/family-deep-dive

description: Deep dive analysis of NIST 800-53 control families with implementation guidance

NIST 800-53 Control Family Deep Dive

Provides comprehensive analysis of NIST 800-53 control families, including control overview, common implementations, cloud-specific guidance, and integration patterns for AWS/Azure/GCP.

Usage

/nist:family-deep-dive <family> [baseline] [options]

Arguments

• `$1` - Control family: "AC", "AU", "SC", "IA", "CM", "CP", "IR", "SI", "RA", etc.
• `$2` - Baseline (optional): "low", "moderate", "high" (default: "moderate")
• `$3` - Options (optional): `--environment=cloud|hybrid|on-prem`, `--show-controls`, `--implementation-only`

Examples

# Deep dive on Access Control family
/nist:family-deep-dive AC moderate

# Deep dive on Audit family for cloud
/nist:family-deep-dive AU moderate --environment=cloud

# Show all controls in family
/nist:family-deep-dive SC moderate --show-controls

# Implementation guidance only (skip theory)
/nist:family-deep-dive IA moderate --implementation-only

Output - Access Control (AC) Family

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
NIST 800-53 CONTROL FAMILY DEEP DIVE
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Family: Access Control (AC)
Baseline: Moderate
Environment: Cloud (AWS, Azure, GCP)

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
FAMILY OVERVIEW
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Purpose:
  The Access Control family addresses the policies, procedures, and technical
  controls to limit information system access to authorized users, processes
  acting on behalf of authorized users, and devices (including other systems).

Core Principles:
  - Least Privilege: Users have minimum access needed
  - Separation of Duties: Critical functions split among multiple users
  - Need-to-Know: Access based on job function requirements
  - Defense in Depth: Multiple layers of access control

Control Count in Moderate Baseline: 25 controls
  - Base controls: 22
  - Enhancements: 3 additional
  - Optional enhancements: 40+ available

Maturity Model:
  Level 1 (Basic): Authentication, authorization, auditing
  Level 2 (Intermediate): RBAC, periodic reviews, automated provisioning
  Level 3 (Advanced): Attribute-based access, real-time analytics, zero trust

Common Failures:
  - Orphaned accounts (users who left but access remains)
  - Excessive privileges (admin access for non-admin tasks)
  - Stale access (permissions granted but no longer needed)
  - Shared accounts (cannot attribute actions to individuals)
  - No access reviews (permissions drift over time)

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
KEY CONTROLS (Moderate Baseline)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

AC-1: Policy and Procedures
  Purpose: Establish governance for access control
  Implementation: Document access control policy, procedures, review annually
  Cloud Pattern: Store in version control (Git), require exec approval
  Effort: 16 hours (initial), 4 hours/year (review)
  Evidence: Policy document, approval memo, annual review log

AC-2: Account Management ⭐ HIGH PRIORITY
  Purpose: Manage system account lifecycle (create, modify, disable, delete)
  Implementation: Automated provisioning via identity provider
  Cloud Pattern: Okta/Azure AD → AWS SSO, automated deprovisioning
  Effort: 40 hours (automation setup), 10 hours/month (reviews)
  Evidence: IAM user lists, quarterly access reviews, termination logs
  Common Gap: Manual deprovisioning leads to orphaned accounts
  Fix: Integrate HR system with IAM for automated lifecycle

AC-3: Access Enforcement
  Purpose: Enforce approved authorizations for system access
  Implementation: RBAC or ABAC policies, deny-by-default
  Cloud Pattern: IAM policies, Security Groups, RBAC
  Effort: 24 hours (initial policy design)
  Evidence: IAM policy documents, access logs showing enforcement
  Common Gap: Overly permissive policies (e.g., AdministratorAccess for all)
  Fix: Implement least privilege via managed policies per role

AC-4: Information Flow Enforcement
  Purpose: Control information flow between systems and networks
  Implementation: Network segmentation, data loss prevention
  Cloud Pattern: VPCs, subnets, NACLs, Security Groups, VPC endpoints
  Effort: 32 hours (network design)
  Evidence: Network diagram, security group rules, flow logs
  Common Gap: Flat network (all systems can communicate)
  Fix: Segment by environment (dev/stage/prod) and tier (web/app/data)

AC-5: Separation of Duties
  Purpose: Divide critical functions among different individuals
  Implementation: Dual approval for sensitive actions, role segregation
  Cloud Pattern: IAM policies prevent single user from both create + approve
  Effort: 16 hours (policy design)
  Evidence: IAM policies showing separation, audit logs
  Example: Developers can create resources, but can't deploy to production

AC-6: Least Privilege ⭐ HIGH PRIORITY
  Purpose: Grant only minimum necessary permissions
  Implementation: Role-based policies, periodic permission reviews
  Cloud Pattern: Managed policies (AWS), Azure RBAC, GCP IAM
  Effort: 40 hours (initial), ongoing refinement
  Evidence: Permission analysis, unused permission reports
  Common Gap: Over-permissioning (easier to give broad access)
  Fix: Start with read-only, add permissions as needed with justification

AC-7: Unsuccessful Login Attempts
  Purpose: Lock accounts after failed login attempts
  Implementation: Failed login threshold (e.g., 5 attempts), lockout duration
  Cloud Pattern: Okta/Azure AD account lockout policy
  Effort: 2 hours (configuration)
  Evidence: Account lockout policy screenshot, lockout event logs
  Best Practice: 5 attempts, 30-minute lockout

AC-8: System Use Notification
  Purpose: Display warning banner before login
  Implementation: Login page banner, SSH banner
  Cloud Pattern: CloudFront → S3 static page with banner, SSH config
  Effort: 4 hours
  Evidence: Screens