I recently started working on a project where my role is partially that of a cybersecurity engineer. Reading through the NIST SP 800-53, I understand the necessity of the security controls assigned, but the process of implementing a plan to comply with the controls is a grueling process.

For example, I know that Splunk will be able to satisfy many of the Auditing controls, but I'm only aware of that because I've used it before. Are there any publications or resources that offer suggestions for applications/methodologies to use to satisfy these security controls?


Probably too late, but first, I feel your pain. And to top it off, authorizing officials (AOs) usually want the controls documented in MS Word, a static solution that does not match the requirements of today's rapid release CI/CD pipelines. So after writing my first ATO by hand, I vowed never to do that again.

For starters, look at OpenControl which defines a machine-readable, YAML-based language for capturing control state, the system specific control text narrative and (ideally) a verification process. Experiment with OpenControl using the example project freedonia-compliance which uses compliance-masonry to generate the documentation.

I have used OpenControl to create markdown-based documentation in git for several federal clients. Then pandoc can be run against that to create the Word docs AOs want. (I have not yet managed to get an AO to look at git as, well, they have check boxes that need checking and git is not one of them. Things need to change...)

You might also want to look at GovReady, a security compliance company that we (CivicActions) are in partnership with. I am using their hyperGRC tool to help with creating System Security Plan (SSP) documentation, and we are currently exploring ways to attach real-time evidence gathering and control verification for ongoing authorization (the mantra of the RMFv2).

The next step is to integrate control management directly into the CI/CD pipeline so that as configurations change, so does the compliance documentation.

There's a similar project that NIST is working on called OSCAL (Open Security Controls Assessment Language) that looks promising. We are currently working with both schemas, and there is an oscalkit for conversion from OpenControl to OSCAL.

  • A few things: (1) Shockingly good answer from a new contributor, thanks for ruining my cynicism. (2) Good self-disclosure, that's important. (3) Could you describe in more detail what Compliance Masonry does? I'm confused what you mean by "text narrative" especially. (4) Minor typo: "we (CivicActions) is" should be "we (CivicActions) are"
    – Nic
    Jul 7 '19 at 21:55
  • @NicHartley thanks for the suggestions. Edited my answer. Jul 7 '19 at 23:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.