NIST 800-53

Summary

NIST SP 800-53 defines the standards and guidelines for federal agencies to architect and manage their information security systems. It was established to provide guidance for the protection of agency's and citizen's private data. The version used for this section is NIST 800-53, Rev. 5, September 2020.

Definitions

Definition	Requirements
AC-2_2. Removal of temporary or emergency accounts	023. Terminate inactive user sessions 027. Allow session lockout
AC-2_3. Disable accounts	144. Remove inactive accounts periodically
AC-2_4. Automated audit actions	301. Notify configuration changes
AC-2_6. Dynamic privilege management	095. Define users with privileges 096. Set user's required privileges
AC-2_7a. Establish and administer privileged user accounts	095. Define users with privileges 096. Set user's required privileges
AC-2_7b. Monitor privileged role or attribute assignments	095. Define users with privileges 096. Set user's required privileges
AC-2_7c. Monitor changes to roles or attributes	095. Define users with privileges 096. Set user's required privileges
AC-2_10. Shared and group account credential change	144. Remove inactive accounts periodically
AC-2_13. Disable accounts for high-risk individuals	027. Allow session lockout 144. Remove inactive accounts periodically
AC-6. Least privilege	186. Use the principle of least privilege
AC-12. Session termination	023. Terminate inactive user sessions 369. Set a maximum lifetime in sessions
AC-18_5. Antennas and transmission power levels	249. Locate access points
IA-1. Policy and procedures	229. Request access credentials
IA-2. Identification and authentication (organizational users)	121. Guarantee uniqueness of emails 229. Request access credentials 257. Access based on user credentials 265. Restrict access to critical processes
IA-7. Cryptographic module authentication	147. Use pre-existent mechanisms 224. Use secure cryptographic mechanisms
PL-4_1. Social media and external site/applications usage restrictions	260. Use alternative emails
SC-3. Security function isolation	235. Define credential interface

Free trial

Search for vulnerabilities in your apps for free with Fluid Attacks' automated security testing! Start your 21-day free trial and discover the benefits of the Continuous Hacking Essential plan. If you prefer the Advanced plan, which includes the expertise of Fluid Attacks' hacking team, fill out this contact form.