NIST 800-53 — Compliance Controls

Home/Compliance

nist-800-53

NIST 800-53. Security Controls

1,246 controls · cross-mapped to ATT&CK techniques

Translate between regulatory language and what attackers actually do. Each control maps to MITRE ATT&CK techniques; open a control to see those techniques and whether we hold detection coverage for them.

NIST 800-53 (1246)NIST CSF (106)ISO 27001:2022 (93)PCI-DSS v4.0 (75)CIS v8.1 (62)CRI Profile (60)CSA CCM v4 (57)SOC 2 TSC (57)OWASP API (10)OWASP Mobile (10)OWASP Web (10)

1246

Total controls

Detection coverage

Covered controls

1246

Coverage gaps

▤ Export audit (CSV) Coverage report Self-assessment Show gaps only

▶ Check your own detection coverage

Paste the ATT&CK technique IDs you have Sigma/YARA rules for (one per line, e.g. T1059, T1190). The controls below will update to show YOUR coverage instead of ours.

Red team insight A nist-800-53 compliant org should have detection for the green-tagged techniques below. Controls showing no technique coverage are likely blind spots. Use gaps view to enumerate unmonitored attack paths.

▤

Controls

80 shown of 1,246

AT-2.5

Advanced Persistent Threat

Provide literacy training on the advanced persistent threat.

family AT framework nist-800-53

AT-2.6

Cyber Threat Environment

Provide literacy training on the cyber threat environment; and Reflect current cyber threat information in system operations.

family AT framework nist-800-53

AT-3

Role-based Training

Provide role-based security and privacy training to personnel with the following roles and responsibilities: {{ insert: param, at-3_prm_1 }}: Before authorizing access to the system, information, or performing assigned duties, and {{ insert: param, at-03_odp.03 }} thereafter; and When required by system changes; Update role-based training content {{ insert: param, at-03_odp.04 }} and following {{ insert: param, at-03_odp.05 }} ; and Incorporate lessons learned from internal or external security incidents or breaches into role-based training.

family AT framework nist-800-53

AT-3.1

Environmental Controls

Provide {{ insert: param, at-03.01_odp.01 }} with initial and {{ insert: param, at-03.01_odp.02 }} training in the employment and operation of environmental controls.

family AT framework nist-800-53

AT-3.2

Physical Security Controls

Provide {{ insert: param, at-03.02_odp.01 }} with initial and {{ insert: param, at-03.02_odp.02 }} training in the employment and operation of physical security controls.

family AT framework nist-800-53

AT-3.3

Practical Exercises

Provide practical exercises in security and privacy training that reinforce training objectives.

family AT framework nist-800-53

AT-3.4

Suspicious Communications and Anomalous System Behavior

family AT framework nist-800-53

AT-3.5

Processing Personally Identifiable Information

Provide {{ insert: param, at-03.05_odp.01 }} with initial and {{ insert: param, at-03.05_odp.02 }} training in the employment and operation of personally identifiable information processing and transparency controls.

family AT framework nist-800-53

AT-4

Training Records

Document and monitor information security and privacy training activities, including security and privacy awareness training and specific role-based security and privacy training; and Retain individual training records for {{ insert: param, at-04_odp }}.

family AT framework nist-800-53

AT-5

Contacts with Security Groups and Associations

family AT framework nist-800-53

AT-6

Training Feedback

Provide feedback on organizational training results to the following personnel {{ insert: param, at-06_odp.01 }}: {{ insert: param, at-06_odp.02 }}.

family AT framework nist-800-53

AU-1

Policy and Procedures

Develop, document, and disseminate to {{ insert: param, au-1_prm_1 }}: {{ insert: param, au-01_odp.03 }} audit and accountability policy that: Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and Procedures to facilitate the implementation of the audit and accountability policy and the associated audit and accountability controls; Designate an {{ insert: param, au-01_odp.04 }} to manage the development, documentation, and dissemination of the audit and accountability policy and procedures; and Review and update the current audit and accountability: Policy {{ insert: param, au-01_odp.05 }} and following {{ insert: param, au-01_odp.06 }} ; and Procedures {{ insert: param, au-01_odp.07 }} and following {{ insert: param, au-01_odp.08 }}.