/control-tailor

description: Interactive NIST 800-53 control tailoring for specific baselines and environments

NIST 800-53 Control Tailoring

Provides interactive control tailoring guidance for NIST 800-53 baselines, helping organizations customize controls based on risk assessment, operational requirements, and technology constraints while maintaining compliance.

Usage

/nist:control-tailor <control-id> <baseline> [options]

Arguments

• `$1` - Control ID (e.g., "AC-2", "AU-2", "SC-7") or family (e.g., "AC", "AU")
• `$2` - Baseline: "low", "moderate", "high", "privacy"
• `$3` - Options (optional): `--environment=cloud|hybrid|on-prem`, `--output=guidance|ssp-text|yaml`

Examples

# Tailor single control for moderate baseline
/nist:control-tailor AC-2 moderate

# Tailor control for cloud environment
/nist:control-tailor AC-2 moderate --environment=cloud

# Tailor entire control family
/nist:control-tailor AC moderate

# Generate SSP-ready text
/nist:control-tailor SC-7 high --output=ssp-text

# Export tailoring decisions as YAML
/nist:control-tailor AC-2 moderate --output=yaml

Output

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
NIST 800-53 CONTROL TAILORING
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Control: AC-2 - Account Management
Baseline: Moderate
Environment: Cloud (AWS)
Organization: Your Company

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
BASELINE CONTROL STATEMENT (Rev 5)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

AC-2: Account Management

The organization:
  a. Identifies and selects the following types of information system accounts
     to support organizational missions/business functions: [Assignment: organization-
     defined information system account types];

  b. Assigns account managers for information system accounts;

  c. Establishes conditions for group and role membership;

  d. Specifies authorized users of the information system, group and role membership,
     and access authorizations (i.e., privileges) and other attributes (as required)
     for each account;

  e. Requires approvals by [Assignment: organization-defined personnel or roles]
     for requests to create information system accounts;

  f. Creates, enables, modifies, disables, and removes information system accounts
     in accordance with [Assignment: organization-defined procedures or conditions];

  g. Monitors the use of information system accounts;

  h. Notifies account managers when accounts are no longer required or when users
     are terminated or transferred;

  i. Authorizes access to the information system based on a valid access authorization,
     intended system usage, and other attributes as required;

  j. Reviews accounts for compliance with account management requirements
     [Assignment: organization-defined frequency]; and

  k. Establishes a process for reissuing shared/group account credentials when
     individuals are removed from the group.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
CONTROL ENHANCEMENTS (Select for Moderate Baseline)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Baseline Includes:
✓ AC-2(1) - Automated System Account Management
✓ AC-2(2) - Removal of Temporary / Emergency Accounts
✓ AC-2(3) - Disable Inactive Accounts
✓ AC-2(4) - Automated Audit Actions
✓ AC-2(5) - Inactivity Logout
✓ AC-2(13) - Disable Accounts for High-Risk Individuals

Additional Enhancements Available (Optional):
□ AC-2(6) - Dynamic Privilege Management
□ AC-2(7) - Privileged User Accounts
□ AC-2(8) - Dynamic Account Creation
□ AC-2(9) - Restrictions on Use of Shared Groups / Accounts
□ AC-2(11) - Usage Conditions
□ AC-2(12) - Account Monitoring / Atypical Usage

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
RECOMMENDED ENHANCEMENTS
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Based on: Cloud environment, Financial services sector, PCI-DSS overlap

STRONGLY RECOMMENDED (High ROI):

✓ AC-2(1) - Automated System Account Management
  Impact: HIGH
  Cost: MEDIUM
  Justification:
    - Reduces manual errors in provisioning/deprovisioning
    - Ensures timely access removal (compliance requirement)
    - Provides audit trail for all account changes
  Cloud Implementation:
    - AWS: IAM + Identity Center + Lambda for automation
    - Azure: Azure AD + PIM + Logic Apps
    - GCP: Cloud Identity + Workflows
  Effort: 40 hours (initial setup), 2 hours/month (maintenance)
  Satisfies: SOC2 CC6.1, PCI 8.1.4, ISO 27001 A.9.2

✓ AC-2(2) - Removal of Temporary / Emergency Accounts
  Impact: HIGH
  Cost: LOW
  Justification:
    - Prevents forgotten emergency accounts from becoming security risk
    - Required for high-sensitivity environments
    - Easy to implement with automation
  Cloud Implementation:
    - EventBridge rule to check account age
    - Lambda to disable accounts older than 72 hours
    - SNS notification before auto-disable
  Effort: 8 hours (one-time setup)
  Satisfies: ISO 27001 A.9.2.6

✓ AC-2(3) - Disable Inactive Accounts
  Impact: HIGH
  Cost: LOW
  Justification:
    - Reduces attack surface (inactive accounts = security risk)
    - Required for PCI-DSS compliance (90 days)
    - Aligns with SOC 2 best practices
  Cloud Implementation:
    - IAM credential report analysis
    - Automated disable after 90 days inactivity
    - Manager notification before disable
  Effort: 12 hours
  Satisfies: PCI 8.1.4, SOC2 CC6.1

✓ AC-2(4) - Automated Audit Actions
  Impact: HIGH
  Cost: MEDIUM
  Justification:
    - Creates audit trail for all account management
    - Enables security analytics and threat detection
    - Required for forensics and incident response
  Cloud Implementation:
    - CloudTrail for all IAM API calls
    - CloudWatch Logs with 1-year retention
    - GuardDuty for anomaly detection
  Effort: 16 hours
  Satisfies: SOC2 CC7.2, PCI 10.2

RECOMMENDED (Good Value):

⊕ AC-2(9) - Restrictions on Use of Shared Groups / Accounts
  Impact: MEDIUM
  Cost: LOW
  Justification