{
  "node_id": "nist-ir-8011-v1-automated-assessments",
  "title": "Automation Support for Security Control Assessments Volume 1: Overview",
  "domain": "Cybersecurity",
  "version": "1.0.0",
  "last_updated": "2017-06-01",
  "bluf": "This volume introduces concepts to support automated assessment of security controls detailed in NIST Special Publication (SP) 800-53. The ability to assess all implemented information security controls as frequently as needed using manual procedural methods is impractical for most organizations due to the size, complexity, and scope of their IT footprint. This document provides an operational approach for automating assessments of selected and implemented security controls to support and facilitate near real-time information security continuous monitoring (ISCM) and ongoing security authorizations. The approach is designed to be consistent with NIST guidance, including SP 800-53A, and supports programs like the Department of Homeland Security (DHS) Continuous Diagnostics and Mitigation (CDM) program.\n\nThe core methodology involves automating the 'Test' assessment method by comparing a system's actual state or behavior with a defined desired state specification. This comparison is used to perform 'defect checks', which correspond to security sub-capabilities and test for the absence or failure of a control. The document organizes controls into ISCM security capabilities, which are logical groupings that fulfill a specific purpose, such as Hardware Asset Management or Vulnerability Management. This framework supports organizations in transitioning from static, periodic security authorizations to a more dynamic, ongoing authorization process.",
  "paywall": {
    "status": "LOCKED",
    "unlock_cost_usd": "0.01",
    "skyfire_id": "41779894-ece2-4163-9761-b3b1b76e19b0"
  },
  "crosswalks": {
    "_available_keys": [
      "nist_framework"
    ],
    "_note": "Full crosswalk values included in vault response"
  },
  "dependencies": [
    "nist-sp-800-53-r5",
    "nist-sp-800-30-risk-assessment"
  ],
  "primary_citations_count": 7
}