NIST Publications & Governing Security Requirements
Positions & Assigned Manuals
| Manual / Publication | Brief Description |
|---|---|
| NIST SP 800-53 Rev 5 | Security and privacy control catalog used for day-to-day control execution, technical enforcement, and evidence compilation. |
| NIST SP 800-128 (Upd 1) | Security-focused configuration management, establishing system build baselines and tracking change control tickets. |
| NIST SP 800-137 | Information Security Continuous Monitoring (ISCM) for automated vulnerability scanning, log audits, and ongoing posture reports. |
| NIST SP 800-70 Rev 5 | National Checklist Program for implementing DISA STIGs and CIS security configuration benchmarks across system components. |
| NIST SP 800-40 Rev 4 | Enterprise patch management planning and tracking timely flaw remediation for identified Common Vulnerabilities and Exposures (CVEs). |
| DISA STIGs & SRGs | DoD-mandated configuration checklists and automated benchmarks applied to operating systems, databases, network devices, and software. |
| Manual / Publication | Brief Description |
|---|---|
| NIST SP 800-37 Rev 2 | Directs organizational execution of the 7-step Risk Management Framework and manages the complete lifecycle authorization package. |
| NIST SP 800-53B | Control baseline selection (Low, Moderate, High) and security control tailoring specifications for organizational systems. |
| NIST SP 800-18 Rev 2 | Master standard for developing, maintaining, and updating the comprehensive System Security Plan (SSP). |
| NIST SP 800-30 Rev 1 | Conducting organizational risk assessments to determine threat likelihood, adverse impact, and residual risk for ATO submissions. |
| NIST SP 800-39 | Enterprise-level multi-tier risk framing aligning organizational governance with mission and system operations. |
| DCSA DAAG | Primary authorization guide for cleared defense contractor systems under NISP, coordinating eMASS packages and oversight. |
| Manual / Publication | Brief Description |
|---|---|
| 32 CFR Part 117 (NISPOM Rule) | Codified federal regulation governing industrial security, classified defense contracts, personnel clearances, and facility safeguards. |
| SEAD 3 | Mandatory reporting requirements for personnel holding access to classified information or sensitive designations. |
| SEAD 4 | Uniform national security adjudicative guidelines establishing eligibility criteria for security clearances. |
| DCSA Industrial Security Guidance | Facility Security Clearance (FCL) management, physical security, cleared visitor handling, and DCSA annual audit readiness. |
| Manual / Publication | Brief Description |
|---|---|
| ICD 705 | Intelligence Community directive establishing physical, technical, acoustic, and visual security standards for SCIFs. |
| ICS 705-1 & ICS 705-2 | Physical security specifications and standards for reciprocal acceptance of accredited SCIF spaces across government agencies. |
| IC Tech Spec for ICD/ICS 705 | Technical specifications for SCIF construction: acoustic attenuation (STC 45/50), TEMPEST shielding, duct baffles, and lock hardware. |
| ICD 503 | Information Technology Systems Security Risk Management across the Intelligence Community for networks operating within SCIF boundaries. |
| ICD 704 | Personnel security standards and eligibility criteria for access to Sensitive Compartmented Information (SCI). |
| Manual / Publication | Brief Description |
|---|---|
| NIST SP 800-37 Rev 2 | Governs Step 5 (Authorize) decision criteria, residual risk evaluation, terms of authorization, and ongoing risk acceptance. |
| OMB Circular A-130 | Federal executive requirement that senior officials accept explicit responsibility for system operating risk. |
| DoD Instruction 8510.01 | Directs DoD Authorizing Official determinations, eMASS package concurrence, Continuous ATO (cATO), and security reciprocity. |
| ICD 503 | Establishes mutual acceptance and reciprocity rules for authorization decisions across Intelligence Community elements. |
| Manual / Publication | Brief Description |
|---|---|
| NIST SP 800-53A Rev 5 | Comprehensive assessment procedures, examination methods, interview questions, and test cases producing the SAR. |
| NIST SP 800-115 | Technical guide for security testing, penetration testing execution (Section 5.2), and formal Rules of Engagement (Appendix B). |
| NIST SP 800-30 Rev 1 | Scoring vulnerability severity, evaluating exploitability against system defenses, and determining residual risk ratings. |
Risk Management Framework (RMF)
STEP 00
PREPARE
SP 800-37 / 39
STEP 01
CATEGORIZE
FIPS 199 / 800-60
STEP 02
SELECT
SP 800-53 / 53B
STEP 03
IMPLEMENT
SP 800-18 / 128
STEP 04
ASSESS
SP 800-53A / 115
STEP 05
AUTHORIZE
OMB A-130 / DAAG
STEP 06
MONITOR
SP 800-137 / 137A
| Publication & Official Link | Brief Description | Phase | Scope |
|---|---|---|---|
| NIST SP 800-37 Rev 2 | Risk Management Framework for Information Systems and Organizations. Foundational standard establishing the 7-step system lifecycle process integrating security and privacy risk management into SDLC. | Lifecycle | Foundation |
| NIST SP 800-39 | Managing Information Security Risk. Multi-tier risk framing structure (Tier 1 Organization, Tier 2 Mission, Tier 3 Information System) aligning operational risk tolerance with executive oversight. | Step 0 | Enterprise Risk |
| NIST SP 800-160 (Vol 1 & 2) | Engineering Trustworthy & Cyber-Resilient Systems. Systems security engineering principles (ISO/IEC/IEEE 15288) and resiliency techniques to anticipate, withstand, recover, and adapt to attacks. | Step 0 & 3 | Engineering |
| FIPS PUB 199 | Standards for Security Categorization of Federal Information Systems. Mandatory standard defining potential impact levels (Low, Moderate, High) across Confidentiality, Integrity, and Availability. | Step 1 | Federal Standard |
| NIST SP 800-60 (Vol 1 & 2) | Guide for Mapping Information Types to Security Categories. Management guidelines (Vol 1) and extensive catalog (Vol 2) mapping federal information types to provisional impact ratings. | Step 1 | Categorization |
| CNSSI 1253 | Security Categorization & Control Selection for National Security Systems. Categorization methods and control overlays for National Security Systems (NSS) processing classified data. | Step 1 & 2 | CNSS |
| FIPS PUB 200 | Minimum Security Requirements for Federal Information Systems. Mandatory baseline safeguards across 17 control families that agencies must satisfy based on FIPS 199 impact levels. | Step 2 | Federal Standard |
| NIST SP 800-53 Rev 5 | Security and Privacy Controls for Information Systems. Master catalog of 20 control families defining technical, operational, and management controls and enhancements. | Step 2 | Controls |
| NIST SP 800-53B | Control Baselines for Information Systems. Predefined Low, Moderate, and High security baselines, federal privacy baseline, and control tailoring guidance. | Step 2 | Baselines |
| NIST SP 800-18 Rev 2 | Developing Security, Privacy, and SCRM Plans. Master standard for authoring the System Security Plan (SSP), defining authorization boundaries and control implementations. | Step 3 | SSP |
| NIST SP 800-128 (Upd 1) | Guide for Security-Focused Configuration Management. Methodology for developing secure configuration baselines, managing CCBs, and performing configuration audits. | Step 3 | Configuration |
| NIST SP 800-70 Rev 5 | National Checklist Program for IT Products. Guidance for adopting standardized checklists, CIS benchmarks, and DISA STIGs to enforce hardened configurations. | Step 3 | Checklists |
| NIST SP 800-53A Rev 5 | Assessing Security and Privacy Controls in Information Systems. Procedural guide detailing examination methods and test cases to build the SAP and author the SAR. | Step 4 | Assessment |
| NIST SP 800-115 | Technical Guide to Information Security Testing and Assessment. Principal NIST standard for technical vulnerability discovery, penetration testing (Section 5.2), and RoE. | Step 4 | Pen Testing |
| NIST SP 800-30 Rev 1 | Guide for Conducting Risk Assessments. Process for identifying threats, calculating likelihood and impact, and determining residual risk for ATO acceptability. | Step 4 | Risk Assessment |
| OMB Circular A-130 | Managing Information as a Strategic Resource. Mandatory federal executive policy governing agency information management, RMF authorization, and continuous monitoring. | Step 5 | Executive Policy |
| DoD Instruction 8510.01 | Risk Management Framework (RMF) for DoD Systems. Directs DoD RMF implementation, eMASS authorization packages, Continuous ATO (cATO), and reciprocity. | Step 5 | DoD Policy |
| DCSA DAAG | DCSA Assessment and Authorization Guide. Primary authorization guide for cleared defense contractor systems under NISP, replacing DAAPM effective Oct 1, 2025. | Step 5 | DCSA Directive |
| ICD 503 | IC IT Systems Security Risk Management. Governs RMF execution, Authorizing Official risk determinations, and cross-community reciprocity for SCI systems. | Step 5 | ODNI Directive |
| NIST SP 800-137 | Information Security Continuous Monitoring (ISCM). Architecture, metric gathering, scanning intervals, and risk reporting to maintain continuous authorization. | Step 6 | Continuous Mon. |
| NIST SP 800-137A | Assessing ISCM Programs. Assessment methodology and maturity evaluation criteria to evaluate the effectiveness of continuous monitoring operations. | Step 6 | Program Audit |
| NIST SP 800-161 Rev 1 (Upd 1) | Cybersecurity Supply Chain Risk Management (C-SCRM). Identifies, assesses, and mitigates risks across vendors, software dependencies, and hardware components. | Step 0 & 3 | Supply Chain |
Testing & Secure Configuration
| Publication & Link | Purpose and Practical Use | Domain |
|---|---|---|
| NIST SP 800-115 | Technical Guide to Information Security Testing and Assessment. Core standard for penetration testing execution (Section 5.2) and Rules of Engagement (Appendix B). | Penetration Testing |
| NIST SP 800-128 (Upd 1) | Security-Focused Configuration Management. Establishes secure configuration baselines, change control boards, authorization workflows, and automated monitoring. | Configuration |
| NIST SP 800-40 Rev 4 | Guide to Enterprise Patch Management Planning. Supports a repeatable architecture for identifying, prioritizing, testing, and deploying security patches. | Patching |
| NIST SP 800-70 Rev 5 | National Checklist Program for IT Products. Operational guidance for using standardized configuration checklists (e.g. STIGs, CIS benchmarks). | Checklists |
| NIST SP 800-126 Rev 4 | Technical Specification for SCAP Version 1.4. Defines automated vulnerability scanning and compliance checking protocols using validated tooling. | SCAP |
| NIST SP 800-123 | Guide to General Server Security. Foundational server operating system hardening reference; pair with current vendor guidance and DISA STIGs. | Hardening |
| NIST SP 800-41 Rev 1 | Guidelines on Firewalls and Firewall Policy. Packet filter and stateful inspection firewall design, policy ruleset architecture, and review. | Firewalls |
| NIST SP 800-92 | Guide to Computer Security Log Management. Log collection, cryptographic integrity, retention, and centralized SIEM analysis. | Logging |
Operational Security & Specialist References
| Publication & Link | Purpose and Practical Use | Domain |
|---|---|---|
| NIST SP 800-61 Rev 3 | Incident Response Recommendations. Integrated with modern cybersecurity risk management and the NIST Cybersecurity Framework (CSF 2.0). | Incident Response |
| NIST SP 800-34 Rev 1 | Contingency Planning Guide for Federal Information Systems. Recovery point/time objectives, business impact analyses, and alternate site strategies. | Contingency / DR |
| NIST SP 800-84 | Guide to Test, Training, and Exercise Programs. Structured guidance for authoring and conducting TTXs (tabletop exercises) and functional exercises. | Exercises / TTX |
| NIST SP 800-86 | Integrating Forensic Techniques into Incident Response. Evidence preservation, chain of custody, memory analysis, and disk acquisition. | Forensics |
| NIST SP 800-88 Rev 2 | Guidelines for Media Sanitization. Clear, Purge, and Destroy methods for magnetic and solid-state storage. Classified media also requires NSA/CSS standards. | Sanitization |
| NIST SP 800-63-4 (Parts A, B, C) | Digital Identity Guidelines. Enrollment and identity proofing (63A), authentication and lifecycle management (63B), and federation / assertions (63C). | Identity & MFA |
| NIST SP 800-57 Part 1 Rev 5 | Recommendation for Key Management. General cryptographic principles, key generation, protection mechanisms, and crypto transitions. | Cryptography |
| NIST SP 800-52 Rev 2 | TLS and IPsec VPN Guidance. Guidelines for selection, configuration, and deployment of secure TLS implementations (800-52) and IPsec VPN tunnels (800-77). | Encrypted Comms |
| NIST SP 800-207 | Zero Trust Architecture (ZTA). Foundational tenets, policy engines, and Policy Decision Point / Policy Enforcement Point (PDP/PEP) enterprise models. | Zero Trust |
| NIST SP 800-171 Rev 3 | Protecting Controlled Unclassified Information (CUI). Safeguards and assessment procedures for nonfederal systems (DFARS 252.204-7012 / CMMC). | CUI Nonfederal |
SCIF & Classified System Authorities
| Directive / Mandate & Link | Purpose and Practical Use | Issuing Authority |
|---|---|---|
| ICD 705 | Sensitive Compartmented Information Facilities (SCIFs). Establishes uniform SCIF physical, acoustic, visual, and technical security requirements. | ODNI Policy |
| ICS 705-01 & ICS 705-02 | Physical Security Standards & Standards for Reciprocal Use. Intelligence Community standards for facility construction and mutual acceptance. | IC Standards |
| IC Tech Spec for ICD/ICS 705 | Technical Specifications for Construction and Management of SCIFs. Covers acoustic attenuation (STC 45/50), TEMPEST, duct baffling, and door locks. | Technical Spec |
| ICD 503 | Intelligence Community Information Environment Risk Management. Defines RMF implementation, continuous monitoring, and reciprocity for SCI IT networks. | ODNI Directive |
| ICD 703 & ICD 704 | Classified National Intelligence Protection & Personnel Security. Establishes eligibility standards for access to SCI and Special Access Programs (SAP). | ODNI Directive |
| CNSSI 1253 | Security Categorization and Control Selection for National Security Systems. National security systems categorization and control overlays. | CNSS |
| NISPOM Rule (32 CFR Part 117) | National Industrial Security Program Operating Manual. Codified industrial security regulation governing cleared contractor facilities. Section 117.18 covers IT. | Regulation |
| DCSA DAAG | DCSA Assessment and Authorization Guide for cleared contractor systems under NISP. Replaces DAAPM effective October 1, 2025. | DCSA |
| DoD Policy & DISA Guidance | DoDI 8500.01 & DoDI 8510.01 (RMF for DoD IT). Supported by applicable STIGs and Security Requirements Guides (SRGs). | DoD / DISA |
Regulatory Note: DCSA announced that the DAAG officially replaced the DAAPM effective October 1, 2025. Ensure contractor authorization packages adhere to current DCSA instructions and NISP eMASS submission requirements.
Policy Enforcement & Audit Evidence
| Policy Area | SP 800-53 Controls | Required Audit Evidence |
|---|---|---|
| Access & Authentication | AC-1..6, IA-1..2 | Account authorization requests, quarterly user access reviews, separation of duties matrix, least-privilege role assignments, MFA enforcement logs. |
| Configuration & Patching | CM-1..6, SI-1..2 | Approved golden build baselines, CCB change request tickets, automated benchmark scan results (STIG / CIS), flaw remediation tracking records. |
| Assessment & Testing | CA-1..8, RA-1..5 | Security assessment plan, Authorizing Official test approval, signed Rules of Engagement (RoE), penetration test report, flaw verification retests. |
| Logging & Response | AU-1..9, IR-1..8 | Audit logging configuration baselines, centralized SIEM forwarding logs, incident response plan, TTX exercise records, chain of custody logs. |
| Media & Physical Security | MP-1..6, PE-1..3 | Accountable media inventory registers, cryptographic sanitization certificates (SP 800-88), visitor access logs, facility intrusion alarm records. |
| Planning & Recovery | PL-1..2, CP-1..9 | Signed System Security Plan (SSP), Disaster Recovery / Contingency Plan, immutable backup verification logs, annual failover recovery testing results. |
Authorization & SCIF Package Artifacts
| Package Domain | Governing Authorities | Required Deliverables & Audit Artifacts |
|---|---|---|
| System Authorization (eMASS / ATO) | NIST SP 800-37 Rev 2 • DoD 8510.01 • DCSA DAAG | System Security Plan (SSP), Boundary Diagrams, Security Categorization (FIPS 199 / SP 800-60), Security Assessment Plan & Report (SAP/SAR), POA&M, Continuous Monitoring Strategy, Signed Approval to Operate (ATO). |
| SCIF Facility Accreditation | ICD 705 • ICS 705-1/2 • IC Tech Spec | Construction Security Plan (CSP), Fixed Facility Checklist (FFC), TEMPEST evaluation, Acoustic test reports (STC 45/50), Site Security Manager logs, Formal SSA Accreditation Letter. |