National Institute of Standards and Technology (NIST) 800-53 Revision 4

nist_800_53_revision_4_aws

NIST-800-53-Revision-4

OfficialVerified

NIST 800-53 is a regulatory standard that defines the minimum baseline of security controls for all U.S. federal information systems except those related to national security. The controls defined in this standard are customizable and address a diverse set of security and privacy requirements.

64requirements81checks

Prowler prowler-provider-aws

Run this compliance with Prowler

Run in Prowler Cloud

Run

prowler aws --compliance nist_800_53_revision_4_aws

Requirements (64)

Access Control (AC)14116

ac_2_1Access control policies (e.g., identity or role-based policies, control matrices, and cryptography) control access between active entities or subjects (i.e., users or processes acting on behalf of users) and passive entities or objects (e.g., devices, files, records, and domains) in systems. Access enforcement mechanisms can be employed at the application and service level to provide increased information security. Other systems include systems internal and external to the organization. This requirement focuses on account management for systems and applications. The definition of and enforcement of access authorizations, other than those determined by account type (e.g., privileged verses non-privileged) are addressed in requirement 3.1.2.9

Attributes

Item Id: ac_2_1
Section: Access Control (AC)
Service: aws
Sub Section: Account Management (AC-2)

ac_2_3The information system automatically disables inactive accounts after 90 days for user accounts.5

Attributes

Item Id: ac_2_3
Section: Access Control (AC)
Service: aws
Sub Section: Account Management (AC-2)

ac_2_4The information system automatically audits account creation, modification, enabling, disabling, and removal actions, and notifies [Assignment: organization-defined personnel or roles].10

Attributes

Item Id: ac_2_4
Section: Access Control (AC)
Service: aws
Sub Section: Account Management (AC-2)

ac_2_12Monitors and reports atypical usage of information system accounts to organization-defined personnel or roles.2

Attributes

Item Id: ac_2_12
Section: Access Control (AC)
Service: aws
Sub Section: Account Management (AC-2)

ac_2Manage system accounts, group memberships, privileges, workflow, notifications, deactivations, and authorizations.21

Attributes

Item Id: ac_2
Section: Access Control (AC)
Service: aws

ac_3The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies.13

Attributes

Item Id: ac_3
Section: Access Control (AC)
Service: aws

ac_4The information system enforces approved authorizations for controlling the flow of information within the system and between interconnected systems based on organization-defined information flow control policies.15

Attributes

Item Id: ac_4
Section: Access Control (AC)
Service: aws

ac_5Separate duties of individuals to prevent malevolent activity. automate separation of duties and access authorizations.3

Attributes

Item Id: ac_5
Section: Access Control (AC)
Service: aws

ac_6_10The information system prevents non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.1

Attributes

Item Id: ac_6_10
Section: Access Control (AC)
Service: iam
Sub Section: Least Privilege (AC-6)

ac_6The organization employs the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions.22

Attributes

Item Id: ac_6
Section: Access Control (AC)
Service: aws

ac_17_1The information system monitors and controls remote access methods.2

Attributes

Item Id: ac_17_1
Section: Access Control (AC)
Service: aws

ac_17_2The information system implements cryptographic mechanisms to protect the confidentiality and integrity of remote access sessions.3

Attributes

Item Id: ac_17_2
Section: Access Control (AC)
Service: aws

ac_17_3The information system routes all remote accesses through organization-defined managed network access control points.0

Attributes

Item Id: ac_17_3
Section: Access Control (AC)
Service: vpc

ac_21Facilitate information sharing. Enable authorized users to grant access to partners.10

Attributes

Item Id: ac_21
Section: Access Control (AC)
Service: aws

Audit and Accountability (AU)955

au_2Automate security audit function with other organizational entities. Enable mutual support of audit of auditable events.11

Attributes

Item Id: au_2
Section: Audit and Accountability (AU)
Service: aws

au_3The information system generates audit records containing information that establishes what type of event occurred, when the event occurred, where the event occurred, the source of the event, the outcome of the event, and the identity of any individuals or subjects associated with the event.11

Attributes

Item Id: au_3
Section: Audit and Accountability (AU)
Service: aws

au_6_1The organization employs automated mechanisms to integrate audit review, analysis,and reporting processes to support organizational processes for investigation and response to suspicious activities.7

Attributes

Item Id: au_6_1
Section: Audit and Accountability (AU)
Service: aws
Sub Section: Audit Review, Analysis And Reporting (AU-6)

au_6_3The organization analyzes and correlates audit records across different repositories to gain organization-wide situational awareness.7

Attributes

Item Id: au_6_3
Section: Audit and Accountability (AU)
Service: aws
Sub Section: Audit Review, Analysis And Reporting (AU-6)

au_7_1The information system provides the capability to process audit records for events of interest based on [Assignment: organization-defined audit fields within audit records].5

Attributes

Item Id: au_7_1
Section: Audit and Accountability (AU)
Service: aws

au_9_2The information system backs up audit records [Assignment: organization-defined frequency] onto a physically different system or system component than the system or component being audited.0

Attributes

Item Id: au_9_2
Section: Audit and Accountability (AU)
Service: s3
Sub Section: Protection of Audit Information (AU-9)

au_9The information system protects audit information and audit tools from unauthorized access, modification, and deletion.2

Attributes

Item Id: au_9
Section: Audit and Accountability (AU)
Service: aws

au_11The organization retains audit records for [Assignment: organization-defined time period consistent with records retention policy] to provide support for after-the-fact investigations of security incidents and to meet regulatory and organizational information retention requirements.1

Attributes

Item Id: au_11
Section: Audit and Accountability (AU)
Service: cloudwatch

au_12Audit events defined in AU-2. Allow trusted personnel to select which events to audit. Generate audit records for events.11

Attributes

Item Id: au_12
Section: Audit and Accountability (AU)
Service: aws

Security Assessment And Authorization (CA)19

ca_7Continuously monitor configuration management processes. Determine security impact, environment and operational risks.9

Attributes

Item Id: ca_7
Section: Security Assessment And Authorization (CA)
Service: aws

Configuration Management (CM)411

cm_2The organization develops, documents, and maintains under configuration control, a current baseline configuration of the information system.6

Attributes

Item Id: cm_2
Section: Configuration Management (CM)
Service: aws

cm_7The organization configures the information system to provide only essential capabilities and prohibits or restricts the use of the functions, ports, protocols, and/or services.2

Attributes

Item Id: cm_7
Section: Configuration Management (CM)
Service: aws

cm_8_1The organization develops and documents an inventory of information system components that accurately reflects the current information system, includes all components within the authorization boundary of the information system, is at the level of granularity deemed necessary for tracking and reporting and reviews and updates the information system component inventory.1

Attributes

Item Id: cm_8_1
Section: Configuration Management (CM)
Service: ec2
Sub Section: Information System Component Inventory (CM-8)

cm_8_3The organization employs automated mechanisms to detect the presence of unauthorized hardware, software, and firmware components within the information system and takes actions (disables network access by such components, isolates the components etc) when unauthorized components are detected.2

Attributes

Item Id: cm_8_3
Section: Configuration Management (CM)
Service: aws
Sub Section: Information System Component Inventory (CM-8)

Contingency Planning (CP)29

cp_9The organization conducts backups of user-level information, system-level information and information system documentation including security-related documentation contained in the information system and protects the confidentiality, integrity, and availability of backup information at storage locations.3

Attributes

Item Id: cp_9
Section: Contingency Planning (CP)
Service: aws

cp_10The organization provides for the recovery and reconstitution of the information system to a known state after a disruption, compromise, or failure.6

Attributes

Item Id: cp_10
Section: Contingency Planning (CP)
Service: aws

Identification and Authentication (IA)710

ia_2_1The information system implements multi-factor authentication for network access to privileged accounts.3

Attributes

Item Id: ia_2_1
Section: Identification and Authentication (IA)
Service: iam
Sub Section: Identification and Authentication (Organizational users) (IA-2)

ia_2_2The information system implements multifactor authentication for network access to non-privileged accounts.1

Attributes

Item Id: ia_2_2
Section: Identification and Authentication (IA)
Service: iam
Sub Section: Identification and Authentication (Organizational users) (IA-2)

ia_2_11The information system implements multifactor authentication for remote access to privileged and non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access and the device meets [Assignment: organization-defined strength of mechanism requirements].3

Attributes

Item Id: ia_2_11
Section: Identification and Authentication (IA)
Service: iam
Sub Section: Identification and Authentication (Organizational users) (IA-2)

ia_2The information system uniquely identifies and authenticates organizational users (or processes acting on behalf of organizational users).1

Attributes

Item Id: ia_2
Section: Identification and Authentication (IA)
Service: aws

ia_5_1The information system, for password-based authentication that enforces minimum password complexity, stores and transmits only cryptographically-protected passwords, enforces password minimum and maximum lifetime restrictions, prohibits password reuse, allows the use of a temporary password for system logons with an immediate change to a permanent password etc.1

Attributes

Item Id: ia_5_1
Section: Identification and Authentication (IA)
Service: iam
Sub Section: Authenticator Management (IA-5)

ia_5_4The organization employs automated tools to determine if password authenticators are sufficiently strong to satisfy [Assignment: organization-defined requirements].1

Attributes

Item Id: ia_5_4
Section: Identification and Authentication (IA)
Service: iam
Sub Section: Authenticator Management (IA-5)

ia_5_7The organization ensures that unencrypted static authenticators are not embedded in applications or access scripts or stored on function keys.0

Attributes

Item Id: ia_5_7
Section: Identification and Authentication (IA)
Service: codebuild
Sub Section: Authenticator Management (IA-5)

Incident Response (IR)37

ir_4_1The organization employs automated mechanisms to support the incident handling process.5

Attributes

Item Id: ir_4_1
Section: Incident Response (IR)
Service: aws
Sub Section: Incident Handling (IR-4)

ir_6_1The organization employs automated mechanisms to assist in the reporting of security incidents.1

Attributes

Item Id: ir_6_1
Section: Incident Response (IR)
Service: guardduty
Sub Section: Incident Reporting (IR-6)

ir_7_1The organization employs automated mechanisms to increase the availability of incident response-related information and support.1

Attributes

Item Id: ir_7_1
Section: Incident Response (IR)
Service: guardduty
Sub Section: Incident Response Assistance (IR-7)

Risk Assessment (RA)12

ra_5Scan for system vulnerabilities. Share vulnerability information and security controls that eliminate vulnerabilities.2

Attributes

Item Id: ra_5
Section: Risk Assessment (RA)
Service: guardduty

System and Services Acquisition (SA)25

sa_3The organization manages the information system using organization-defined system development life cycle, defines and documents information security roles and responsibilities throughout the system development life cycle, identifies individuals having information security roles and responsibilities and integrates the organizational information security risk management process into system development life cycle activities.1

Attributes

Item Id: sa_3
Section: System and Services Acquisition (SA)
Service: aws

sa_10The organization requires the developer of the information system, system component, or information system service to: a. Perform configuration management during system, component, or service [Selection (one or more): design; development; implementation; operation]; b. Document, manage, and control the integrity of changes to [Assignment: organization-defined configuration items under configuration management]; c. Implement only organization-approved changes to the system, component, or service; d. Document approved changes to the system, component, or service and the potential security impacts of such changes; and e. Track security flaws and flaw resolution within the system, component, or service and report findings to [Assignment: organization-defined personnel].4

Attributes

Item Id: sa_10
Section: System and Services Acquisition (SA)
Service: aws

System and Communications Protection (SC)1159

sc_2The information system separates user functionality (including user interface services) from information system management functionality.3

Attributes

Item Id: sc_2
Section: System and Communications Protection (SC)
Service: iam

sc_4The information system prevents unauthorized and unintended information transfer via shared system resources.0

Attributes

Item Id: sc_4
Section: System and Communications Protection (SC)
Service: ebs

sc_5The information system protects against or limits the effects of the following types of denial of service attacks: [Assignment: organization-defined types of denial of service attacks or references to sources for such information] by employing [Assignment: organization-defined security safeguards].2

Attributes

Item Id: sc_5
Section: System and Communications Protection (SC)
Service: aws

sc_7_3The organization limits the number of external network connections to the information system.15

Attributes

Item Id: sc_7_3
Section: System and Communications Protection (SC)
Service: aws
Sub Section: Boundary Protection (SC-7)

sc_7The information system: a. Monitors and controls communications at the external boundary of the system and at key internal boundaries within the system; b. Implements subnetworks for publicly accessible system components that are [Selection: physically; logically] separated from internal organizational networks; and c. Connects to external networks or information systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security architecture.19

Attributes

Item Id: sc_7
Section: System and Communications Protection (SC)
Service: aws

sc_8_1The information system implements cryptographic mechanisms to [Selection (one or more): prevent unauthorized disclosure of information; detect changes to information] during transmission unless otherwise protected by [Assignment: organization-defined alternative physical safeguards].3

Attributes

Item Id: sc_8_1
Section: System and Communications Protection (SC)
Service: aws
Sub Section: Transmission Confidentiality And Integrity (SC-8)

sc_8The information system protects the [Selection (one or more): confidentiality; integrity] of transmitted information.3

Attributes

Item Id: sc_8
Section: System and Communications Protection (SC)
Service: aws

sc_12The organization establishes and manages cryptographic keys for required cryptography employed within the information system in accordance with [Assignment: organization-defined requirements for key generation, distribution, storage, access, and destruction].2

Attributes

Item Id: sc_12
Section: System and Communications Protection (SC)
Service: aws

sc_13The information system implements [Assignment: organization-defined cryptographic uses and type of cryptography required for each use] in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.1

Attributes

Item Id: sc_13
Section: System and Communications Protection (SC)
Service: dynamodb

sc_23The information system protects the authenticity of communications sessions.0

Attributes

Item Id: sc_23
Section: System and Communications Protection (SC)
Service: elb

sc_28The information system protects the [Selection (one or more): confidentiality; integrity] of [Assignment: organization-defined information at rest].11

Attributes

Item Id: sc_28
Section: System and Communications Protection (SC)
Service: aws

System and Information Integrity (SI)1046

si_2_2The organization employs automated mechanisms to determine the state of information system components with regard to flaw remediation.2

Attributes

Item Id: si_2_2
Section: System and Information Integrity (SI)
Service: aws
Sub Section: Flaw Remediation (SI-2)

si_4_1The organization connects and configures individual intrusion detection tools into an information system-wide intrusion detection system.1

Attributes

Item Id: si_4_1
Section: System and Information Integrity (SI)
Service: guardduty
Sub Section: Information System Monitoring (SI-4)

si_4_2The organization employs automated tools to support near real-time analysis of events.8

Attributes

Item Id: si_4_2
Section: System and Information Integrity (SI)
Service: aws
Sub Section: Information System Monitoring (SI-4)

si_4_4The information system monitors inbound and outbound communications traffic continuously for unusual or unauthorized activities or conditions.7

Attributes

Item Id: si_4_4
Section: System and Information Integrity (SI)
Service: aws
Sub Section: Information System Monitoring (SI-4)

si_4_5The information system alerts organization-defined personnel or roles when the following indications of compromise or potential compromise occur: [Assignment: organization-defined compromise indicators].7

Attributes

Item Id: si_4_5
Section: System and Information Integrity (SI)
Service: aws
Sub Section: Information System Monitoring (SI-4)

si_4_16The organization correlates information from monitoring tools employed throughout the information system.2

Attributes

Item Id: si_4_16
Section: System and Information Integrity (SI)
Service: aws
Sub Section: Information System Monitoring (SI-4)

si_4The organization: a.Monitors the information system to detect: 1. Attacks and indicators of potential attacks in accordance with [Assignment: organization-defined monitoring objectives]; and 2.Unauthorized local, network, and remote connections; b. Identifies unauthorized use of the information system through [Assignment: organization-defined techniques and methods]; c. Deploys monitoring devices: 1. Strategically within the information system to collect organization-determined essential information; and 2. At ad hoc locations within the system to track specific types of transactions of interest to the organization; d. Protects information obtained from intrusion-monitoring tools from unauthorized access, modification, and deletion; e. Heightens the level of information system monitoring activity whenever there is an indication of increased risk to organizational operations and assets, individuals, other organizations, or the Nation based on law enforcement information, intelligence information, or other credible sources of information; f. Obtains legal opinion with regard to information system monitoring activities in accordance with applicable federal laws, Executive Orders, directives, policies, or regulations; and g. Provides [Assignment: organization-defined information system monitoring information] to [Assignment: organization-defined personnel or roles] [Selection (one or more): as needed; [Assignment: organization-defined frequency]].10

Attributes

Item Id: si_4
Section: System and Information Integrity (SI)
Service: aws

si_7_1The information system performs an integrity check of security relevant events at least monthly.3

Attributes

Item Id: si_7_1
Section: System and Information Integrity (SI)
Service: aws
Sub Section: Software, Firmware, and Information Integrity (SI-7)

si_7The organization employs integrity verification tools to detect unauthorized changes to [Assignment: organization-defined software, firmware, and information].1

Attributes

Item Id: si_7
Section: System and Information Integrity (SI)
Service: aws

si_12The organization handles and retains information within the information system and information output from the system in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements.5

Attributes

Item Id: si_12
Section: System and Information Integrity (SI)
Service: aws