NIST SP 800-53 agent skills
15 skills relate to NIST SP 800-53. The tag says which framework a skill relates to; the skills contain no text from it.
NIST SP 800-53 is the catalogue of security and privacy controls that NIST publishes for information systems and organisations. US federal agencies apply it under FISMA, and FedRAMP builds on it. These skills cover categorisation, system security plan statements, plans of action and milestones, and the evidence an assessor samples.
15 skills tagged NIST SP 800-53
- Access review campaign prepA ready-to-run access review: systems in scope, account lists reconciled against HR, pre-flagged leavers and admins, and review sheets for managers.
- Backup restore test evidenceA restore test plan with success criteria set in advance, then a write-up that proves backups recover within your RTO and RPO.
- Change management evidence samplingA change management test before the auditor runs one: the production change population, sampled approvals and segregation of duties gaps.
- Evidence freshness checkAn index of every evidence artefact with its date, owner and period covered, flagging stale, undated and missing items before the auditor does.
- First gap assessmentA first gap assessment against your chosen framework: what exists, rated by evidence, and a gap register with the long-lead items first.
- GRC setup reviewThe 10 grcskills that fit your setup, an audit of what is broken, duplicated or missing, and a 30-day plan, written to files.
- Incident response plan draftingAn incident response plan sized to your real team: roles and deputies, a severity scale, a contact tree and one-page playbooks for likely incidents.
- Internal audit checklist from scopeA working internal audit checklist for one area, built from your own documents: a question, a record to inspect, a sample and a pass criterion per test.
- Logging and monitoring evidence packA logging and monitoring evidence pack: log coverage and retention per system, the alert rules that matter, and proof an alert was handled.
- Multi-framework overlap mapOne internal control set in your own words, mapped across your frameworks, so evidence is collected once and the unique gaps stand out.
- Plan of action and milestones draftA plan of action and milestones from your findings and scans: one row per weakness, dated milestones, owners, and every vague or overdue item flagged.
- Risk register first passA first risk register of 20 to 40 company-specific scenarios, drafted from your own material, with owners and scores to confirm.
- SSP control implementation statementsSystem security plan statements drafted from your real evidence, per control id: who, what, how, where and how often, with every unproven claim flagged.
- System categorization first passA draft system categorization: boundary, information types, impact levels with reasons, the high-water mark and what the official decides.
- Vendor tieringSupplier tiers that size the review effort: the full vendor population from finance, single sign-on and contracts, scored on data, access and dependency.