{"id":79550,"date":"2026-10-28T06:33:07","date_gmt":"2026-10-28T06:33:07","guid":{"rendered":"https:\/\/www.devopsschool.com\/blog\/?p=79550"},"modified":"2026-10-28T06:33:09","modified_gmt":"2026-10-28T06:33:09","slug":"nist-sp-800-53-in-practice-select-implement-assess-and-monitor-security-controls","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/blog\/nist-sp-800-53-in-practice-select-implement-assess-and-monitor-security-controls\/","title":{"rendered":"NIST SP 800-53 in Practice: Select, Implement, Assess, and Monitor Security Controls"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">&#8216;We have logging&#8217; is not an adequate answer to an assessor. Which events are logged? Who can modify them? What happens when a collector fails? How do you prove that the protection works?&nbsp;<strong>NIST Special Publication 800-53<\/strong>&nbsp;helps organizations turn broad security expectations into testable security and privacy controls.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">NIST SP 800-53 Revision 5 is a comprehensive control catalog. Release 5.2.0 includes additional revisions to control content, particularly around software updates and patches. SP 800-53A supplies assessment procedures; SP 800-53B supplies selection baselines. These publications work together, but they perform different jobs.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">First, separate three related documents<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th class=\"has-text-align-left\" data-align=\"left\">Resource<\/th><th class=\"has-text-align-left\" data-align=\"left\">Main question<\/th><th class=\"has-text-align-left\" data-align=\"left\">Practical use<\/th><\/tr><\/thead><tbody><tr><td>SP 800-53<\/td><td>What controls can address identified security and privacy needs?<\/td><td>Control definitions and enhancements<\/td><\/tr><tr><td>SP 800-53B<\/td><td>Which controls form a starting baseline for a system?<\/td><td>Low-, moderate-, high-impact security baselines and privacy baseline<\/td><\/tr><tr><td>SP 800-53A<\/td><td>How can implemented controls be assessed?<\/td><td>Examine, interview, and test procedures<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">There is&nbsp;<strong>no official Level 1-to-Level 5 security maturity scale<\/strong>&nbsp;in SP 800-53. Low, moderate, and high describe protection needs and system impact categories in the relevant context;&nbsp;<strong>high impact does not mean highly mature<\/strong>. For federal systems, use applicable FIPS 199 and the NIST Risk Management Framework (RMF); private organizations may tailor the catalog to their own obligations.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Map the Risk Management Framework<\/h2>\n\n\n\n<pre class=\"wp-block-preformatted\">PrepareCategorizeSelect controlsImplementAssessAuthorizeMonitor<\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Prepare:<\/strong>\u00a0organize risk responsibility, security architecture, asset information, and common-control arrangements.<\/li>\n\n\n\n<li><strong>Categorize:<\/strong>\u00a0determine the likely consequences to confidentiality, integrity, and availability if the system is compromised.<\/li>\n\n\n\n<li><strong>Select:<\/strong>\u00a0choose an initial control baseline when applicable, tailor it, and document rationale and parameters.<\/li>\n\n\n\n<li><strong>Implement:<\/strong>\u00a0build protections into infrastructure, applications, policies, and operations; document how each is realized.<\/li>\n\n\n\n<li><strong>Assess:<\/strong>\u00a0gather evidence that controls are installed correctly, operate as intended, and achieve expected results.<\/li>\n\n\n\n<li><strong>Authorize:<\/strong>\u00a0the appropriate authority makes a documented risk-based operational decision where authorization is required.<\/li>\n\n\n\n<li><strong>Monitor:<\/strong>\u00a0respond to evolving vulnerabilities, configurations, findings, and mission changes.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">For a small private SaaS deployment, the same thinking is useful even when a formal federal authorization-to-operate process does not apply.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Learn to read a control ID<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Consider these illustrative controls from the catalog:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th class=\"has-text-align-left\" data-align=\"left\">Control<\/th><th class=\"has-text-align-left\" data-align=\"left\">Concern<\/th><th class=\"has-text-align-left\" data-align=\"left\">Example implementation<\/th><\/tr><\/thead><tbody><tr><td>AC-2<\/td><td>Account Management<\/td><td>Approval, review, and removal of account access<\/td><\/tr><tr><td>IA-2<\/td><td>Identification and Authentication (Organizational Users)<\/td><td>Strong authentication for organizational users<\/td><\/tr><tr><td>AU-2<\/td><td>Event Logging<\/td><td>Selection and generation of relevant security events<\/td><\/tr><tr><td>CP-9<\/td><td>System Backup<\/td><td>Protected backups and recovery arrangements<\/td><\/tr><tr><td>SI-2<\/td><td>Flaw Remediation<\/td><td>Identify, test, deploy, and verify fixes<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">A control&#8217;s number identifies a topic, not an entire implementation. Read the actual current wording, enhancements, parameters, related controls, and assessor guidance in the official sources. A single product may support many controls, but rarely proves complete implementation of any one by itself.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">End-to-end example: Protect a telemetry API<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Northstar Mobility hosts a telemetry API, a managed database, an identity provider, and an operational dashboard. Begin with a system boundary: included accounts, workloads, network segments, managed services, users, and external provider responsibilities.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>1. Identify the risk.<\/strong>&nbsp;A privileged engineer could lose a credential, enabling unauthorized access to customer data.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>2. Choose relevant controls.<\/strong>&nbsp;AC-2 for account lifecycle, IA-2 for authentication, AU-2 for events, and SI-2 for flaws are plausible candidates, subject to baseline and tailoring requirements.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>3. Document implementation.<\/strong>&nbsp;Explain identity federation, access approval workflow, MFA configuration, logging destinations, retention decisions, and vulnerability remediation procedures. Avoid saying only &#8216;Implemented via AWS.&#8217;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>4. Identify inheritance.<\/strong>&nbsp;A cloud provider may handle data center physical access while Northstar remains responsible for its own application identities, cloud configurations, and log review. Define inherited, shared, and organization-implemented responsibilities precisely.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>5. Assess the control.<\/strong>&nbsp;Interview the identity administrator, examine access review samples, and test whether a disabled user can still obtain application access. The test must be authorized and performed in a safe environment.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>6. Handle failure.<\/strong>&nbsp;Record the unmet assessment objective, exposure, remediation owner, planned date, and mitigation; retest after changes.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Example control implementation and assessment record<\/h2>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-1\" data-shcb-language-name=\"JavaScript\" data-shcb-language-slug=\"javascript\"><span><code class=\"hljs language-javascript\">control_id: AC<span class=\"hljs-number\">-2<\/span>\n<span class=\"hljs-attr\">system<\/span>: telemetry-api\n<span class=\"hljs-attr\">responsible_owner<\/span>: identity-platform-team\n<span class=\"hljs-attr\">implementation<\/span>: &gt;\n  Human access is provisioned through the identity provider after\n  manager approval and reviewed periodically by service owners.\n  Departing employees are disabled through the offboarding workflow.\nassessment:\n  examine:\n    - access-approval-samples\n    - identity-configuration-<span class=\"hljs-keyword\">export<\/span>\n    - access-review-records\n  <span class=\"hljs-attr\">interview<\/span>:\n    - identity-platform-team\n  <span class=\"hljs-attr\">test<\/span>:\n    - approved-test-user-revocation\n<span class=\"hljs-attr\">status<\/span>: implemented-pending-assessment\n<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-1\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">JavaScript<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">javascript<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<p class=\"wp-block-paragraph\">This is a teaching format,&nbsp;<strong>not official OSCAL<\/strong>, and the text is not a substitute for the authoritative control wording or full assessment objectives. In a production environment, select an appropriate machine-readable format such as OSCAL when interoperability matters.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Hands-on lab: Build a tiny assessment tracker<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Create&nbsp;<code>assess_controls.py<\/code>&nbsp;and run it with Python 3. The data are synthetic.<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-2\" data-shcb-language-name=\"PHP\" data-shcb-language-slug=\"php\"><span><code class=\"hljs language-php\">controls = &#91;\n    {<span class=\"hljs-string\">\"id\"<\/span>: <span class=\"hljs-string\">\"AC-2\"<\/span>, <span class=\"hljs-string\">\"implemented\"<\/span>: <span class=\"hljs-keyword\">True<\/span>, <span class=\"hljs-string\">\"examined\"<\/span>: <span class=\"hljs-keyword\">True<\/span>, <span class=\"hljs-string\">\"tested\"<\/span>: <span class=\"hljs-keyword\">True<\/span>},\n    {<span class=\"hljs-string\">\"id\"<\/span>: <span class=\"hljs-string\">\"IA-2\"<\/span>, <span class=\"hljs-string\">\"implemented\"<\/span>: <span class=\"hljs-keyword\">True<\/span>, <span class=\"hljs-string\">\"examined\"<\/span>: <span class=\"hljs-keyword\">True<\/span>, <span class=\"hljs-string\">\"tested\"<\/span>: <span class=\"hljs-keyword\">False<\/span>},\n    {<span class=\"hljs-string\">\"id\"<\/span>: <span class=\"hljs-string\">\"AU-2\"<\/span>, <span class=\"hljs-string\">\"implemented\"<\/span>: <span class=\"hljs-keyword\">False<\/span>, <span class=\"hljs-string\">\"examined\"<\/span>: <span class=\"hljs-keyword\">False<\/span>, <span class=\"hljs-string\">\"tested\"<\/span>: <span class=\"hljs-keyword\">False<\/span>},\n]\n\n<span class=\"hljs-keyword\">for<\/span> c in controls:\n    complete = all(c&#91;k] <span class=\"hljs-keyword\">for<\/span> k in (<span class=\"hljs-string\">\"implemented\"<\/span>, <span class=\"hljs-string\">\"examined\"<\/span>, <span class=\"hljs-string\">\"tested\"<\/span>))\n    status = <span class=\"hljs-string\">\"Local evidence complete\"<\/span> <span class=\"hljs-keyword\">if<\/span> complete <span class=\"hljs-keyword\">else<\/span> <span class=\"hljs-string\">\"Needs follow-up\"<\/span>\n    <span class=\"hljs-keyword\">print<\/span>(f<span class=\"hljs-string\">'{c&#91;\"id\"]}: {status}'<\/span>)\n<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-2\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">PHP<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">php<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<p class=\"wp-block-paragraph\">Expected output:&nbsp;<code>AC-2<\/code>&nbsp;is locally complete;&nbsp;<code>IA-2<\/code>&nbsp;and&nbsp;<code>AU-2<\/code>&nbsp;need follow-up. This simplified local checklist demonstrates workflow only. An actual SP 800-53A determination evaluates the applicable objectives, their methods, and the assessor&#8217;s findings; the three Boolean fields above do&nbsp;<strong>not<\/strong>&nbsp;establish federal control compliance.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Put continuous monitoring on an operational cadence<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">For each selected control, define an owner, evidence source, evaluation method, trigger, and review frequency. Examples include access-review completion, backup-restoration results, unresolved critical flaws, cloud policy drift, and changes to system boundaries. The frequency must reflect system risk, applicable requirements, and organizational policy rather than a single universal interval.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A useful evidence chain looks like this:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">Risk or requirementSelected controlDocumented implementationConfiguration and operational evidenceAssessment findingRemediation or risk decisionContinuous monitoring<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">What good assessors actually challenge<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A control can appear to be enabled but fail in practice. An MFA policy may exclude emergency accounts; logs may omit privileged actions; patch tickets may close before deployment; backups may be unreadable. Assessors therefore examine both design and effectiveness. The three broad assessment methods are&nbsp;<strong>examine, interview, and test<\/strong>, tailored according to the official procedures and assessment plan.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Do not treat a downloaded 800-53 spreadsheet as an audit checklist that can be blindly checked &#8216;Yes.&#8217; Control enhancements, organization-defined parameters, inherited responsibilities, system impact, overlays, and actual obligations matter.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Self-assessment<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Q:<\/strong>&nbsp;Which publication defines control baselines?&nbsp;<strong>A:<\/strong>&nbsp;SP 800-53B.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Q:<\/strong>&nbsp;Does a high-impact baseline indicate an organization&#8217;s maturity?&nbsp;<strong>A:<\/strong>&nbsp;No. It is a control-selection baseline for system protection needs.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Q:<\/strong>&nbsp;What distinguishes implementation from assessment?&nbsp;<strong>A:<\/strong>&nbsp;Implementation establishes the mechanism; assessment evaluates whether it is correctly implemented and effective against defined objectives.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Official references<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>SP 800-53 Rev. 5 and release updates:\u00a0<a href=\"https:\/\/csrc.nist.gov\/pubs\/sp\/800\/53\/r5\/final\">https:\/\/csrc.nist.gov\/pubs\/sp\/800\/53\/r5\/final<\/a><\/li>\n\n\n\n<li>SP 800-53B:\u00a0<a href=\"https:\/\/csrc.nist.gov\/pubs\/sp\/800\/53\/b\/upd1\/final\">https:\/\/csrc.nist.gov\/pubs\/sp\/800\/53\/b\/upd1\/final<\/a><\/li>\n\n\n\n<li>NIST 800-53 download resources:\u00a0<a href=\"https:\/\/csrc.nist.gov\/projects\/risk-management\/sp800-53-controls\/downloads\">https:\/\/csrc.nist.gov\/projects\/risk-management\/sp800-53-controls\/downloads<\/a><\/li>\n\n\n\n<li>NIST RMF resources:\u00a0<a href=\"https:\/\/csrc.nist.gov\/projects\/risk-management\">https:\/\/csrc.nist.gov\/projects\/risk-management<\/a><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>&#8216;We have logging&#8217; is not an adequate answer to an assessor. Which events are logged? Who can modify them? What happens when a collector fails? How do&#8230; <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_joinchat":[],"footnotes":""},"categories":[11138],"tags":[],"class_list":["post-79550","post","type-post","status-publish","format-standard","hentry","category-best-tools"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/79550","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/comments?post=79550"}],"version-history":[{"count":1,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/79550\/revisions"}],"predecessor-version":[{"id":79551,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/79550\/revisions\/79551"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/media?parent=79550"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/categories?post=79550"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/tags?post=79550"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}