Automation Support for Security Control Assessments, Volume 1: Overview

Published: June 06, 2017


Kelley L. Dempsey, Paul Eavy, George Moore


This volume introduces concepts to support automated assessment of most of the security controls in NIST Special Publication (SP) 800-53. Referencing SP 800-53A, the controls are divided into more granular parts (determination statements) to be assessed. The parts of the control assessed by each determination statement are called control items. The control items are then grouped into the appropriate security capabilities. As suggested by SP 800-53 Revision 4, security capabilities are groups of controls that support a common purpose. For effective automated assessment, testable defect checks are defined that bridge the determination statements to the broader security capabilities to be achieved and to the SP 800-53 security control items themselves. The defect checks correspond to security sub-capabilities -- called sub-capabilities because each is part of a larger capability. Capabilities and sub-capabilities are both designed with the purpose of addressing a series of attack steps. Automated assessments (in the form of defect checks) are performed using the test assessment method defined in SP 800-53A by comparing a desired and actual state (or behavior).
Citation: NIST Interagency/Internal Report (NISTIR) - 8011, Volume 1
Report Number:
8011, Volume 1
Pub Type: NIST Pubs

Download Paper


actual state, assessment, assessment boundary, assessment method, authorization boundary, automated security control assessment, automation, capability, continuous diagnostics and mitigation, information security continuous monitoring, dashboard, defect, defect check, desired state specification, ISCM dashboard, mitigation, ongoing assessment, root cause analysis, security automation, security capability, security control, security control assessment, security control item
Created June 06, 2017, Updated June 06, 2017