old.reddit.com /r/NISTControls/
NIST Controls Discussion, Resource Sharing, News, Recommendations for Solutions
Active Web Watch
Back to top.
Recently Seen Items
Compact view
Reading view
Hey Reddit Hivemind! I have been doing RMF for the last 11 years and I have been doing interviews and hiring RMF personnel for the last 7-8… I feel like a lot of the time the candidates look good on paper, but end up being a dud… so…
What I am wondering is if any of you who hire for RMF related positions or any of you who do RMF 1-3 related work have any good interview questions (that you have asked or been asked) to actually gauge someones ability to write system security plans, categorize systems, ability to take technical ideas/processes and write them in a layman manner, etc? What things do you look for in the candidates to make more efficient choices in candidate selection?
[link] [comments]
Greetings! First post. I am being asked to make sure that a DR plan, where they are really asking for a BCP with a DR plan (BCP being my specialty), is ISO 27001 compliant. If I raise them to NIST 800-53 compliant, using a crosswalk document that I found, can anyone here confirm that 800-53 is a good equivalency? I believe it is, but I am asking in a few online groups. Many, many thanks in advance for your comments!
[link] [comments]
Idk if it can be answered here or if someone can attest to it, but am I able to switch to FIPS compliant encryption after already enabling Bitlocker on computers? Or will I have to disable Bitlocker and switch the settings to FIPS compliant first, then re-Bitlocker them?
[link] [comments]
Hello!
I am trying to create a Security Configuration Checklist for Microsoft 365. There appear to be two options for support on this in the NIST National Checklist Program here (https://ncp.nist.gov/repository?sortBy=modifiedDate%7Cdesc&keyword=online). Either the CIS 365 Benchmark or the SCuBA tool from CISA. I have found a mapping to 800-53 using CIS 365 Benchmark controls. But I haven't found a mapping to 800-53 for the SCuBA controls. Does such a thing exist? Can I choose either checklist to create the SCC? Thanks for any input or comments.
[link] [comments]
Will require some Open source authoritative source which can be relied upon. In the past PCI themselves had published the mapping between PCI DSS V3.2 and NIST SP 800 -53 Rev4. But they have not done this yet for PCI DSS V4. Cannot use SCF or UCF as they do not provide direct mapping between these standards instead they map it to their common controls.
[link] [comments]
How are organizations controlling this for remote workers, specifically ones that may travel to hotels. In a corporate office environment, I see this as an easy fix. I've thought about only allowing LTE Hotspots, so they do not use a hotel WIFI. I also cannot find a way to technically prevent these types of connections. Any help would be appreciated.
AC.L2-3.1.16, AC.L2-3.1.17, and AC.L2-3.1.18 are the controls I'm referring to.
[link] [comments]
My organization hired a consultant to conduct a NIST assessment for us. He is new and this will be his first time leading an assessment.
We provided him with our SSP, but he also wants to schedule interviews with various staff members. In some cases, he’s requesting 3-4 hours of peoples time.
Are interviews a standard part of the assessment process? I know it’s a time-intensive process, but I have the feeling it’s being made more complicated than it actually should be.
[link] [comments]
Hey everyone, so I work for a major cloud provider and have been tasked with learning all about ATOs to better help mission owners onboard into enterprise cloud offerings. Can someone explain to me start to finish how I representing the cloud provider, is supposed to help mission owners onboard? I have a pretty rough idea of what I should be doing like, providing PPSM, HW/SW lists, test plans, then selecting controls and going line by line. This is all I really “know” but not sure what this looks like from a hands on perspective, like what am I spending my time doing exactly? What is the output of the categorization step, I know there’s low, moderate, high. But what exactly is that being mapped too, data types? The entire system? Like what is considered low, moderate, or high? I know that’s a lot but thanks everyone for the support.
[link] [comments]
One issue we keep coming up against when trying to implement 800-171 is finding terms that aren't well defined and how to interpret them or find a federally accepted definition.
For example, the controls make a lot of references to 'software' and 'install' (like 3.4.9). In this case, the NIST definition of 'installation' is somewhat helpful , but 'software' has a dozen definitions, none of them super helpful.
Is uncompiled code software? Does compiling it count as an installation? What about cloning a repo? Is a script software? Is a linux user that writes a simple shell script in their home directory installing software? Would a series of Powershell commands in a text file be software? Would changing the extension to .ps1 count as installing?
My gut says to just take the most restrictive approach and say yes to all of the above, but I worry that always erring on the side of caution is going to result in an environment that's extremely difficult to build and maintain, and functionally useless.
Anyone have any good resources or suggestions for clarifying some of these things? We have worked with an outside consultant and it was extremely helpful but it feels like we have to learn to sort some of this out on our own for this to be successful long-term.
[link] [comments]
Does FedRAMP/NIST 800-53 Moderate require that the SDL/SIL be locked down tight like the cloud VMs and architecture would be? Or would it be better to keep the development servers located in the cloud?
For context, our current development servers are located in AWS Gov Cloud. Our developers want to bring the development servers into their lab instead of on the cloud. Would this require us to bring the lab up to compliance with 800-53. We are currently at 800-171 compliance and expect that 800-53 would be a lot more of a lift to get to.
[link] [comments]
We need to know what control addresses Windows SSTP VPN using the domain login passthrough credentials.
We have Duo MFA enabled on the VPN connection but need to know if we need to require entering the domain un/pw when connecting to the VPN or if we can enable credential passthrough.
Thanks.
[link] [comments]
No idea where to start here. Any built-in feature in VPC can be used to handle this?
[link] [comments]
I have been tasked with incorporating a new system into an existing boundary. My ISSO told me to go through NIST 800-53 and review and check if any of the controls are impacted by the new system.
I am not sure what the criteria is for this? He said- does this control "change" with the new system. I am looking at it from the perspective of- Does the new system use this control? If so, how? and if it's not applicable to note that.
The communication with this ISSO is terrible so I am afraid to ask more questions. Any help is great!
[link] [comments]
After reviewing the SAP/SAR workbook I noticed the FedRAMP methodology bundles NIST 800-53(a) granularity into larger single scope sections. Which in turn makes it less likely an organization will pass the control, even partially.
Any reasoning behind this?
Example: theoretical...
Control in NIST AC-1.a[1]....[2]....[3] all separate granularity auditing sections.
Control in FedRAMP AC-1.a[1,2,3] one single audit section.
[link] [comments]
Hey Everyone,
my organization has some international contractors that have access to our Microsoft GCC-High tenant resources. My question is are they allowed to access our Microsoft GCC-High tenant resources. We were thinking of creating a policy that has international travel as our exception. Will we encounter any issues with being compliant?
[link] [comments]
I know there is a DISA STIG for whitelisting web browser, besides CM-7(5) which applies only to high impact systems, are there any other security requirements in NIST SP 800-53 that would force whitelisting for SAML RelayState Redirect?
[link] [comments]
I’m helping finalize a subcontract with a university, but there’s pushback on a clause about NIST SP 800-171 DoD NIST Assessment Requirements.
The university says this doesn’t apply and should be deleted from the subcontract because their effort is fundamental research. However, it’s my understanding that the institution should still have a current NIST assessment on file through the SPRS portal (they currently don’t have one in there). Example source that supports my interpretation: Federal Register - CMMC Program - Fundamental Research.
Am I misunderstanding the NIST assessment requirement? You need 110 score if the effort involves CUI, but you simply need a score - any score - logged in the assessment portal to be in compliance for fundamental research.
[link] [comments]
I'm curious how everyone is meeting this control on Linux (specifically Red Hat). I'm also interested in knowing if you've run into any conflicts with 3.14.5 (malware scanning) since two different solutions intercepting I/O could be a large cause for conflict
Just for reference here are the controls I'm referencing:
3.4.8 Apply deny-by-exception (blacklisting) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (whitelisting) policy to allow the execution of authorized software.
3.14.5 Perform periodic scans of organizational systems and real-time scans of files from external sources as files are downloaded, opened, or executed. 3.14. 6 Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.
[link] [comments]
Hey all,
I have a company(A) ho is looking to purchase products that my company makes. Company A required us to be NIST certified. I am working with IT today to go through the questionnaire. I have a few questions because although we are a very large organization we do not have this certification.
-Our location runs “separately” from corporate. Can we fill these questions out per our location?
-what is the “system” that it calls out in system identification. Is that firewalls…ERP….etc?
- is there a cost associated with becoming complaint?
-is there an Audit required for this?
Honestly, we have no guidance for this process so any help would be very appreciated!
[link] [comments]
I’m sys admin with very limited experience in information security/documentation. I was tasked to self-assess my company controls and document my findings. Is there an online resource that provide guidance to do this?
I found the official assessment guide 800-53A and was thinking of creating an interview template to review specific controls with the system admin/owner. Once I have the info and evidence, update the 800-53A with my findings. Is this the correct approach?
TIA
[link] [comments]
Hi folks, my cutover to GCC is in a few weeks, and I'm a bit nervous to be honest. We are keeping onprem AD, so hybrid setup. I'm hoping I don't have to rejoin PCs to the domain, but I've read that some had to do that. Any gotchas or tips you can share for those experienced in these migrations? Thank you!
[link] [comments]