/overlay-apply

description: Apply NIST 800-53 overlays (FedRAMP, DoD, Privacy, etc.) to existing baselines

NIST 800-53 Overlay Application

Applies overlay requirements from FedRAMP, DoD, Privacy, and other specialized frameworks to NIST 800-53 baselines, identifying additional controls, parameter changes, and implementation guidance.

Usage

/nist:overlay-apply <overlay-type> <baseline> [options]

Arguments

• `$1` - Overlay type: "fedramp", "dod", "privacy", "cmmc", "cjis", "hipaa", "irs-1075"
• `$2` - Base baseline: "low", "moderate", "high"
• `$3` - Options (optional): `--output=table|ssp-text|yaml`, `--show-only-changes`

Examples

# Apply FedRAMP Moderate overlay
/nist:overlay-apply fedramp moderate

# Apply DoD IL4 requirements
/nist:overlay-apply dod moderate

# Apply Privacy overlay
/nist:overlay-apply privacy moderate

# Show only additional requirements
/nist:overlay-apply fedramp moderate --show-only-changes

# Generate SSP-ready text
/nist:overlay-apply fedramp moderate --output=ssp-text

Output

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
NIST 800-53 OVERLAY APPLICATION
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Overlay: FedRAMP Moderate
Base Baseline: NIST 800-53 Rev 5 Moderate
Authorization Type: Agency ATO (initial)
Cloud Service Model: IaaS

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
SUMMARY
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Baseline Controls: 325 controls
FedRAMP Additions: 28 controls
FedRAMP Removals: 0 controls (none)
Parameter Changes: 47 parameters
Total Required: 353 controls

Categorization:
  Low Impact: 0 controls (not applicable for Moderate)
  Moderate Impact: 353 controls
  High Impact: 0 controls (can optionally implement)

Impact Analysis:
  Effort Increase: +15% (28 additional controls)
  Cost Increase: +$35k-$50k (initial), +$15k/year (ongoing)
  Timeline Impact: +6-8 weeks (implementation)

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
FEDRAMP-SPECIFIC ADDITIONS
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

HIGH PRIORITY (Must Implement Before Assessment):

+ AC-2(12) - Account Monitoring / Atypical Usage
  Requirement: Monitor for atypical account usage
  FedRAMP Rationale: Enhanced threat detection for government data
  Implementation:
    - CloudWatch anomaly detection for IAM activity
    - GuardDuty for threat detection
    - SIEM correlation rules (Splunk, DataDog)
  Effort: 24 hours
  Cost: $500/month (GuardDuty + CloudWatch)
  Evidence: GuardDuty findings, CloudWatch dashboards

+ AC-6(9) - Auditing Use of Privileged Functions
  Requirement: Log all privileged function execution
  FedRAMP Rationale: Government requires elevated privilege audit trail
  Implementation:
    - CloudTrail logging for all admin API calls
    - Separate log stream for privileged actions
    - Tamper-proof log storage (S3 Object Lock)
  Effort: 8 hours
  Cost: $50/month (additional CloudTrail storage)
  Evidence: CloudTrail logs showing privileged events

+ AU-3(1) - Full-Text Recording of Privileged Commands
  Requirement: Record full command text for privileged operations
  FedRAMP Rationale: Forensic analysis of admin actions
  Implementation:
    - CloudTrail records full API request/response
    - Session Manager logging for SSH/RDP sessions
    - S3 bucket for long-term storage (1 year)
  Effort: 12 hours
  Cost: $100/month (storage)
  Evidence: Session logs, API call records

+ AU-4(1) - Transfer to Alternate Storage
  Requirement: Transfer audit logs to alternate/independent storage
  FedRAMP Rationale: Prevent log tampering by admins
  Implementation:
    - Cross-region CloudTrail replication
    - Separate AWS account for log aggregation
    - S3 Object Lock (compliance mode, 1 year)
  Effort: 16 hours
  Cost: $200/month (cross-region transfer + storage)
  Evidence: S3 replication configuration, Object Lock proof

+ CA-7(3) - Trend Analyses
  Requirement: Perform security trend analysis
  FedRAMP Rationale: Proactive threat identification
  Implementation:
    - CloudWatch Insights queries (weekly)
    - GuardDuty trend reports (monthly)
    - Security dashboard with 30-day trends
  Effort: 32 hours
  Cost: $300/month (CloudWatch Insights)
  Evidence: Trend analysis reports, dashboards

+ CP-9(8) - Cryptographic Protection (Backups)
  Requirement: Encrypt backups with cryptographic mechanisms
  FedRAMP Rationale: Protect backup data confidentiality
  Implementation:
    - S3 default encryption (AES-256 or KMS)
    - RDS automated backups encrypted
    - EBS snapshot encryption enabled
  Effort: 4 hours (configuration only)
  Cost: $0 (encryption is free)
  Evidence: S3/RDS/EBS encryption configs

+ IA-2(1) - Multi-Factor Authentication (Network Access)
  Requirement: MFA for all network access
  FedRAMP Rationale: Stronger authentication for government systems
  Implementation:
    - Okta MFA for all users (TOTP or Push)
    - AWS SSO MFA enforcement
    - Disable password-only access
  Effort: 8 hours
  Cost: $3/user/month (Okta MFA)
  Evidence: Okta MFA enrollment reports, IAM MFA status

+ IA-2(2) - Multi-Factor Authentication (Non-Privileged Access)
  Requirement: MFA for non-privileged accounts too
  FedRAMP Rationale: FedRAMP requires MFA for ALL accounts
  Implementation:
    - Same as IA-2(1) - applies to all users
  Effort: Included in IA-2(1)
  Cost: Included
  Evidence: MFA enforcement policy + enrollment data

+ IA-2(8) - Access to Accounts – Replay Resistant
  Requirement: Prevent replay attacks on authentication
  FedRAMP Rationale: Protect against authentication token theft
  Implementation:
    - OAuth/OIDC with short-lived tokens (Okta)
    - Session tokens with nonce
    - TLS 1.2+ for all authentication traffic
  Effort: 4 hours (verify existing implementation)
  Cost: $0 (Okta handles this)
  Evidence: Okta OAuth configuration

+ IA-2(12) - Acceptance of PIV Credentials
  Requirement: Accept PIV/CAC cards (government smart cards)
  FedRAMP Rationale: R