Skip to main content
U.S. flag

An official website of the United States government

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Automation Support for Security Control Assessments, Volume 1: Overview

Published

Author(s)

Kelley L. Dempsey, Paul Eavy, George Moore

Abstract

This volume introduces concepts to support automated assessment of most of the security controls in NIST Special Publication (SP) 800-53. Referencing SP 800-53A, the controls are divided into more granular parts (determination statements) to be assessed. The parts of the control assessed by each determination statement are called control items. The control items are then grouped into the appropriate security capabilities. As suggested by SP 800-53 Revision 4, security capabilities are groups of controls that support a common purpose. For effective automated assessment, testable defect checks are defined that bridge the determination statements to the broader security capabilities to be achieved and to the SP 800-53 security control items themselves. The defect checks correspond to security sub-capabilities -- called sub-capabilities because each is part of a larger capability. Capabilities and sub-capabilities are both designed with the purpose of addressing a series of attack steps. Automated assessments (in the form of defect checks) are performed using the test assessment method defined in SP 800-53A by comparing a desired and actual state (or behavior).
Citation
NIST Interagency/Internal Report (NISTIR) - 8011, Volume 1
Report Number
8011, Volume 1

Keywords

actual state, assessment, assessment boundary, assessment method, authorization boundary, automated security control assessment, automation, capability, continuous diagnostics and mitigation, information security continuous monitoring, dashboard, defect, defect check, desired state specification, ISCM dashboard, mitigation, ongoing assessment, root cause analysis, security automation, security capability, security control, security control assessment, security control item

Citation

Dempsey, K. , Eavy, P. and Moore, G. (2017), Automation Support for Security Control Assessments, Volume 1: Overview, NIST Interagency/Internal Report (NISTIR), National Institute of Standards and Technology, Gaithersburg, MD, [online], https://doi.org/10.6028/NIST.IR.8011-1 (Accessed March 4, 2024)
Created June 6, 2017, Updated November 10, 2018