Initial Public Draft (IPD), Special Publication 800-53 ...

Draft NIST Special Publication 800-53

Revision 5

Security and Privacy Controls for Information Systems and Organizations

This publication contains a comprehensive catalog of technical and nontechnical security and privacy controls. The controls can support a variety of specialty applications including the Risk Management Framework, Cybersecurity Framework, and Systems Engineering Processes used for developing systems, products, components, and services and for protecting organizations, systems, and individuals.

JOINT TASK FORCE

INITIAL PUBLIC DRAFT

Draft NIST Special Publication 800-53

Revision 5

Security and Privacy Controls for Information Systems and Organizations

August 2017

U.S. Department of Commerce

Wilbur L. Ross, Jr., Secretary National Institute of Standards and Technology Kent Rochford, Acting NIST Director and Under Secretary of Commerce for Standards and Technology

DRAFT NIST SP 800-53, REVISION 5

SECURITY AND PRIVACY CONTROLS FOR

INFORMATION SYSTEMS AND ORGANIZATIONS

________________________________________________________________________________________________

Authority

This publication has been developed by NIST to further its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. ? 3551 et seq., Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A130.

Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of OMB, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST.

National Institute of Standards and Technology Special Publication 800-53, Revision 5

Natl. Inst. Stand. Technol. Spec. Publ. 800-53, Rev. 5, 494 pages (August 2017)

CODEN: NSPUE2

Certain commercial entities, equipment, or materials may be identified in this document to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose.

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts, practices, and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.

Organizations are encouraged to review draft publications during the designated public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at .

Public comment period: August 15 through September 12, 2017 National Institute of Standards and Technology

Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930 Email: sec-cert@

All comments are subject to release under the Freedom of Information Act (FOIA).

PAGE i

DRAFT NIST SP 800-53, REVISION 5

SECURITY AND PRIVACY CONTROLS FOR

INFORMATION SYSTEMS AND ORGANIZATIONS

________________________________________________________________________________________________

Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology (IT). ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security of other than national security-related information and protection of individuals' privacy in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information systems security and its collaborative activities with industry, government, and academic organizations.

Abstract

This publication provides a catalog of security and privacy controls for federal information systems and organizations to protect organizational operations and assets, individuals, other organizations, and the Nation from a diverse set of threats including hostile attacks, natural disasters, structural failures, human errors, and privacy risks. The controls are flexible and customizable and implemented as part of an organization-wide process to manage risk. The controls address diverse requirements derived from mission and business needs, laws, Executive Orders, directives, regulations, policies, standards, and guidelines. The publication describes how to develop specialized sets of controls, or overlays, tailored for specific types of missions and business functions, technologies, environments of operation, and sector-specific applications. Finally, the consolidated catalog of controls addresses security and privacy from a functionality perspective (i.e., the strength of functions and mechanisms) and an assurance perspective (i.e., the measure of confidence in the security or privacy capability). Addressing both functionality and assurance ensures that information technology products and the information systems that rely on those products are sufficiently trustworthy.

Keywords

Assurance; availability; computer security; confidentiality; FISMA; information security; integrity; personally identifiable information; Privacy Act; privacy controls; privacy functions; privacy requirements; Risk Management Framework; security controls; security functions; security requirements; system; system security.

PAGE ii

DRAFT NIST SP 800-53, REVISION 5

SECURITY AND PRIVACY CONTROLS FOR

INFORMATION SYSTEMS AND ORGANIZATIONS

________________________________________________________________________________________________

Acknowledgements

This publication was developed by the Joint Task Force Transformation Initiative Interagency Working Group with representatives from the Civil, Defense, and Intelligence Communities in an ongoing effort to produce a unified information security framework for the federal government. The National Institute of Standards and Technology wishes to acknowledge and thank the senior leaders from the Departments of Commerce and Defense, the Office of the Director of National Intelligence, the Committee on National Security Systems, and the members of the interagency technical working group whose dedicated efforts contributed significantly to the publication. The senior leaders, interagency working group members, and their organizational affiliations include:

Department of Defense John A. Zangardi Acting DoD Chief Information Officer

Thomas P. Michelli Acting Principal Deputy and DoD Chief Information Officer

Essye B. Miller Deputy Chief Information Officer for Cybersecurity and DoD Senior Information Security Officer

John R. Mills Director, Cybersecurity Policy, Strategy, and International

Office of the Director of National Intelligence Raymond Cook Assistant DNI and Chief Information Officer

Jennifer Kron Deputy Chief Information Officer

Sue Dorr Director, Information Assurance Division and Chief Information Security Officer

Wallace Coggins Director, Security Coordination Center

National Institute of Standards and Technology Charles H. Romine Director, Information Technology Laboratory

Donna Dodson Cybersecurity Advisor, Information Technology Laboratory

Matt Scholl Chief, Computer Security Division

Kevin Stine Chief, Applied Cybersecurity Division

Ron Ross FISMA Implementation Project Leader

Committee on National Security Systems Essye B. Miller Chair

Cheryl Peace Co-Chair

Kevin Dulany Tri-Chair--Defense Community

Peter H. Duspiva Tri-Chair--Intelligence Community

Daniel Dister Tri-Chair--Civil Agencies

Joint Task Force Transformation Initiative Interagency Working Group

Ron Ross NIST, JTF Leader

Jody Jacobs NIST

Ellen Nadeau NIST

David Black The MITRE Corporation

Kevin Dulany Department of Defense

Victoria Pillitteri NIST

Charles Cutshall OMB

Rich Graubart The MITRE Corporation

Dorian Pappas Intelligence Community

Taylor Roberts OMB

Esten Porter The MITRE Corporation

Daniel Faigin Aerospace Corporation

Kelley Dempsey NIST

Naomi Lefkovitz NIST

Ned Goren NIST

Christian Enloe NIST

In addition to the above acknowledgments, a special note of thanks goes to Peggy Himes, Jim Foti, and Elizabeth Lennon of NIST for their superb technical editing and administrative support. The authors also wish to recognize Kristen Baldwin, Carol Bales, John Bazile, Jon Boyens, Sean Brooks, Ruth Cannatti, Kathleen Coupe, Keesha Crosby, Dominic Cussatt, Ja'Nelle DeVore, Jennifer Fabius, Jim Fenton, Matthew Halstead, Hildy Ferraiolo, Ryan Galluzzo, Robin Gandhi, Mike Garcia, Paul Grassi, Marc Groman, Matthew Halstead, Kevin Herms, Scott Hill, Ralph

PAGE iii

DRAFT NIST SP 800-53, REVISION 5

SECURITY AND PRIVACY CONTROLS FOR

INFORMATION SYSTEMS AND ORGANIZATIONS

________________________________________________________________________________________________

Jones, Martin Kihiko, Raquel Leone, Michael McEvilley, Kirsten Moncada, Elaine Newton, Michael Nieles, Michael Nussdorfer, Celia Paulsen, Andrew Regenscheid, Joe Stuntz, members of the Federal Privacy Council's Risk Management Subcommittee, and the technical staff from the NIST Computer Security Division and Applied Cybersecurity Division for their exceptional contributions in helping to improve the content of the publication. And finally, the authors also gratefully acknowledge the significant contributions from individuals and organizations in the public and private sectors, both nationally and internationally, whose insightful and constructive comments improved the overall quality, thoroughness, and usefulness of this publication.

Historical Contributions to NIST Special Publication 800-53

The authors wanted to acknowledge the many individuals who contributed to previous versions of Special Publication 800-53 since its inception in 2005. They include Marshall Abrams, Dennis Bailey, Lee Badger, Curt Barker, Matt Barrett, Nadya Bartol, Frank Belz, Paul Bicknell, Deb Bodeau, Paul Brusil, Brett Burley, Bill Burr, Dawn Cappelli, Roger Caslow, Corinne Castanza, Mike Cooper, Matt Coose, Dom Cussatt, George Dinolt, Randy Easter, Kurt Eleam, Denise Farrar, Dave Ferraiolo, Cita Furlani, Harriett Goldman, Peter Gouldmann, Tim Grance, Jennifer Guild, Gary Guissanie, Sarbari Gupta, Priscilla Guthrie, Richard Hale, Bennett Hodge, William Hunteman, Cynthia Irvine, Arnold Johnson, Roger Johnson, Don Jones, Lisa Kaiser, Stu Katke, Sharon Keller, Tom Kellerman, Cass Kelly, Eustace King, Steve LaFountain, Annabelle Lee, Robert Lentz, Steve Lipner, Bill MacGregor, Tom Macklin, Tom Madden, Robert Martin, Erika McCallister, Tim McChesney, Michael McEvilley, Rosalie McQuaid, Peter Mell, John Mildner, Pam Miller, Sandra Miravalle, Joji Montelibano, Doug Montgomery, George Moore, Mark Morrison, Sherrill Nicely, Robert Niemeyer, LouAnna Notargiacomo, Pat O'Reilly, Tim Polk, Karen Quigg, Steve Quinn, Mark Riddle, Ed Roback, Cheryl Roby, George Rogers, Scott Rose, Mike Rubin, Karen Scarfone, Roger Schell, Jackie Snouffer, Ray Snouffer, Murugiah Souppaya, Gary Stoneburner, Keith Stouffer, Marianne Swanson, Pat Toth, Glenda Turner, Pat Viscuso, Joe Weiss, Richard Wilsher, Mark Wilson, John Woodward, and Carol Woody.

PAGE iv

DRAFT NIST SP 800-53, REVISION 5

SECURITY AND PRIVACY CONTROLS FOR

INFORMATION SYSTEMS AND ORGANIZATIONS

________________________________________________________________________________________________

Notes to Reviewers

As we push computers to "the edge" building an increasingly complex world of interconnected information systems and devices, security and privacy continue to dominate the national dialog. The Defense Science Board in its 2017 report, Task Force on Cyber Defense, provides a sobering assessment of the current vulnerabilities in the U.S. critical infrastructure and the information systems that support the mission essential operations and assets in the public and private sectors.

"...The Task Force notes that the cyber threat to U.S. critical infrastructure is outpacing efforts to reduce pervasive vulnerabilities, so that for the next decade at least the United States must lean significantly on deterrence to address the cyber threat posed by the most capable U.S. adversaries. It is clear that a more proactive and systematic approach to U.S. cyber deterrence is urgently needed..."

There is an urgent need to further strengthen the underlying information systems, component products, and services that we depend on in every sector of the critical infrastructure--ensuring those systems, components, and services are sufficiently trustworthy and provide the necessary resilience to support the economic and national security interests of the United States. This update to NIST Special Publication 800-53 (Revision 5) responds to the call by the Defense Science Board by embarking on a proactive and systemic approach to develop and make available to a broad base of public and private sector organizations, a comprehensive set of safeguarding measures for all types of computing platforms, including general purpose computing systems, cyber-physical systems, cloud and mobile systems, industrial/process control systems, and Internet of Things (IoT) devices. Those safeguarding measures include security and privacy controls to protect the critical and essential operations and assets of organizations and the personal privacy of individuals. The ultimate objective is to make the information systems we depend on more penetration resistant to attacks; limit the damage from attacks when they occur; and make the systems resilient and survivable.

Revision 5 of this foundational NIST publication represents a one-year effort to develop the next generation security and privacy controls that will be needed to accomplish the above objectives. It includes changes to make the controls more consumable by diverse consumer groups including, for example, enterprises conducting mission and business operations; engineering organizations developing information systems and systems-of-systems; and industry partners building system components, products, and services. The major changes to the publication include:

? Making the security and privacy controls more outcome-based by changing the structure of the controls;

? Fully integrating the privacy controls into the security control catalog creating a consolidated and unified set of controls for information systems and organizations, while providing summary and mapping tables for privacy-related controls;

? Separating the control selection process from the actual controls, thus allowing the controls to be used by different communities of interest including systems engineers, software developers, enterprise architects; and mission/business owners;

? Promoting integration with different risk management and cybersecurity approaches and lexicons, including the Cybersecurity Framework;

? Clarifying the relationship between security and privacy to improve the selection of controls necessary to address the full scope of security and privacy risks; and

PAGE v

DRAFT NIST SP 800-53, REVISION 5

SECURITY AND PRIVACY CONTROLS FOR

INFORMATION SYSTEMS AND ORGANIZATIONS

________________________________________________________________________________________________

? Incorporating new, state-of-the-practice controls based on threat intelligence and empirical attack data, including controls to strengthen cybersecurity and privacy governance and accountability.

In separating the process of control selection from the security and privacy controls, a significant amount of tailoring guidance and other informative material previously contained in Special Publication 800-53 was eliminated from the publication. That content will be moved to other publications such as NIST Special Publication 800-37 (Risk Management Framework) during the next update cycle for that document. The context will also remain active in Special Publication 800-53 Revision 4, until the subsequent publication becomes final. NIST continues to work with the privacy community to better integrate privacy and security controls, and is particularly interested in how best to achieve such integration in this publication.

Your feedback on this draft publication is important to us. We appreciate each contribution from our reviewers. The very insightful comments from both the public and private sectors, nationally and internationally, continue to help shape the final publication to ensure that it meets the needs and expectations of our customers. NIST anticipates producing the final draft of this publication in October 2017 and publishing the final version not later than December 29, 2017.

- RON ROSS

NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY

PAGE vi

 ................
................

In order to avoid copyright disputes, this page is only a partial summary.

Google Online Preview   Download