{
  "node_id": "nist-800-190-container",
  "title": "NIST SP 800-190 (Containers)",
  "domain": "Cloud & SaaS",
  "version": "1.1.0",
  "last_updated": "2026-04-10",
  "bluf": "Compliance with NIST SP 800-190 guidance for application container security necessitates a multi-layered control framework that addresses risks across the entire lifecycle. This node enforces critical security postures, beginning with the image build process where each image_uses_trusted_base is mandatory, ensuring builds originate from approved, signed sources. A comprehensive vulnerability assessment must pass, reflected by the image_vulnerability_scan_passed status, which strictly adheres to a max_critical_vulnerabilities_allowed threshold of zero. The node also mandates that secrets_managed_externally, injected via a secure orchestrator mechanism to avoid their insecure embedding within images. Supply chain integrity is maintained by verifying registry_requires_authentication for all operations. In the orchestration layer, access control is paramount; therefore, orchestrator_rbac_enabled is required to enforce least privilege. Default-deny network communication is enforced through active network_policies_enforced, isolating workloads. At runtime, the security posture is hardened by mandating that a container_runs_as_non_root and that a runtime_security_profile_applied, like Seccomp or AppArmor, restricts system call privileges. The container's integrity is further protected when an immutable_filesystem_enabled configuration prevents unauthorized modifications. Finally, the underlying host infrastructure must be demonstrably secure, requiring that the host_os_hardened against a standard like a CIS benchmark and that all host_access_audited to maintain a verifiable log of administrative actions.",
  "paywall": {
    "status": "LOCKED",
    "unlock_cost_usd": "0.01",
    "skyfire_id": "41779894-ece2-4163-9761-b3b1b76e19b0"
  },
  "crosswalks": {
    "_available_keys": [
      "nist_framework",
      "iso_standard",
      "ai_overlay_2026",
      "industry_mapping"
    ],
    "_note": "Full crosswalk values included in vault response"
  },
  "dependencies": [
    "nist-sp-800-145-cloud-computing",
    "nist-sp-800-218-ssdf",
    "nist-800-204-microservices"
  ],
  "primary_citations_count": 6
}