NIST SP 800-53

Security & Privacy Controls: system component inventory, supply chain protection, software integrity.


Short name	SP 800-53
Region	Americas
Country or scope	United States
Sector	Government
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers SP 800-53

Scan requirements: 7, all decided by a scan.
Controls: the scan requirements below, plus 15 controls from Safeguard's control catalog for SP 800-53.
Automated tests: none map to it directly. Evidence from the frameworks the crosswalk relates it to counts toward its controls where a reviewed or approved equivalent row links them (the crosswalk).
Policy templates: 26: 4 written for SP 800-53 and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 7 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`NIST53-CM-8` System Component Inventory	The organization must develop and maintain an inventory of system components that accurately reflects the system (SP 800-53r5 CM-8)	Scan
`NIST53-CM-8-3` Inventory Accuracy and Detail	Component inventories must include the level of granularity needed for tracking and reporting, meaning each component is recorded with its name and version (SP 800-53r5 CM-8, incl. CM-8(3) automated detection support)	Scan
`NIST53-SI-7` Software Integrity Verification	Integrity verification mechanisms must be employed to detect unauthorized changes to software and firmware, which requires cryptographic hashes for delivered components (SP 800-53r5 SI-7)	Scan
`NIST53-SR-4` Provenance	The organization must document, monitor, and maintain valid provenance of systems and system components, including who created the accompanying inventory documentation (SP 800-53r5 SR-4)	Scan
`NIST53-SR-3` Supply Chain Controls and Processes	Supply chain risk management processes must identify and address weaknesses across suppliers, requiring that the supplier of each component is known and recorded (SP 800-53r5 SR-3)	Scan
`NIST53-RA-5` Vulnerability Monitoring and Scanning	Systems must be monitored and scanned for vulnerabilities, which requires components to carry standard identifiers (PURL/CPE) so they can be matched to vulnerability databases (SP 800-53r5 RA-5)	Scan
`NIST53-SI-2` Flaw Remediation	Software flaws must be identified, reported, and corrected, requiring known versions for every component so applicable patches can be determined (SP 800-53r5 SI-2)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`AC-1`	Access Control Policy and Procedures
`AC-2`	Account Management
`AC-3`	Access Enforcement
`AU-2`	Event Logging
`AU-9`	Protection of Audit Information
`CM-2`	Baseline Configuration
`CM-6`	Configuration Settings
`IA-2`	Identification and Authentication (Organizational Users)
`IA-5`	Authenticator Management
`IR-4`	Incident Handling
`RA-5`	Vulnerability Monitoring and Scanning
`SC-7`	Boundary Protection
`SC-28`	Protection of Information at Rest
`SI-2`	Flaw Remediation
`SR-3`	Supply Chain Controls and Processes

Policy templates

Written for SP 800-53:

Access Control Policy and Procedures
Configuration Management Policy
System and Information Integrity Policy
Incident Response Policy and Procedures

And 22 from the standard set, adapted to SP 800-53.