National Institute of Standards and Technology (NIST)

Maintain the integrity, confidentiality, and security of information systems.

Security and Privacy Controls for Federal Information Systems and Organizations

The National Institute of Standards and Technology (NIST) is a U.S. federal agency that establishes computer and information technology related standards and guidelines for federal agencies to use.

NIST SP 800-53 is shorthand for the National Institute of Standards and Technology Special Publication 800-53, Security and Privacy Controls for Federal Information Systems and Organization. These guidelines apply to any component of a system that stores, processes or transmits federal information. It provides a catalog of controls — operational, technical, and management safeguards used by information systems to maintain the integrity, confidentiality, and security of federal information systems.

While the framework was designed for governmental agencies, it is used by organizations in all industries to improve the security of their organization’s information systems by providing a fundamental baseline for developing a secure organizational infrastructure.

National Institute of Standards and Technology Requirements

Scan for Vulnerabilities
Scan for vulnerabilities in the information system and hosted applications and when new vulnerabilities potentially affecting the system/applications are identified and reported.
Automate Parts of the Vulnerability Management Process
Employ vulnerability scanning tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process such as measurement of vulnerability impact and enumerating platforms, software flaws, and improper configurations.
Analyze Scan Reports
Analyze vulnerability scan reports and results from security control assessments.
Remediation of Vulnerabilities
Remediate legitimate vulnerabilities in accordance with an organizational assessment of risk.
Help Eliminate Similar Vulnerabilities
Share information obtained from the vulnerability scanning process and security control assessments internally to help eliminate similar vulnerabilities in other information systems.