Tag
NIST 800 53
15 articles
Risk and vendors
NIST 800-30 risk assessments
How to run a risk assessment with NIST SP 800-30 Rev. 1: the four steps, the risk model, how likelihood and impact combine, and what the report must hold.
6 min read
Compliance frameworks
Writing a POA&M that assessors accept
The fields a plan of action and milestones needs, how to write milestones an assessor believes, and what a POA&M cannot do under DoD scoring and CMMC.
6 min read
Compliance frameworks
NIST 800-171 Revision 2 vs Revision 3
What changed between NIST SP 800-171 Rev. 2 and Rev. 3, which revision your contract likely requires, and how to prepare for Rev. 3 without wasted work.
6 min read
Compliance frameworks
Scoping where CUI lives in your environment
How to trace where CUI enters and moves, sort assets into the CMMC scoping categories, choose between an enclave and the enterprise, and document the result.
6 min read
Compliance frameworks
NIST 800-171: protecting CUI in practice
What NIST SP 800-171 requires of contractors holding CUI, the requirements that take the most work, and the DFARS obligations that sit alongside them.
6 min read
Compliance frameworks
Continuous monitoring under NIST 800-53
What NIST 800-53 control CA-7 requires, how to set monitoring frequencies, which controls feed it, and how monitoring results turn into risk decisions.
5 min read
Compliance frameworks
Writing control implementation statements
How to write NIST 800-53 implementation statements an assessor can test: cover every part and parameter, name the mechanism, and handle inherited controls.
6 min read
Security engineering
Joiner, mover, leaver processes
Joiner, mover, leaver is one access process with three triggers. How to run each event from the HR record, why movers get missed, and what evidence to keep.
6 min read
Compliance frameworks
NIST 800-53 Rev 5 privacy controls
How NIST SP 800-53 Rev. 5 builds privacy into the catalog: the PT family, privacy controls in other families, the privacy baseline, and who owns what.
5 min read
Security engineering
Managing privileged access
Admin accounts carry most of your access risk. How to find them, separate them, grant elevation for hours instead of years, and log what privileged users do.
6 min read
Compliance frameworks
Tailoring NIST 800-53 controls
The tailoring activities NIST SP 800-53B describes, how to set parameter values and compensating controls, and how to record decisions a reviewer accepts.
6 min read
Security engineering
Least privilege in practice
Every framework asks for least privilege and none says how. Designing roles, finding excess access, separating duties on a small team, and proving all of it.
6 min read
Risk and vendors
Risk scoring: likelihood and impact
How to build likelihood and impact scales two people apply the same way, how to combine them without false precision, and how auditors test your scores.
6 min read
Compliance frameworks
Choosing a NIST 800-53 baseline
How FIPS 199 categorization and the high-water mark decide your NIST 800-53 baseline, who makes the call, and the categorization mistakes to avoid.
6 min read
Compliance frameworks
NIST 800-53 control families, explained
What each of the 20 control families in NIST SP 800-53 Rev. 5 covers, how a single control is built, and how to read the catalog without getting lost.
6 min read