Security · United States (NIST)

NIST SP 800-53 Rev. 5 (selected controls)

Attestkeep maps what your cluster's admission control and image scanning recorded in a period to 15 clauses of NIST SP 800-53 Rev. 5. 15 are assessed from those records; none is marked outside scope.

Create an account How a package is built

What the framework asks

15 clauses a cluster can answer.

Citations and titles as the report prints them. Open a clause to read what it asks, restated close to the instrument's own words.

Security and Privacy Controls for Information Systems

NIST SP 800-53 Rev. 5

Selected CM, RA, SI, SR, AU and CP controls

Citation	Clause	Report sections
CM-2	Baseline configuration Develop, document and maintain a current baseline configuration of the system under configuration control.	Control statementAdmission decisions
CM-3	Configuration change control Determine and document the types of changes that are configuration controlled, review proposed changes, and retain records of them.	Triage decisionsEvidence chain
CM-7	Least functionality Configure the system to provide only mission-essential capabilities and prohibit or restrict the use of functions, ports, protocols and services that are not required.	Control statementAdmission decisions
CM-14	Signed components Prevent the installation of software and firmware components without verification that the component has been digitally signed using a recognized and approved certificate.	Supply chainControl statementAdmission decisions
RA-5	Vulnerability monitoring and scanning Monitor and scan for vulnerabilities in the system and hosted applications, analyze the reports, and remediate legitimate vulnerabilities within response times set by the organization.	CoverageAdmission decisionsOutcomesControl statementIssues
RA-7	Risk response Respond to findings from security assessments, monitoring and audits in accordance with organizational risk tolerance.	Triage decisionsAdmission decisionsDeployment contextBreak-glass events
SI-2	Flaw remediation Identify, report and correct system flaws, and install security-relevant updates within a defined period of their release.	CoverageControl statementIssues
SI-3	Malicious code protection Implement malicious code protection mechanisms at system entry and exit points, and update them as new releases become available.	CoverageSupply chainControl statement
SI-7	Software, firmware and information integrity Employ integrity verification tools to detect unauthorized changes to software, firmware and information.	Supply chainControl statement
SR-3	Supply chain controls and processes Establish a process for identifying and addressing weaknesses or deficiencies in the supply chain elements and processes.	Control statementCoverage
SR-4	Provenance Document, monitor and maintain valid provenance of systems, components and associated data.	Supply chainControl statementOrganisation
SR-11	Component authenticity Develop and implement anti-counterfeit policy and procedures, and scan for counterfeit system components.	Supply chainControl statement
AU-2	Event logging Identify the event types the system is capable of logging, and log those the organization determines are necessary.	Evidence chain
AU-12	Audit record generation Provide audit record generation capability for the event types the system is capable of auditing, and generate records that contain the required content.	Evidence chainControl statementAdmission decisions
CP-2 / SI-13	Continuity of the control Plan for the continued operation of essential mission functions, and for the availability of the mechanisms that protect them.	Availability

What Attestkeep produces

Evidence from records the cluster already keeps.

Nothing is filled in by hand. Each clause's answer carries a status (met, partial, gap or outside scope), a note with the period's own numbers, and the report sections those numbers come from.

Statements the mapping draws on

Each assessed clause is answered by one or more of these statements about the period's records. The same statement answers the same question under every framework, so two reports for one period cannot disagree.

Only images of established provenance may run5 clauses
Every image in the inventory carries a scan record4 clauses
Every decision and administrative action is recorded3 clauses
Admission refuses non-compliant workloads2 clauses
Workloads name images by digest, not by a movable tag2 clauses
Accepted risks are named, justified and expire2 clauses
Images may enter only from named registries2 clauses
Remediation windows are declared for each severity2 clauses
Workload privilege is constrained at admission2 clauses
Vulnerability thresholds are stricter where the workload is exposed or privileged1 clause
The control itself was operating throughout the period1 clause
A refusal or a critical finding reaches a person1 clause
The organisation operating the control is identified1 clause
A bill of materials is held for the images in service1 clause
Images carrying severe findings are refused1 clause

The package

What the report contains.

Every package carries the same sections, whatever the framework. The ones marked are those NIST SP 800-53 answers cite, with the number of clauses citing each.

The scope paragraph, as the report states it.

This document reports what one Kubernetes cluster's admission control and image scanning recorded during the period, mapped onto a selection of NIST SP 800-53 Rev. 5 controls. The catalogue is far larger than any one instrument can answer; the controls below are those where image scanning and admission enforcement are the operating mechanism — configuration management, risk assessment, system and information integrity, supply chain risk management, and the audit controls the decision record answers. Controls outside that selection are not addressed here and no inference should be drawn about them.

Questions

About NIST SP 800-53 and Attestkeep

Is this a NIST SP 800-53 certification?

No. The package is evidence produced from your cluster's own records. It is not a certification, and no auditor is obliged to accept it. The scope paragraph on this page is the one the report itself carries.

Are any of the 15 clauses outside scope?

No. Every clause in this mapping is assessed from the period's records, and each one names the report sections its answer comes from.

Which plan includes NIST SP 800-53?

Every plan can report against it. Community and Team include one framework of your choice, Business three, Enterprise every one. Prices are on the pricing page.

How does an auditor check the package?

In a browser at attestkeep.com/verify.html, where nothing is uploaded, or with the short script on the documentation site. Neither needs us. For auditors has the details.

Install it yourself.

Create an account, confirm your e-mail with the code we send, take the free Community key from the Licenses page, and install with Helm.

Create an account