NIST SP800-53 Compliance Evaluation

[cjbuchanan]

From Issue #36.

Federal systems, and federally funded state systems, must demonstrate FISMA compliance using the NIST SP800-53 guidelines according to Federal Information Processing Standards (FIPS) 199 Moderate level of impact to comply with the Health Information Portability and Accountability Act (HIPAA).

https://www.insidegovernmentcontracts.com/2014/12/fisma-updated-and-modernized/

[pradeepBoston]

Payload is not encrypted. It is raw BLOB data. It is not compliant with NIST SP800-53 guidelines as payload must be encrypted with signature which are exchanged to validate.

[infopowerbroker]

To clarify, which version of NIST 800-53 are you looking at (v5 or v4) and which controls (and control enhancements) are being referenced? Also, what is the scope or 'system boundary' that is being included in this question?

Compliance is broad brush, so specifics are helpful to nail down the necessary protections vs tradeoffs to promote overall the system boundary's confidentiality, integrity, and availability.