nist-compliance

NIST Compliance Skill

Level 1: Quick Start (5 minutes)

What You'll Learn

Tag code with NIST 800-53r5 controls, track compliance, and generate evidence for security audits.

Core Principles

• Traceability: Link code to security controls
• Evidence: Automate compliance documentation
• Continuous Compliance: Integrate into CI/CD
• Defense in Depth: Multiple control layers

Quick Start Tagging

/**
 * @nist ia-2 "User authentication"
 * @nist ia-5 "Authenticator management"
 * @evidence code, test
 */
export async function authenticateUser(credentials: Credentials) {
  // @nist ia-5.1 "Password complexity validation"
  validatePasswordComplexity(credentials.password);

  // @nist au-2 "Audit authentication events"
  await auditLog.record("auth.attempt", {
    user: credentials.username,
    timestamp: new Date(),
  });

  return authService.verify(credentials);
}

# @nist ac-3 "Access enforcement"
# @nist ac-6 "Least privilege"
def check_permissions(user, resource, action):
    """
    @nist-implements ac-3.a "Enforce approved authorizations"
    @evidence test, documentation
    """
    if not user.has_permission(resource, action):
        audit_access_denial(user, resource, action)  # @nist au-2
        raise PermissionDenied()

# @nist-controls: [sc-8, sc-13, ac-12]
security:
  tls:
    version: "1.3" # @nist sc-8 "Transmission confidentiality"
    ciphers: ["TLS_AES_256_GCM_SHA384"] # @nist sc-13
  session:
    timeout: 1800 # @nist ac-12 "Session termination (30 min)"

Essential Checklist

• Install pre-commit hooks for NIST validation
• Tag authentication code (IA family)
• Tag access control (AC family)
• Tag audit logging (AU family)
• Generate initial compliance report

Common Control Families

Family	Code	Examples
Access Control	AC	AC-2 (accounts), AC-3 (enforcement), AC-6 (least privilege)
Identification & Auth	IA	IA-2 (user auth), IA-5 (authenticators), IA-8 (identification)
Audit & Accountability	AU	AU-2 (events), AU-3 (content), AU-6 (review)
System & Communications	SC	SC-8 (confidentiality), SC-13 (crypto), SC-28 (data at rest)
System & Information Integrity	SI	SI-10 (input validation), SI-11 (error handling)