Home/Compliance
nist-800-53

NIST 800-53. Security Controls

11 controls · cross-mapped to ATT&CK techniques
Translate between regulatory language and what attackers actually do. Each control maps to MITRE ATT&CK techniques; open a control to see those techniques and whether we hold detection coverage for them.
NIST 800-53 (1246)NIST CSF (106)ISO 27001:2022 (93)PCI-DSS v4.0 (75)CIS v8.1 (62)CRI Profile (60)CSA CCM v4 (57)SOC 2 TSC (57)OWASP API (10)OWASP Mobile (10)OWASP Web (10)
1246
Total controls
0%
Detection coverage
0
Covered controls
1246
Coverage gaps
▤ Export audit (CSV) Coverage report Self-assessment Show gaps only
▶ Check your own detection coverage

Paste the ATT&CK technique IDs you have Sigma/YARA rules for (one per line, e.g. T1059, T1190). The controls below will update to show YOUR coverage instead of ours.

Red team insight A nist-800-53 compliant org should have detection for the green-tagged techniques below. Controls showing no technique coverage are likely blind spots. Use gaps view to enumerate unmonitored attack paths.
▤

Controls

11 shown of 11
AU-6
Audit Record Review, Analysis, and Reporting
Review and analyze system audit records {{ insert: param, au-06_odp.01 }} for indications of {{ insert: param, au-06_odp.02 }} and the potential impact of the inappropriate or unusual activity; Report findings to {{ insert: param, au-06_odp.03 }} ; and Adjust the level of audit record review, analysis, and reporting within the system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.
family AU framework nist-800-53
Equivalent controls in other frameworks  click any to see its ATT&CK technique mappings
iso-27001-2022: A.8.15 ↗iso-27001-2022: A.8.16 ↗
AU-6.1
Automated Process Integration
Integrate audit record review, analysis, and reporting processes using {{ insert: param, au-06.01_odp }}.
family AU framework nist-800-53
AU-6.10
Audit Level Adjustment
family AU framework nist-800-53
AU-6.2
Automated Security Alerts
family AU framework nist-800-53
AU-6.3
Correlate Audit Record Repositories
Analyze and correlate audit records across different repositories to gain organization-wide situational awareness.
family AU framework nist-800-53
AU-6.4
Central Review and Analysis
Provide and implement the capability to centrally review and analyze audit records from multiple components within the system.
family AU framework nist-800-53
AU-6.5
Integrated Analysis of Audit Records
Integrate analysis of audit records with analysis of {{ insert: param, au-06.05_odp.01 }} to further enhance the ability to identify inappropriate or unusual activity.
family AU framework nist-800-53
AU-6.6
Correlation with Physical Monitoring
Correlate information from audit records with information obtained from monitoring physical access to further enhance the ability to identify suspicious, inappropriate, unusual, or malevolent activity.
family AU framework nist-800-53
AU-6.7
Permitted Actions
Specify the permitted actions for each {{ insert: param, au-06.07_odp }} associated with the review, analysis, and reporting of audit record information.
family AU framework nist-800-53
AU-6.8
Full Text Analysis of Privileged Commands
Perform a full text analysis of logged privileged commands in a physically distinct component or subsystem of the system, or other system that is dedicated to that analysis.
family AU framework nist-800-53
AU-6.9
Correlation with Information from Nontechnical Sources
Correlate information from nontechnical sources with audit record information to enhance organization-wide situational awareness.
family AU framework nist-800-53
Showing 1-11 of 11
Prev 1 Next
Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities
Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs
Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures
Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1
About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service
threatengine.sh  ·  Open-source threat intelligence platform  ·  100+ authoritative sources  ·  Every fact traces to its origin