NIST SP 800-53 control assessments

What the assessment is

NIST SP 800-37 sets out the Risk Management Framework in seven steps: prepare, categorize, select, implement, assess, authorize, and monitor. The assess step asks whether the selected controls are implemented correctly, operating as intended, and meeting the system’s security and privacy requirements. That is the step we perform.

We assess against NIST SP 800-53 Revision 5 using the assessment procedures in NIST SP 800-53A. Each control is assessed with the methods the procedure calls for: examining documents, records, and configurations; interviewing the people responsible; and testing the mechanisms themselves.

How an assessment runs

Assessment plan. We agree the system boundary, the baseline and tailoring, the methods and depth for each control, any controls inherited from common control providers, and the schedule. Fieldwork starts only once the plan is agreed.
Fieldwork. We examine, interview, and test, remotely or on site depending on the system. Evidence requests are made in batches so your team can plan around them.
Findings. Each assessment objective is recorded as satisfied or other than satisfied, with the evidence behind the result. Findings are discussed with the system owner as they arise, so nothing in the report is a surprise.
Report. A draft security assessment report goes to the system owner for a factual accuracy review, then the final report is issued. How and when to remediate is the system owner’s decision, recorded in the plan of action and milestones.

What we need from you

The system security plan, including the system boundary and the security categorization
The selected and tailored control baseline, with any overlays and inherited controls identified
Policies, procedures, and the evidence that the controls operate
Access to the people who run the system and, for testing, to the system itself
The current plan of action and milestones, if the system already has one

Who assesses

Assessments are led by assessors experienced in the Risk Management Framework. Nobody who designed, implemented, or documented the controls takes part in assessing them.

Questions

Common questions about nist sp 800-53 control assessments

Do you issue an authorization to operate?

No. Under the Risk Management Framework, only the authorizing official for the system can authorize it to operate. Our security assessment report is one of the inputs to that decision, alongside the system security plan and the plan of action and milestones.

Which baseline do you assess against?

The one selected and tailored for your system. That is usually the low, moderate, or high baseline from NIST SP 800-53B, plus the privacy baseline where it applies and any overlays your organization uses. We assess the controls as your system security plan documents them.

Can you help write our system security plan?

No. We assess controls; we do not design, implement, or document them. Your team or your consultancy prepares the system security plan and the evidence, and we assess what is there.

Can an ISO 27001 audit and a NIST SP 800-53 assessment share evidence?

Often, yes. Many SP 800-53 controls correspond to ISO/IEC 27001 Annex A controls, and NIST publishes a mapping between them. Where the scopes overlap we plan both engagements so evidence is requested once. Each one still reaches its own conclusions against its own criteria.