SP 800-53 is Essential for Security in Federal Government IT Systems

Network World — The National Institute of Standards and Technology (NIST) Special Publication (SP) SP 800-53 provides a unified information security framework to achieve information system security and effective risk management across the entire Federal Government. In previous articles in this series, Paul J. Brusil summarized the risk management framework and the catalog of security controls offered in SP 800-53. In this last of four articles, Brusil reviews the relationship of Recommended Security Controls for Federal Information Systems and Organizations, Rev. 3 to other standards as well as its suitability for government and non-governmental organizations. Everything that follows is Brusil's work with minor edits.

Slideshow: Quiz: Separate Cyber Security Fact From Fiction

* * *

Communities Impacted by SP800-53

SP 800-53 (Appendix H) provides two-way mappings between security controls defined in SP 800-53 and security controls defined in international security standard ISO/IEC 27001, Information Security Management Systems. The latter standard applies to all types of organizations and non-government communities. SP 800-53 also outlines a strategy for harmonizing and converging these two standards.

Part 1, Part 2 and Part 3

SP 800-53 (Appendix I) also contains additions to the SP 800-53 Appendix D security control baselines so that such augmented security control baselines (in Appendix I) can be used in the Industrial Control Systems community. SP 800-53 (Appendix I) also contains community-specific, security control tailoring guidelines and other supplemental guidance for 64 of the security controls applicable to Industrial Control Systems from the SP 800-53 (Appendix D) security control catalog.

First and foremost, SP 800-53 is essential for security in U.S. federal government IT systems. Federal agencies and their external service providers must comply with FISMA, the Federal Information Systems Management Act of 2002, and the set of associated federal documents – FIPS 199 (Standards for Security Categorization of Federal Information and Information Systems), FIPS 200 (Minimum Security Requirements for Federal Information and Information Systems) and SP 800-53 – that delineate standards, specifications and recommendations for implementing FISMA. FISMA requires agencies in the US government and their contractors to understand risk and to undertake a risk management process on all their IT systems.

Specifically, FISMA requires that all agencies develop, document and implement agency-wide IA programs that support operations and assets and provide "adequate security." Every year, Inspectors General evaluate agency progress to achieve such requirements in the context of each agency's unique mission, environment and organization. SP800-53 is used as a guiding document to implement and to improve security under FISMA.

What the critics say

Continue Reading