NIST 800-53r5 Control Tagging Implementation Guide¶

Version: 1.0.0 Last Updated: 2025-01-18 Status: Active Standard Code: NIST-IG Tokens: ~2,500 Priority: Critical

Table of Contents¶

1. 🚀 Quick Start
2. 📋 What's Implemented
3. 🏷️ Tagging Quick Reference
4. 🔄 Workflow Integration
5. 📊 Monitoring Compliance
6. 🎯 Next Steps
7. 📚 Documentation
8. 🤝 Contributing

🚀 Quick Start¶

1. Install Git Hooks (Recommended)¶

./scripts/setup-nist-hooks.sh

This installs:

• Pre-commit hook for NIST tag validation
• Commit message template with NIST control hints
• Automatic tag suggestions for security code

2. Start Tagging Your Code¶

TypeScript/JavaScript¶

/**
 * @nist ia-2 "User authentication"
 * @nist ia-5 "Password management"
 * @evidence code, test
 */
export async function authenticateUser(credentials: Credentials) {
  // @nist ia-5.1 "Password complexity validation"
  validatePassword(credentials.password);

  // @nist au-2 "Audit authentication events"
  await auditLog.record('auth.attempt', { user: credentials.username });
}

Python¶

# @nist ac-3 "Access enforcement"
# @nist ac-6 "Least privilege"
def check_permissions(user, resource, action):
    """
    @nist-implements ac-3.a "Enforce approved authorizations"
    """
    # Implementation

YAML Configuration¶

# @nist-controls: [sc-8, sc-13, ac-12]
security:
  tls:
    version: "1.3"  # @nist sc-8 "Transmission confidentiality"
  session:
    timeout: 30     # @nist ac-12 "Session termination"

3. Run Compliance Checks¶

# Check current file
./scripts/nist-pre-commit.sh

# Generate SSP
cd standards/compliance
npm run generate-ssp

# Harvest evidence
npm run harvest-evidence

📋 What's Implemented¶

✅ Completed¶

• COMPLIANCE_STANDARDS.md: Comprehensive tagging guidelines
• NIST_TAGGING_PROPOSAL.md: Strategic approach document
• CLAUDE.md Updates: LLM context for NIST compliance
• GitHub Actions Workflow: Continuous compliance checking
• Pre-commit Hooks: Automatic validation and suggestions
• OSCAL Platform: Complete SSP and evidence generation

🔧 Available Tools¶

1. Pre-commit Hook (scripts/nist-pre-commit.sh)
2. Validates NIST tag format
3. Suggests controls for security code

4. Configurable blocking/warning behavior

5. GitHub Actions (.github/workflows/nist-compliance.yml)

6. PR validation and suggestions
7. Coverage reporting
8. Weekly compliance audits

9. Automatic SSP generation

10. OSCAL Compliance Platform (standards/compliance/)

11. Semantic control mapping
12. Evidence harvesting
13. SSP generation
14. Assessment automation

🏷️ Tagging Quick Reference¶

Common Security Patterns → NIST Controls¶

🔄 Workflow Integration¶

Development Flow¶

1. Write Code → Security feature detected
2. IDE/Hook Suggests → Appropriate NIST controls
3. Developer Tags → Using standard format
4. Commit → Hook validates tags
5. PR → CI suggests missing controls
6. Merge → SSP auto-updates

CI/CD Pipeline¶

on: [push, pull_request]

jobs:
  nist-compliance:
    - Validate NIST tags ✓
    - Suggest missing controls ✓
    - Generate coverage report ✓
    - Update SSP (on main) ✓
    - Collect evidence (weekly) ✓

📊 Monitoring Compliance¶

Check Coverage¶

# Count total controls tagged
grep -r "@nist" . --include="*.ts" --include="*.js" | wc -l

# List unique controls
grep -r "@nist" . --include="*.ts" | grep -o "@nist [a-z][a-z]-[0-9]\+" | sort -u

# Find untagged security code
./scripts/nist-pre-commit.sh

Generate Reports¶

cd standards/compliance

# Generate System Security Plan
npm run generate-ssp -- --baseline moderate

# Collect compliance evidence
npm run harvest-evidence

# View in OSCAL format
cat oscal-output/ssp-*.json

🎯 Next Steps¶

For Developers¶

1. Install git hooks: ./scripts/setup-nist-hooks.sh
2. Review COMPLIANCE_STANDARDS.md
3. Start tagging security code with @nist annotations
4. Use pre-commit hook for validation

For Security Teams¶

1. Review generated SSPs in standards/compliance/oscal-output/
2. Configure baseline in GitHub Actions workflow
3. Set up compliance dashboard monitoring
4. Schedule regular compliance reviews

For LLM Users¶

When asking for code generation or review:

Please ensure all security-related code includes appropriate NIST 800-53r5 control tags.
Use format: @nist <control-id> "<description>"
Refer to COMPLIANCE_STANDARDS.md for guidelines.

📚 Documentation¶

• COMPLIANCE_STANDARDS.md - Detailed tagging guidelines
• NIST_TAGGING_PROPOSAL.md - Strategic approach
• standards/compliance/README.md - OSCAL platform docs
• CLAUDE.md - LLM context with NIST integration

Related Standards¶

• CODING_STANDARDS.md - General coding standards with NIST section
• MODERN_SECURITY_STANDARDS.md - Security implementation
• PROJECT_MANAGEMENT_STANDARDS.md - Compliance tracking
• UNIFIED_STANDARDS.md - Comprehensive standards overview
• STANDARDS_INDEX.md - Quick reference to all standards

🤝 Contributing¶

To improve NIST tagging:

1. Update control mappings in COMPLIANCE_STANDARDS.md
2. Add new patterns to pre-commit hook
3. Enhance LLM prompts in CLAUDE.md
4. Submit PRs with properly tagged code

Remember: The goal is to make compliance automatic and frictionless. Tag as you code, and let the tools handle the rest! 🚀