<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-nist-800-53-controls
description: >-
  Implement and validate NIST SP 800-53 Rev 5 security controls across all 20
  control families. Automate assessment with OSCAL-formatted catalogs, OPA policies,
  and InSpec profiles for Low/Moderate/High baselines.
domain: cybersecurity
subdomain: compliance-audit
tags:
  - nist-800-53
  - nist
  - oscal
  - security-controls
  - federal
  - compliance
  - audit
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Implementing NIST 800-53 Controls

## Overview

NIST SP 800-53 Rev 5 defines over 1000 security and privacy controls across 20
families. This skill automates control implementation and assessment using OSCAL
machine-readable catalogs, OPA policies for infrastructure validation, and InSpec
profiles mapped to Low/Moderate/High baselines.

Mode: `[MODE: ARCHITECT]` — Control implementation design; `[MODE: BLUE]` — Assessment.

## Prerequisites

| Requirement | Details |
|---|---|
| OPA (`brew install opa`) | Required |
| InSpec (`gem install inspec`) | Required |
| OSCAL CLI (`npm install -g @oscal/oscal-cli`) | Required |
| `pip install compliance-trestle` | Required |

## Key Concepts

### Control Families

```
NIST 800-53 Rev 5 — 20 Control Families:
├── AC  — Access Control (25 controls)
├── AT  — Awareness and Training (6 controls)
├── AU  — Audit and Accountability (16 controls)
├── CA  — Assessment, Authorization, Monitoring (9 controls)
├── CM  — Configuration Management (14 controls)
├── CP  — Contingency Planning (13 controls)
├── IA  — Identification and Authentication (12 controls)
├── IR  — Incident Response (10 controls)
├── MA  — Maintenance (7 controls)
├── MP  — Media Protection (8 controls)
├── PE  — Physical and Environmental Protection (23 controls)
├── PL  — Planning (11 controls)
├── PM  — Program Management (32 controls)
├── PS  — Personnel Security (9 controls)
├── PT  — PII Processing and Transparency (8 controls)
├── RA  — Risk Assessment (10 controls)
├── SA  — System and Services Acquisition (23 controls)
├── SC  — System and Communications Protection (51 controls)
├── SI  — System and Information Integrity (23 controls)
└── SR  — Supply Chain Risk Management (12 controls)

Baselines:
├── Low:      ~130 controls (non-federal, low-impact)
├── Moderate: ~325 controls (most federal systems)
└── High:     ~421 controls (national security systems)
```

### OPA Policies — NIST 800-53 Mapped

```rego
# policy/nist_ac.rego
package nist.access_control

# AC-2: Account Management — disable inactive accounts
deny[msg] {
    user := input.iam_users[_]
    days_inactive := (time.now_ns() - user.last_activity_ns) / (24 * 60 * 60 * 1000000000)
    days_inactive > 90
    msg := sprintf("AC-2: User %v inactive for %v days (>90 day limit)", [user.name, days_inactive])
}

# AC-3: Access Enforcement — no wildcard IAM policies
deny[msg] {
    policy := input.iam_policies[_]
    statement := policy.document.Statement[_]
    statement.Effect == "Allow"
    statement.Action[_] == "*"
    statement.Resource == "*"
    msg := sprintf("AC-3: Policy %v grants wildcard access (*:*)", [policy.name])
}

# AC-6: Least Privilege — limit admin users
deny[msg] {
    admin_count := count([u | u := input.iam_users[_]; u.is_admin])
    admin_count > 3
    msg := sprintf("AC-6: %v admin users exceed threshold of 3", [admin_count])
}
```

### InSpec Profile — NIST 800-53

```ruby
# controls/nist_au.rb
control 'nist-au-2' do
  impact 1.0
  title 'AU-2: Event Logging'
  desc 'System produces audit records for defined events.'
  tag nist: ['AU-2']
  tag baseline: ['low', 'moderate', 'high']

  describe service('auditd') do
    it { should be_enabled }
    it { should be_running }
  end

  describe file('/etc/audit/audit.rules') do
    it { should exist }
    its('content') { should match(/-w \/etc\/passwd -p wa/) }
    its('content') { should match(/-w \/etc\/shadow -p wa/) }
  end
end

control 'nist-ia-2' do
  impact 1.0
  title 'IA-2: Identification and Authentication'
  desc 'Uniquely identify and authenticate organizational users.'
  tag nist: ['IA-2']
  tag baseline: ['low', 'moderate', 'high']

  describe sshd_config do
    its('PasswordAuthentication') { should eq 'no' }
    its('PubkeyAuthentication') { should eq 'yes' }
  end
end

control 'nist-sc-28' do
  impact 1.0
  title 'SC-28: Protection of Information at Rest'
  desc 'Protect confidentiality and integrity of information at rest.'
  tag nist: ['SC-28']
  tag baseline: ['moderate', 'high']

  describe command('lsblk -o NAME,FSTYPE | grep -i crypt') do
    its('stdout') { should_not be_empty }
  end
end
```

## Workflow

### Step 1: Select Baseline and Generate Catalog

```bash
node scripts/agent.js --action catalog --baseline moderate \
  --output /tmp/nist-catalog.json
```

### Step 2: Assess Controls

```bash
node scripts/agent.js --action assess --profile ./controls/ \
  --families AC,AU,IA,SC --output /tmp/nist-assessment.json
```

### Step 3: Generate SSP Artifact

```bash
node scripts/agent.js --action ssp --input /tmp/nist-assessment.json \
  --system-name "Production Cloud" --output /tmp/nist-ssp.json
```

## Verification

- [ ] Baseline selected (Low/Moderate/High) and justified
- [ ] All control families in baseline have mapped implementations
- [ ] OPA policies enforce AC, IA, SC controls automatically
- [ ] Audit logging satisfies AU family requirements
- [ ] OSCAL-formatted catalog and SSP produced
- [ ] POA&M generated for unimplemented controls
- [ ] Continuous monitoring plan covers ongoing assessment

## References

- [NIST SP 800-53 Rev 5](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final)
- [NIST OSCAL](https://pages.nist.gov/OSCAL/)
- [Compliance Trestle](https://ibm.github.io/compliance-trestle/)
