NIST 800-53 Compliance

Monitor insider activity. Detect anomalies. Respond to incidents. ALL-IN-ONE

Syteca cooperates closely with the National Institute of Standards and Technology (NIST), a world-renowned non-regulatory agency providing detailed guidelines for improving information security within federal agencies and associated organizations. As an all-in-one insider risk management platform, Syteca can help you build data protection systems and digital infrastructure protection systems that comply with key requirements of NIST 800-53.

Syteca is listed in NIST Special Publication (SP) 1800-18 Privileged Account Management for the Financial Services Sector.

NIST 800-53 compliance: who needs it and why?

As a non-regulatory agency of the US Department of Commerce, NIST focuses on researching and establishing general guidelines and standards that federal agencies must meet.

In particular, NIST Special Publication 800-53: Security and Privacy Controls for Information Systems and Organizations is a set of guidelines and recommendations for architecting and managing secure information systems. Compliance with NIST 800-53 security control guidelines is the main key to achieving compliance with the Federal Information Security Management Act of 2002 (FISMA) and Federal Information Processing Standards (FIPS) requirements.

Since 2005, NIST has released several revisions of SP 800-53. The latest is Revision 5.1 [PDF], published in 2020. The control baselines that have previously been included in NIST Special Publication 800-53 have been relocated to its companion publication — NIST Special Publication 800-53B.

NIST 800-53B

Security control baselines

Privacy control baseline

High-impact

Moderate-impact

Low-impact

Privacy control baseline

The Syteca platform is the ultimate NIST 800-53 compliance software that covers the core security controls and makes it easy to secure your organization’s critical assets and sensitive data.

Using Syteca to meet NIST 800-53 requirements

Syteca helps you comply with NIST 800-53 security controls and secure your sensitive data by providing user activity monitoring and auditing, identity and access management, and incident response capabilities.

NIST 800-53 Revision 5.1 provides detailed guidelines for the above-mentioned security and privacy controls that cover 20 control families.

NIST 800-53 control families

AC – Access Control

AT – Awareness and Training

AU – Audit and Accountability

CA – Assessment, Authorization, and Monitoring

CM – Configuration Management

CP – Contingency Planning

IA – Identification and Authentication

IR – Incident Response

MA – Maintenance

MP – Media Protection

PE – Physical and Environmental Protection

PL – Planning

PM – Program Management

PS – Personnel Security

PT – Personally Identifiable Information
Processing and Transparency

RA – Risk Assessment

SA – System and Services Acquisition

SC – System and Communications Protection

SI – System and Information Integrity

SR – Supply Chain Risk Management

For each of these families, there’s a large list of NIST 800-53 controls that includes security controls with different impact levels. However, organizations don’t need to implement all of these controls to comply with FISMA and NIST SP 800-53. They need to follow the baseline recommendations for architecting information security systems but are free to choose which security tools and solutions to use for that purpose.

Access Control (AC)
Audit and Accountability (AU)
Assessment, Authorization, and Monitoring (CA)
Identification and Authentication (IA)
Incident Response (IR)
Maintenance (MA)
Planning (PL)

With Syteca, you can implement the necessary security controls for NIST 800-53 control families including:

As a NIST compliance tool, Syteca fully covers all of the controls in the Audit and Accountability family while also covering the majority of security controls in other control families.

Access Control

The Access Control family includes a wide range of security controls for ensuring the proper level of access management. Syteca includes a number of features that can help you meet critical NIST 800-53 access control requirements, including:

AC-2 Account management. Syteca contains a set of authentication features that can be used for improving your current account management system, including identity management, two-factor authentication, and privileged access management (PAM), and role-based access control.
AC-3 Access enforcement. Syteca’s access management capabilities allow authorization approval to be enforced according to your access control policies.
AC-5 Separation of duties. Using Syteca, you can allow users to access only the data necessary for performing their duties by adding users to a certain user group with specific permissions.
AC-6 Least Privilege. Syteca ensures granular access by assigning, elevating, terminating, and managing user access privileges. It also enables granting of temporary access permissions by request and auditing of privileged user activity.
AC-7 Unsuccessful logon attempts. Syteca provides the ability to allow users access without approval only during work hours and to block any login attempts during non-working hours and days.
AC-8 System use notification. Syteca can be configured to display notifications about login attempts within the protected perimeter.
AC-10 Concurrent session control. Syteca allows you to control concurrent user logins to the Management Tool.
AC-12 Session termination. The maximum duration of one local session is 24 hours. At 00:00 (midnight), all live sessions are terminated. After termination, new live sessions start automatically.
AC-17 Remote access. Syteca provides monitoring and control capabilities for easy and secure access of remote employees and third-party contractors.

Syteca offers a robust set of privileged access management capabilities, enabling you to granularly manage access permissions for different users, roles, and user groups. Other access management features provided by Syteca include manual access approval, time-limited access permissions, one-time passwords, two-factor authentication, and secondary authentication for shared accounts.

Audit and Accountability

The NIST Audit and Accountability control family covers security practices required for establishing a reliable accountability system within an organization. NIST recommends performing detailed and continuous audits to detect possible cybersecurity threats and investigate incidents. Auditing and accountability are necessary to pass a NIST compliance audit or prove compliance with other security standards and regulations.

Syteca is a comprehensive user activity monitoring solution that can provide you with a detailed audit log of every event that happens on a monitored endpoint. The platform can help you meet the key NIST 800-53 audit logging requirements as it covers many security controls within the Audit and Accountability control family, including:

AU-2 Event logging. Syteca can be configured to monitor and audit all or only specific events.
AU-3 Content of audit records. Syteca audit records contain information regarding security event descriptions, time stamps, user or process identifiers, source and destination addresses, event outcomes, names of files involved, etc.
AU-4 Audit log storage capacity. Syteca relies on compression algorithms to store audit logs without using too much disk space. This way, you don’t need to expand your data storage.
AU-6 Audit record review, analysis, and reporting. Syteca provides a rich set of reporting capabilities. Reports can be generated manually or automatically according to a set schedule. You can also review activity records via a built-in video player and use metadata about an event as search parameters.
AU-7 Audit record reduction and report generation. Syteca allows you to filter and sort audit log records and generate reports on them.
AU-8 Time stamps. All recorded data is coupled with timestamps.
AU-9 Protection of audit information. Audit logs are protected against alteration of log entries with an integrity check. The data is also encrypted in the database, with unique database encryption. If an Audit log has been modified, the software displays a red warning message.
AU-10 Non-repudiation. Any non-repudiation action, including creating, sending, receiving, and approving information, is recorded by Syteca. Users can’t alter these records, and you can export them in a protected format and use them as evidence in forensic activities.
AU-11 Audit record retention. You can store any number of audit records until they are needed for administrative, legal, audit, or other operational purposes.
AU-12 Audit record generation. Syteca provides audit logs with detailed audit records.
AU-14 Session audit. By default, Syteca records all user sessions initiated on the target endpoint, including privileged user sessions. Auditing the recorded sessions, you can analyze user keystrokes, visited websites, and opened files, among other metadata.

Assessment, Authorization, and Monitoring

The Assessment, Authorization, and Monitoring control family includes nine security controls for assessing, authorizing, and monitoring employees and various system connections through the infrastructure. To achieve this, NIST recommends developing and implementing a risk management strategy for establishing an assessment, authorization, and monitoring policy and procedures.

Syteca offers functionality for securely authorizing users and entities as well as continuously monitoring their actions within the IT infrastructure.

CA-7 Continuous monitoring. Syteca ensures continuous monitoring of both regular users and privileged users in real time. Monitoring sessions are recorded in a video format with text metadata for further analysis. Syteca also supports keystroke monitoring and USB device management.

Identification and Authentication

The Identification and Authentication control family covers a set of security controls necessary for uniquely identifying each user and device accessing your network. The ability to identify each user accessing the system and then reliably connect them to a specific resource is crucial for detecting potential threats and investigating security incidents.

As a universal NIST compliance software, Syteca provides a number of identity and access management features for ensuring a high level of user identity verification, including secondary authentication and multi-factor authentication (MFA). These capabilities cover the following NIST Identification and Authentication controls:

IA-2 Identification and authorization (organizational users). As advised by NIST 800-53, two-factor authentication or multi-factor authentication can be used to secure access to privileged accounts. The MFA capabilities provided by Syteca allow you to uniquely identify internal employees, subcontractors, and other organizational users.
IA-4 Identifier management. Syteca allows for assigning and verifying each user and role with a unique username. In multitenancy mode, the platform also issues tenant keys so each tenant can quickly identify their Syteca Clients.
IA-5 Authenticator management. User credentials and secrets are safely stored inside the Syteca password vault. Password management capabilities allow you to automate the creation, rotation, and termination of credentials as well as prevent leaks.
IA-8 Identification and authorization (non-organizational users). Syteca’s secondary authentication feature ensures additional identification of every user logging in to the system under a shared account. Access requests from unknown and unauthorized users are denied automatically.
IA-10 Adaptive authentication. The user and entity behavior analytics module in Syteca can detect if a user logs in to the system at an unusual time. In this case, the platform can notify you or terminate the user session automatically, making the user re-authenticate.
IA-11 Re-authentication. Syteca can automatically terminate user sessions if they violate security rules you configure. To continue working, a user whose session is terminated will have to authenticate once more.

Incident Response

The Incident Response control family covers one of the most important parts of ensuring the protection of sensitive data: what needs to be done in case of a security incident. Syteca provides actionable tools to meet the requirements of the following controls:

IR-4 Incident handling. Syteca provides an alerting system to detect incidents in a timely manner and a set of manual and automated incident response options. You can immediately kill a threatening process or block a suspicious user and investigate the incident.
IR-5 Incident monitoring. When an incident is detected, a security officer is notified and provided with all context needed to quickly respond. The officer also can watch the suspicious user session in real time to define whether it needs an immediate response.
IR-6 Incident reporting. With Syteca, you can generate reports on any details of a security incident and use them to report the incident to the relevant authorities. You can also export data in a forensic format for further cybersecurity incident investigation and analysis.

Maintenance

Any changes to cybersecurity system configurations can pose the threat of compromising its performance, introducing new vulnerabilities to it, or deploying malicious code. The Maintenance control family describes ways to ensure that your security system undergoes maintenance without any harm or undesired changes. Here’s how you can secure maintenance activities with Syteca:

MA-2 Controlled maintenance. Syteca records users with any level of privileges and in any environment, including Syteca administrators. Reviewing these records can help you monitor and control the maintenance of cybersecurity system components.
MA-4 Nonlocal maintenance. Remote sessions are monitored and recorded the same way as local ones. This way, you’ll have an equal level of control over local and nonlocal maintenance activities.

Planning

The Planning controls of NIST 800-53 help organizations create a robust security management system and control any security-related activity. Systematic and centralized collection of data about cyber protection is the foundation for policies and plans required by this family of NIST 800-53 controls. You can easily add data collected by Syteca to your pipelines:

PL-9 Central management. The Management Tool allows you to access and manage all security-related information that Syteca collects. Also, you can integrate Syteca with your SIEM and ticketing system to fully centralize security information management.

Meet other IT security requirements with Syteca

NISPOM Change 2 and H.R. 666

Let’s get the conversation started

Contact our team to learn how our insider risk management software can safeguard your organization’s data from any risks caused by human factors. Book a call with us at a time that suits you best, and let’s explore how we can help you achieve your security goals.

Get in Touch