What is the NIST 800-53r5?
The foundational security and privacy guidance document of the National Institute of Standards and Technology (NIST) is known as NIST 800-53, the Security and Privacy Controls for Information Systems and Organizations. The fifth revision was released in September 2020.
In an article published to the official NIST blog, authors Ron Ross, Victoria Yan Pillitteri, and Noami Lefkovitz state that “NIST SP 800-53, Revision 5 is not just a minor update but rather a complete renovation—addressing both structural issues and technical content.” In particular, the authors note that its guidance is applicable to organizations small and large and relates to connected Internet of Things (IoT) devices all the way to operational Industrial Control Systems (ICS).
Why Use the NIST 800-53 Assessment Framework?
The NIST 800-53 guidance provides a consolidated control catalog of controls that organizations can select and implement based on the different categories of information management systems. But after implementing those controls, it is vital to assess the personnel, processes, and technology to ensure that the organization follows them. To help better understand compliance, many organizations turn to cybersecurity consultants to assess the situation, provide insights on what is out of compliance and remediate those trouble areas.
Typically, such assessments are laborious and time-consuming, not only in manually collecting the data, but also in collating it into a presentable form.
How to Conduct a NIST 800-53 Assessment with SecurityGate.io
The SecurityGate.io NIST 800-53 assessment tool lifts the load in performing these assessments. Our cloud-based tool has built-in workflows for this framework, so you can quickly assess an organization for NIST 800-53 compliance without having to configure anything on the front end.
Three new insights have been implemented for NIST 800-53r5 in the SecurityGate.io platform including:
ICS MITRE Mappings – NIST 800-53r5 is now mapped to ICS MITRE tactics.
Risk – NIST 800-53r5 assessment questions are now mapped to risk insights to show several different types of risk depending on missing controls.
PPT (People, Process, and Technology)
These insights are also seen in Reports with more detail about the PPT breakdown, top risks, and MITRE tactics.
About SecurityGate.io
SecurityGate.io is a (SaaS) platform that helps organizations prioritize resources and improve cybersecurity by enabling teams to quickly compare insights of their security controls. With SecurityGate.io’s critical infrastructure expertise, simplified dashboard, and actionable data workflows, asset owners and consultant partners are empowered to collaborate and mature cyber-programs faster and easier than traditional manual methods.
