A short AI-narrated film with English captions. Pressing play loads the YouTube player. Watch on YouTube
Overlay: USA Federal Civilian Community Overlay | ArcKit Version: [VERSION]
/arckit:us-nist-800-53 generates a tailored NIST SP 800-53 Revision 5 control set for the system, starting from the SP 800-53B baseline (Low / Moderate / High / Privacy) keyed to the system's FIPS 199 categorization. It documents parameter assignments, tailoring decisions (adds, removes, scoping statements), inheritance from FedRAMP-authorised Cloud Service Providers (CSPs), and compensating controls where the baseline implementation is not feasible.
The output is the control selection artefact that feeds the FedRAMP System Security Plan (SSP) and the agency Authority-to-Operate (ATO) package. It is the foundation for assessment procedures (SP 800-53A Rev 5), POA&M management, and continuous monitoring (/arckit:us-fedramp-readiness, /arckit:us-zero-trust).
Reviewed by the ISSO, System Owner, Common Control Provider (CCP) representatives, and the Authorizing Official. Privacy controls are reviewed by the agency Senior Agency Official for Privacy (SAOP).
Inputs
| Artefact | Purpose |
|---|---|
FIPS 199 Categorization (ARC-<id>-FIPS199-v1.0.md) |
Determines the high-water mark baseline (Low / Moderate / High) |
Requirements (ARC-<id>-REQ-v1.0.md) |
NFR-SEC-* and INT-* drive control tailoring |
Architecture Principles (ARC-<id>-PRIN-v1.0.md) |
Inheritance posture and tailoring guidance |
Output
- Doc-type:
NIST - Filename:
ARC-<PID>-NIST-v1.0.md(project root, single-instance)
Process Overview
- Select the SP 800-53B baseline (Low / Moderate / High) plus the Privacy overlay.
- Identify inheritable controls from FedRAMP-authorised CSPs (IaaS, PaaS) using the CSP's Customer Responsibility Matrix (CRM).
- Apply tailoring: scoping considerations, parameter assignments, supplemental controls, compensating controls.
- Document every tailoring decision with rationale traceable to FIPS 199, mission needs, or compensating risk acceptance.
- Surface gaps as POA&M candidates and feed them into the risk register.
Regulatory Anchors
- NIST SP 800-53 Rev 5 — https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf
- NIST SP 800-53B (Control Baselines) — https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53B.pdf
- FedRAMP Rev 5 Baselines — https://www.fedramp.gov/rev5/baselines/
Example Usage
/arckit:us-nist-800-53 001-citizen-benefits-portal
Common Pitfalls
- Failing to inherit from FedRAMP-authorised CSPs. If you are deploying on a FedRAMP-authorised IaaS/PaaS, dozens of controls are provider-inherited. Not claiming inheritance forces you to re-evidence them and burdens the assessor.
- Missing parameter assignments. Controls like AC-2(2) or AU-6(1) include organisation-defined parameters (e.g. "frequency"). Leaving these blank is an audit finding.
- Not documenting compensating controls. Where a control cannot be implemented as written, a compensating control must be documented with rationale, residual risk, and AO acceptance.
- Ignoring control enhancements at higher baselines. Moderate and High baselines include enhancements that are not optional. Treat them as in-scope by default.
Handoffs
us-fedramp-ssp— control set is consumed by the FedRAMP System Security Planus-zero-trust— control selection cross-references CISA ZTMM pillarsus-sbom-eo-14028— Supply Chain (SR) family aligns with secure-software attestationadr— significant tailoring decisions warrant an ADR