U.S. National Institute of Standards and Technology · Revision 5

NIST SP 800-53 Rev. 5 Security and Privacy Controls: real-world incidents for each item

Control SA-15(8) asks developers to use threat and vulnerability analyses from similar systems to inform current development. That is exactly what a CollectSEA analysis does before implementation starts; the controls below are the ones each failure pattern exercises.

Official NIST SP 800-53
  1. SA-15(8)

    Reuse of Threat and Vulnerability Information

    Use threat modeling and vulnerability analyses from similar systems, components or services to inform the current development process.

    Applies to every failure pattern: each CollectSEA analysis is a way to carry out this item. See all patterns.

  2. AC-3

    Access Enforcement

    Enforce approved authorizations for access to information and system resources.

    and 13 more in the linked patterns.

  3. AC-4

    Information Flow Enforcement

    Control how information flows within and between systems.

    and 3 more in the linked patterns.

  4. AC-5

    Separation of Duties

    Separate duties so no single actor can complete a high-impact action alone.

    and 2 more in the linked patterns.

  5. AC-6

    Least Privilege

    Allow only the access users and processes need for their tasks.

    and 5 more in the linked patterns.

  6. AU-3

    Content of Audit Records

    Audit records establish what happened, when, where, the source, the outcome and the identity involved.

    and 2 more in the linked patterns.

  7. CM-3

    Configuration Change Control

    Review, approve, test and document changes to the system.

    and 2 more in the linked patterns.

  8. CM-4

    Impact Analyses

    Analyze changes to determine potential security and privacy impacts before implementation.

    and 2 more in the linked patterns.

  9. CP-9

    System Backup

    Back up information and protect the backups.

    and 2 more in the linked patterns.

  10. CP-10

    System Recovery and Reconstitution

    Recover and reconstitute the system to a known state after disruption or failure.

    and 2 more in the linked patterns.

  11. IA-2

    Identification and Authentication

    Uniquely identify and authenticate users, including multi-factor authentication for privileged accounts.

    and 2 more in the linked patterns.

  12. RA-5

    Vulnerability Monitoring and Scanning

    Monitor and scan for vulnerabilities and remediate them.

    and 2 more in the linked patterns.

  13. SC-5

    Denial-of-Service Protection

    Protect against or limit the effects of denial-of-service events.

    and 2 more in the linked patterns.

  14. SC-7

    Boundary Protection

    Monitor and control communications at external and key internal boundaries.

    and 2 more in the linked patterns.

  15. SC-24

    Fail in Known State

    Fail to a known, secure state when failures occur.

  16. SI-2

    Flaw Remediation

    Identify, report and correct system flaws within defined time periods.

    and 2 more in the linked patterns.

  17. SI-10

    Information Input Validation

    Check the validity of information inputs.

    and 3 more in the linked patterns.

Mappings are CollectSEA's own analysis and are not produced or endorsed by U.S. National Institute of Standards and Technology. Item names and summaries paraphrase the official text; consult the source for the authoritative wording.