solution is flexible, limitless, and accessible to a wide range of organizations, regardless of their specific mission and objectives. It is critical to realize that organizations have flexibility in the way they determine to align with the standards.

Some of the improvements organizations will realize from a successful assessment include:

1. Confirmation of security controls successfully implemented and effective.
2. Uncovering risk in a system based on “gaps” in the security implementation when assessed against the security controls.
3. Information and data how the system adheres to the security controls, and how the business objectives may be compromised.
4. With the identification of non-compliance for the security control, an organization may focus on implementing a solution and developing processes and procedures based on requirements defined for the security control.
5. An organization’s objectives and system risk are assessed and quantified, enabling stakeholders to improve.

SteelToad’s NIST 800-53 Cybersecurity Assessment is assessed from the NIST Special Publication 800-53A, Assessing Security and Privacy Controls in Federal Information Systems and Organizations. Since FY 2013 our assessors have been performing best processes assessments in cybersecurity, ISO, NIST, CMMI, and CMMC for commercial, DoD and Federal agencies.

The need to protect an organization’s systems consistently and thoroughly from cyberattacks is an essential requirement. to make risk management a routine and consistent practice, it is critical that organizations approach risk management and risk treatment in a proactive manner. By conducting a NIST 800-53 evaluation, organizations will be able to identify the current state of their processes and security controls. With the assessment results, organizations can identify strengths and weaknesses, and then work to correct these gaps in policy, technology, and procedures to strengthen their security posture.

How to Conduct a Comprehensive Cybersecurity Assessment?

Assessing compliance for NIST 800-53 follows a step-by-step assessment of each security control within the framework. The assessment allows the organization to select Evidence for each security control (as determined in the assessment Plan), to share with SteelToad Assessors, as proof of completely meeting the requirements set forth in the security control. The evidence provided may be obtained, or presented for review, based on different collection methods.

SteelToad will conduct the assessment with our team of experienced assessors. Understanding the need for adaptability to each of our customer’s systems has a benefit: not every assessment method (Examine, Interview, Test) needs to be employed, but experience has taught us how to effectively choose the one that will be the most complete and useful. As a result of our prior experience, SteelToad can determine the best use of various assessment methodologies, to review the Evidence from the organization efficiently.

We will work with the organization to observe and collect the information required to accurately satisfy our team’s review of the evidence as it relates to the security control.

Typically, there are three methodologies we utilize during a NIST 800-53 assessment:

Examine

SteelToad’s assessors review and observe the Evidence provided for each security control. The process of reviewing, inspecting, observing, studying, or analyzing assessment objects (i.e., specifications, mechanisms, activities). A few examples of what may be observed under the definition of this methodology may be:

• Observation of user interaction within a system
• Hardware and/or software system functionality
• Policies
• Procedures
• System Architecture
• Completeness of procedures, functionality, processes
• Documentation
• Management processes

Interview

SteelToad assessors collaborate closely with your team of stakeholders to plan interview sessions. These discussions may take place with a single employee, a management team, or a combination of staff from various departments. Interviews are conducted to gather information from those who may have information to corroborate that the security control is being followed. The purpose is to gather various team members from the company and ask questions so that the assessors understand how the organization meets the security control, clarification of completeness, or a review of how the system functionality works and fulfills the standard. The process of holding discussions with individuals or groups of individuals to facilitate understanding, achieve clarification, or obtain evidence. Some examples of this methodology may be to interview:

• Quality Manager
• CTO
• IT system lead and administrators
• System stakeholders in a variety of departments across the organization
• Cybersecurity/Risk team

 Test

SteelToad utilizes the methodology of testing in reference to seeing how the functionality of a system or process works.

The process of exercising assessment objects (i.e., activities, mechanisms) under specified conditions to compare actual with expected behavior. Some examples of this methodology may be:

• Demonstrating how the system works
• Demonstration of hardware or software functionality/upgrades
• Displaying how a process is carried through (a cyber breach).
• Demonstration of interaction between departments in a specific situation (Is it representative of the process described/policies defined?

Analysis of NIST 800-53 Findings and the Importance of Continuous Assessment

The methodology used is essential to gathering the evidence that meet the standard of the security control. At the same time, it is important to ensure the Evidence provided, through examination, interview, or test, is complete and demonstrates adherence to the security control. SteelToad’s assessors will gather the Evidence and determine if it is acceptable, using the following assessment guidelines:

• Does the artifact show the functionality or processes that are compatible with the security control being evaluated?
• Has a representative from the company directly involved in, or dealing with, the process/procedure presented or clarified the artifact during an interview?
• Has a member of the organization who regularly deals with or oversees the artifact provided it?
• The assessment team has watched the test, and during the demonstration or observation, the test technique demonstrates the accuracy of alignment to the security control.

If the artifact presented does not meet the acceptable level of complete compliance, SteelToad assessors may request a data call or may deem this security control as “NOT MET,” which provides the organization with valuable information, identifying a “GAP” in the system’s cybersecurity alignment with the NIST 800-53 framework.

Functions & Scope of NIST 800-53 Cybersecurity Assessment

In the NIST 800-53 A Special Publication, titled “Assessing Security and Privacy Controls in Information Systems and Organizations”, NIST provides 800-53 Assessment Guidelines to meet the assessment objectives as stated below.

NIST 800-53A was developed to:

1. Provide Assessment Guidelines to encourage “consistent, efficient, comparable, and repeatable assessments of security and privacy controls with reproducible results;”
2. Document a clear understanding of “the risks to organizational operations, organizational assets, individuals, other organizations, and the Nation resulting from the operation and use of systems;”
3. Provide a way to conduct “more cost-effective assessments of security and privacy controls;”
4. Define “complete, reliable, and trustworthy information for organizational officials to support risk management decisions, reciprocity of assessment results, information sharing and compliance with federal laws, Executive Orders, directives, regulations.”

It is difficult to overestimate the importance of assessment planning, scope, goals, process, and experience. SteelToad’s assessors adhere to the NIST 800-53A Assessment guidelines, as well as expertise gained from over 150 best practices, gap assessments, and appraisals. We believe that the amount of planning and concentration placed on developing an appropriate assessment plan, scope, strategy, and assessment approach directly correlates with assessment success. SteelToad adheres to the evaluation processes outlined in 800-53A to maintain a consistent and well-documented assessment approach, providing our clients with a clear, efficient, and well-documented process for limiting risk and securing systems.