williamzujkowski/NIST SP 800-53 Compliance Validator

Purpose & When-To-Use

Invoke this skill when validating NIST SP 800-53 control implementation, conducting compliance assessments, identifying gaps, or generating evidence-based compliance reports for federal systems, contractors, or organizations adopting NIST frameworks.

Trigger Conditions:

• "Validate NIST SP 800-53 compliance for system]"
• "Generate gap analysis for MODERATE baseline"
• "Map evidence to NIST controls for control family]"
• "Assess control family] implementation (e.g., AC, SI, CM)"
• "Create OSCAL SAR for NIST compliance assessment"
• "Automate NIST 800-53 control testing"
• "Continuous monitoring for NIST controls"

Out of Scope:

• FedRAMP-specific requirements (use compliance-fedramp-validator)
• OSCAL format conversion without validation (use compliance-oscal-validator)
• General compliance automation (use compliance-automation-engine)

Pre-Checks

1. Time Normalization: Compute NOW_ET using NIST/time.gov semantics (America/New_York, ISO-8601).
2. Input Validation:

• NIST baseline specified (LOW, MODERATE, HIGH, or custom)
• System boundaries defined (scope of assessment)
• Control families or specific controls identified

1. Documentation Availability: Verify access to system documentation, configurations, evidence artifacts.
2. OSCAL Integration: Check if OSCAL SSP (System Security Plan) exists for evidence mapping.
3. Assessment Type: Clarify if initial assessment, periodic re-assessment, or continuous monitoring.

Abort Conditions:

• No baseline or control scope specified → emit TODO list with required inputs.
• Zero documentation or evidence → warn that validation will be minimal.

Procedure

T1: Quick Control Gap Analysis (≤2k tokens)

Use Case: Fast path for common scenarios (80% of requests).

Steps:

1. Identify NIST Baseline: Select applicable baseline controls.

| Baseline | Control Count | Use Case | |----------|---------------|----------| | LOW | 125 controls | Low-impact systems (public info) | | MODERATE | 325 controls | Moderate-impact (most federal systems) | | HIGH | 421 controls | High-impact (national security, critical infrastructure) |

1. Sample 5 High-Priority Controls (T1 Fast Check):

| Control ID | Control Name | Family | Validation Check | |------------|--------------|--------|------------------| | AC-2 | Account Management | Access Control | User account policies exist, periodic review evidence | | SI-2 | Flaw Remediation | System Integrity | Patch management process, vulnerability scan results | | CM-2 | Baseline Configuration | Configuration Mgmt | Configuration baselines documented, change control | | IA-2 | Identification & Auth | Identification/Auth | MFA enabled, authentication logs | | AU-2 | Event Logging | Audit & Accountability | Audit policy configured, log retention evidence |

1. Quick Gap Score:

• Implemented: Control fully operational with evidence (Green).
• Partial: Control partially implemented, missing evidence or incomplete (Yellow).
• Not Implemented: Control missing or no evidence (Red).

1. Top 3 Gaps: Identify highest-risk missing controls with immediate remediation actions.

Output: Baseline mapping, 5-control quick check, gap score, top 3 priorities.

T2: Comprehensive Control Family Assessment (≤6k tokens)

Use Case: Full control family validation for production assessments.

Steps:

1. NIST SP 800-53 Rev 5.2.0 (20 Control Families)

Complete Control Families (1,189 controls total):

| ID | Family Name | Controls | Focus Area | |----|-------------|----------|------------| | AC | Access Control | 25 | User access, permissions, least privilege | | AT | Awareness and Training | 6 | Security training, role-based awareness | | AU | Audit and Accountability | 16 | Event logging, audit review, log protection | | CA | Assessment, Authorization, Monitoring | 9 | Security assessments, continuous monitoring, authorization | | CM | Configuration Management | 14 | Baseline configs, change control, inventory | | CP | Contingency Planning | 13 | Backup, disaster recovery, alternate processing | | IA | Identification and Authentication | 12 | MFA, credential management, authenticator management | | IR | Incident Response | 10 | Incident handling, reporting, testing | | MA | Maintenance | 6 | System maintenance, remote maintenance, tools | | MP | Media Protection | 8 | Media sanitization, storage, transport | | PE | Physical and Environmental Protection | 20 | Physical access, visitor control, environmental controls | | PL | Planning | 11 | Security planning, architecture, privacy | | PM | Program Management | 31 | Risk management strategy, governance | | PS | Personnel Security | 9 | Position categorization, termination, sanctions | | PT | PII Processing and Transparency | 8 | Privacy controls, consent, data minimization | | RA | Risk Assessment | 10 | Risk assessments, vulnerability scanning | | SA | System and Services Acquisition | 23 | SDLC security, supply chain, developer testing | | SC | System and Communications Protection | 51 | Network security, crypto, transmission integrity | | SI | System and Information Integrity | 23 | Flaw remediation, malware protection, monitoring | | SR | Supply Chain Risk Management | 12 | Supply chain risk, supplier assessments, provenance |

Total: 1,189 controls across 20 families (NIST SP 800-53 Rev 5.2.0, accessed 2025-10-26T18:38:09-0400).

2. Control Validation Methodology (NIST SP 800-53A)

Assessment Methods (per NIST SP 800-53A):

| Method | Description | Evidence Examples | |--------|-------------|-------------------| | Examine | Review documentation, policies, procedures | Policies, plans, procedures, configs, logs | | Interview | Discuss with responsible personnel | Interview notes, attestations, walkthroughs | | Test | Execute technical validation, scanning, testing | Scan results, penetration tests, automated checks |

Control Assessment Example (AC-2: Account Management):

yaml
control_id: AC-2
control_name: Account Management
family: AC (Access Control)
baseline: MODERATE

assessment_objectives:
  - AC-2a: Organization manages system accounts (types, establish, activate, modify, review, disable, remove)
  - AC-2(1): Automated account management (enhancements)
  - AC-2(2): Automated account removal/disabling

assessment_methods:
  examine:
    - Account management policy and procedures
    - Configuration baselines for account creation
    - Account review logs (periodic review evidence)
  interview:
    - System administrators on account lifecycle
    - HR on termination processes
  test:
    - Automated scan: verify inactive accounts disabled after 90 days
    - Test account creation workflow: verify approval required
    - Verify MFA enforcement for privileged accounts

evidence_artifacts:
  - account_policy.pdf (policy document)
  - user_access_review_2025-Q3.xlsx (quarterly review)
  - qualys_scan_2025-10-15.pdf (automated compliance scan)
  - iam_config_baseline.json (baseline configuration)

validation_result: Implemented (Green)
findings: All assessment objectives met with documented evidence
compliance_score: 100%

3. Evidence Mapping Matrix

Evidence Collection (60-70% of compliance effort - automate for efficiency):

| Control Family | Evidence Type | Automated Collection | Manual Collection | |----------------|---------------|----------------------|-------------------| | AC (Access Control) | IAM configs, user lists, MFA logs | ✅ Config exports, SIEM logs | Policies, interviews | | SI (System Integrity) | Patch status, vuln scans, AV logs | ✅ Qualys/Nessus scans, SCCM | Patch procedures | | CM (Config Mgmt) | Config baselines, change logs | ✅ Git commits, Terraform state | Change board minutes | | AU (Audit/Accountability) | Audit logs, SIEM retention | ✅ Splunk/ELK exports | Log retention policy | | IA (Identification/Auth) | MFA enrollment, auth logs | ✅ Okta/AD reports | Authentication policy |

Automation Benefits:

• 60-80% effort reduction with automated evidence collection (accessed 2025-10-26T18:38:09-0400).
• Continuous monitoring vs. point-in-time snapshots.
• Real-time compliance dashboards.

4. Gap Analysis & Remediation Planning

Gap Analysis Workflow:

1. For each control in baseline:

• Check implementation status: Implemented / Partial / Not Implemented.
• Verify evidence: Complete / Incomplete / Missing.
• Calculate control strength: Strong / Weak / None.

1. Gap Categorization:

| Gap Type | Description | Remediation Effort | |----------|-------------|--------------------| | Implementation Gap | Control not implemented | High (design, deploy, test) | | Evidence Gap | Control implemented, no evidence | Low (document, collect artifacts) | | Partial Implementation | Control partially implemented | Medium (complete missing aspects) | | Enhancement Gap | Base control OK, enhancements missing | Medium (add enhancements) |

1. Prioritization (Risk-Based):

python
# Risk score = (Control Criticality × Impact × Likelihood) / Effort
# Criticality: LOW=1, MODERATE=2, HIGH=3
# Impact: 1-5 (data breach, downtime, regulatory)
# Likelihood: 1-5 (exploitability, threat landscape)
# Effort: hours to remediate

def calculate_priority(control):
    criticality = {"LOW": 1, "MODERATE": 2, "HIGH": 3}[control.baseline]
    impact = control.impact_score  # 1-5
    likelihood = control.likelihood_score  # 1-5
    effort = control.remediation_hours

    risk_score = (criticality * impact * likelihood) / effort
    return risk_score

# Sort gaps by risk_score descending → prioritized remediation list

1. Remediation Plan Example:

| Priority | Control | Gap Type | Effort | Risk Score | Deadline | |----------|---------|----------|--------|------------|----------| | 1 | SI-2 (Flaw Remediation) | Implementation | 40h | 18.0 | 30 days | | 2 | IA-2(1) (MFA) | Partial | 20h | 15.0 | 45 days | | 3 | CM-2 (Baseline Config) | Evidence | 8h | 12.0 | 60 days | | 4 | AC-2(4) (Auto Account Mgmt) | Enhancement | 30h | 10.0 | 90 days |

5. OSCAL Integration (Interoperability with OSCAL Validator)

OSCAL Artifacts:

• SSP (System Security Plan): Control implementation descriptions, responsible roles.
• SAP (Security Assessment Plan): Assessment objectives, methods, schedules.
• SAR (Security Assessment Report): Results, findings, recommendations.
• POA&M (Plan of Action & Milestones): Remediation plan with milestones.

Generate OSCAL SAR (Security Assessment Report):

json
{
  "assessment-results": {
    "uuid": "550e8400-e29b-41d4-a716-446655440000",
    "metadata": {
      "title": "NIST SP 800-53 Assessment Results",
      "published": "2025-10-26T18:38:09-04:00",
      "version": "1.0",
      "oscal-version": "1.1.2"
    },
    "import-ap": {
      "href": "#assessment-plan-uuid"
    },
    "results": [
      {
        "uuid": "result-uuid-1",
        "title": "AC-2 Account Management Assessment",
        "finding": {
          "uuid": "finding-uuid-1",
          "title": "AC-2 Implemented with Evidence",
          "description": "Account management controls fully implemented.",
          "related-observations": [
            {
              "observation-uuid": "obs-uuid-1",
              "type": "examine",
              "description": "Account management policy reviewed and current."
            },
            {
              "observation-uuid": "obs-uuid-2",
              "type": "test",
              "description": "Automated test: Inactive accounts disabled after 90 days."
            }
          ]
        },
        "risk": {
          "status": "satisfied"
        }
      }
    ],
    "assessment-log": {
      "entries": [
        {
          "title": "Assessment Start",
          "start": "2025-10-15T09:00:00-04:00",
          "end": "2025-10-26T17:00:00-04:00"
        }
      ]
    }
  }
}

OSCAL POA&M for Gaps:

json
{
  "plan-of-action-and-milestones": {
    "uuid": "poam-uuid-1",
    "metadata": {
      "title": "NIST SP 800-53 Remediation Plan",
      "published": "2025-10-26T18:38:09-04:00"
    },
    "poam-items": [
      {
        "uuid": "poam-item-1",
        "title": "Implement SI-2 Flaw Remediation",
        "description": "Deploy automated patch management solution.",
        "related-findings": ["finding-uuid-si2"],
        "milestones": [
          {
            "uuid": "milestone-1",
            "title": "Deploy SCCM/Patch Management",
            "description": "Install and configure patch management platform.",
            "target-date": "2025-11-25"
          },
          {
            "uuid": "milestone-2",
            "title": "Test Patch Deployment",
            "description": "Pilot patch deployment to test systems.",
            "target-date": "2025-12-10"
          }
        ]
      }
    ]
  }
}

Output: Complete control family assessment, evidence mapping, gap analysis, remediation plan, OSCAL SAR/POA&M.

T3: Enterprise-Wide Continuous Monitoring (≤12k tokens)

Use Case: Continuous monitoring, multi-system assessments, automated testing at scale.

Steps:

1. Continuous Monitoring Architecture

NIST SP 800-137 Continuous Monitoring Framework:

1. Define: Metrics, assessment frequency, roles.
2. Establish: Baseline configuration, continuous monitoring tools.
3. Implement: Automated data collection, analysis, reporting.
4. Analyze: Correlate findings, trend analysis, risk scoring.
5. Respond: Remediation, escalation, risk acceptance.
6. Review: Periodic review of monitoring effectiveness.

Automated Control Testing (60-80% effort reduction):

| Control Family | Automated Test | Tool/Method | Frequency | |----------------|----------------|-------------|-----------| | AC (Access Control) | Inactive account detection | SIEM query, IAM API | Daily | | SI (System Integrity) | Vulnerability scanning | Qualys, Nessus, Tenable | Weekly | | CM (Config Management) | Configuration drift detection | Chef InSpec, AWS Config | Continuous | | AU (Audit/Accountability) | Log collection and retention | Splunk, ELK, SIEM | Continuous | | IA (Identification/Auth) | MFA enrollment rate | Okta/AD reports | Daily |

Continuous Monitoring Dashboard:

NIST SP 800-53 Compliance Dashboard (Real-Time)

Overall Compliance Score: 87% (325/375 controls implemented)

Control Families (MODERATE Baseline):
┌─────────────────────────────────────────────────────────────┐
│ AC (Access Control):        ████████░░ 85% (21/25)          │
│ SI (System Integrity):      ███████░░░ 78% (18/23)          │
│ CM (Configuration Mgmt):    ██████████ 92% (13/14)          │
│ AU (Audit/Accountability):  ████████░░ 81% (13/16)          │
│ IA (Identification/Auth):   ██████████ 100% (12/12)         │
└─────────────────────────────────────────────────────────────┘

Recent Findings (Last 7 Days):
❌ SI-2: 15 systems missing critical patches (detected 2025-10-24)
⚠️  AC-2(3): 3 inactive accounts not disabled (detected 2025-10-25)
✅ CM-2: Configuration drift remediated on 10 systems (2025-10-26)

Trending:
↗ Compliance improved 5% from 82% → 87% (last 30 days)
↘ Open findings decreased from 45 → 32 (last 30 days)

2. Multi-System Assessment (Enterprise Scale)

Scenario: Assess 50 federal systems across 3 data centers.

Approach:

• Standardized Baselines: Define organization-wide baselines (LOW/MODERATE/HIGH).
• Centralized Evidence Repository: Shared evidence library (common controls).
• Automated Collection: API integrations with cloud providers, SIEM, CM tools.
• Parallel Assessments: Assess systems concurrently (reduce timeline).
• Rollup Reporting: Aggregate compliance scores, common gaps, organization-wide trends.

Common Controls (Inheritance):

| Control | Common Control Provider | Inheriting Systems | |---------|-------------------------|---------------------| | PE-2 (Physical Access) | Data Center Operations | All systems in DC1, DC2, DC3 | | IR-1 (Incident Response Policy) | CISO Office | All organizational systems | | CP-1 (Contingency Planning Policy) | Business Continuity Team | All organizational systems |

Benefit: Assess common controls once, inherit across all systems (reduce duplication).

3. Advanced Automation (Infrastructure as Code)

Policy-as-Code Validation:

python
# Example: Chef InSpec test for AC-2 (Account Management)
control 'AC-2' do
  impact 1.0
  title 'Account Management'
  desc 'Verify inactive accounts are disabled after 90 days'

  # Check all user accounts
  describe command('lastlog -b 90') do
    its('stdout') { should eq '' }  # No logins in last 90 days
  end

  # Verify accounts are disabled
  users = command('awk -F: \'{print $1}\' /etc/passwd').stdout.split("\n")
  users.each do |user|
    describe user(user) do
      it { should_not be_disabled } if user_last_login(user) < 90.days.ago
    end
  end
end

Infrastructure Scanning:

bash
# AWS Config rule for SI-2 (Flaw Remediation)
aws configservice put-config-rule --config-rule '{
  "ConfigRuleName": "ec2-managedinstance-patch-compliance-status-check",
  "Description": "Checks if patches are applied to EC2 instances",
  "Source": {
    "Owner": "AWS",
    "SourceIdentifier": "EC2_MANAGEDINSTANCE_PATCH_COMPLIANCE_STATUS_CHECK"
  },
  "Scope": {
    "ComplianceResourceTypes": ["AWS::EC2::Instance"]
  }
}'

4. NIST SP 800-53 Rev 5.2.0 (August 2025 Updates)

Key Updates in Release 5.2.0:

• SA-15 (Development Process, Standards, Tools): Enhanced software update security.
• SA-11 (Developer Testing): Improved testing requirements for software security.
• CM-3 (Configuration Change Control): Strengthened update deployment management.
• SI-7 (Software Integrity): Enhanced integrity verification and validation.

Executive Order 14306 Compliance:

• Focus: "Strengthening the Nation's cybersecurity."
• Emphasis: Software supply chain security, update integrity, secure development.

Output: Continuous monitoring architecture, multi-system assessment, policy-as-code automation, 5.2.0 compliance.

Decision Rules

1. Baseline Selection:

• If system impact level known → use corresponding baseline (LOW/MODERATE/HIGH).
• If impact unknown → default to MODERATE (325 controls, most federal systems).
• If custom controls → validate against full 1,189 control catalog.

1. Evidence Sufficiency:

• Strong Evidence: Multiple artifacts from different sources (examine + interview + test).
• Weak Evidence: Single artifact or outdated evidence (>1 year old).
• No Evidence: No documentation or artifacts → control marked "Not Implemented."

1. Gap Prioritization:

• Prioritize by risk score: (Criticality × Impact × Likelihood) / Effort.
• Critical controls (HIGH baseline) before enhancements.
• Quick wins (high risk, low effort) prioritized for fast remediation.

1. Automation Threshold:

• If >10 systems → implement continuous monitoring (cost-effective).
• If evidence collection >100 hours → automate with API integrations.
• If assessment frequency ≥ quarterly → continuous monitoring required.

1. OSCAL Integration:

• If OSCAL SSP exists → import and validate control descriptions.
• Generate OSCAL SAR for all assessments (interoperability).
• If gaps identified → generate OSCAL POA&M with milestones.

Uncertainty Thresholds:

• If baseline unclear → request system categorization (FIPS 199).
• If evidence sources unknown → emit TODO list with required artifacts.
• If control scope ambiguous → default to full baseline assessment.

Output Contract

Required Fields:

yaml
baseline:
  - level: "LOW" | "MODERATE" | "HIGH" | "CUSTOM"
    control_count: integer
    control_families: array (AC, SI, CM, etc.)

validation_results:
  - control_id: string (e.g., "AC-2")
    control_name: string
    family: string
    implementation_status: "Implemented" | "Partial" | "Not Implemented"
    evidence_artifacts: array (file names, URLs)
    compliance_score: float (0-100%)
    findings: string (summary)

evidence_mapping:
  - control_family: string
    automated_evidence: array (log files, configs, scan results)
    manual_evidence: array (policies, interviews, procedures)
    collection_method: "automated" | "manual" | "hybrid"

gap_analysis:
  - gap_type: "Implementation" | "Evidence" | "Partial" | "Enhancement"
    control_id: string
    risk_score: float
    remediation_effort: integer (hours)
    priority: integer (1=highest)
    deadline: date

remediation_plan:
  - control_id: string
    remediation_action: string
    assigned_to: string (role/team)
    effort_estimate: integer (hours)
    target_date: date
    dependencies: array (other controls)

oscal_outputs:
  - sar: object (OSCAL SAR JSON)
    poam: object (OSCAL POA&M JSON)
    format: "json" | "xml" | "yaml"

compliance_metrics:
  - overall_score: float (0-100%)
    by_family: object ({AC: 85%, SI: 78%, ...})
    trend: "improving" | "stable" | "declining"
    finding_count: integer

continuous_monitoring:  # If T3
  - enabled: boolean
    assessment_frequency: string (daily, weekly, monthly)
    automated_tests: array (test names)
    dashboard_url: string

Token Tier Minimums:

• T1: baseline, validation_results (5 sample controls), gap_analysis (top 3).
• T2: All of T1 + evidence_mapping, remediation_plan, oscal_outputs, compliance_metrics.
• T3: All of T2 + continuous_monitoring, multi-system assessment, advanced automation.

Examples

AC-2 Account Management Validation:

yaml
control_id: AC-2
control_name: Account Management
family: AC (Access Control)
implementation_status: Implemented
evidence_artifacts:
  - account_management_policy.pdf
  - quarterly_user_review_2025-Q3.xlsx
  - qualys_inactive_account_scan.pdf
compliance_score: 100%
findings: All assessment objectives met. Automated testing confirms inactive accounts disabled after 90 days.

See examples/nist-moderate-baseline-assessment.txt for a complete MODERATE baseline assessment.

Quality Gates

1. Token Budgets:

• T1 response ≤2k tokens (quick gap analysis, 5 controls).
• T2 response ≤6k tokens (full family assessment, evidence mapping).
• T3 response ≤12k tokens (continuous monitoring, multi-system).

1. Safety Checks:

• No PII or classified information in evidence artifacts.
• Evidence collection respects data privacy (NIST PT family).
• Automated tests do not disrupt production systems.

1. Auditability:

• All validation results include evidence artifact references.
• Gap analysis includes risk scoring methodology.
• Remediation plans include effort estimates and deadlines.

1. Determinism:

• Same baseline + evidence → same validation results.
• Gap prioritization deterministic (risk score formula).

1. Citations:

• NIST SP 800-53 Rev 5.2.0: 1,189 controls across 20 families (accessed 2025-10-26T18:38:09-0400, NIST CSRC).
• Release 5.2.0 (August 27, 2025): Software security, Executive Order 14306 (accessed 2025-10-26T18:38:09-0400, NIST News).
• Automation: 60-80% effort reduction (accessed 2025-10-26T18:38:09-0400, Satine Tech).

Resources

Official NIST Documentation:

• NIST SP 800-53 Rev 5.2.0 (August 2025) (accessed 2025-10-26T18:38:09-0400)
• NIST SP 800-53A Rev 5.2.0 Assessment Procedures (accessed 2025-10-26T18:38:09-0400)
• NIST SP 800-137 Continuous Monitoring
• NIST SP 800-53B Control Baselines

OSCAL Integration:

• OSCAL Homepage
• OSCAL SAR Schema
• OSCAL POA&M Schema

Automation Tools:

• Chef InSpec (compliance as code)
• AWS Config (cloud resource compliance)
• Azure Policy (NIST compliance built-in)
• OpenSCAP (open-source security compliance)