NIST Compliance Framework

The National Institute of Standards and Technology (NIST) 800-26 provides a unified security framework that enables government organizations to achieve secure IT system security and compliance.

The NIST standards, NIST SP 53 and SP 26, have been widely adopted by both Federal agencies and commercial organizations to improve security controls for information systems supporting the executive agencies of the federal government. These guidelines apply to all components of an information system that process, store, or transmit federal information.

Rsam for NIST Compliance Framework Assessments

Rsam's NIST template is based on SP 800-26 Security Self-Assessment Guide for Information Technology Systems, SP 800-53 Recommended Security Controls for Federal Information Systems and other related documents. Each assessment area in Rsam is carefully mapped to NIST standards and guidelines, allowing organizations to easily conduct an assessment against NIST.

Rsam measures assessment responses against NIST guidelines, performs scoring and identified gaps. Once gaps and compliance violations are known, the Rsam Issue & Remediation module automates the remediation process. Dashboards provide constant progress updates and pre-built reports provide detailed and high-level views of the organization's compliance status.

Key Features:

While a standards-based compliance approach can be a daunting undertaking, compliance professionals recognize that automating the process with a scalable and effective GRC tool can make it more manageable. The Rsam solution for standards-based compliance helps organizations:

• Establish, enforce and manage a consistent standards based program on individual business criticality and compliance requirements.
• Utilize measurable controls for each standard's domain. Easily create and assign additional assessment questionnaires.
• Distribute & gather data via online questionnaires using an intuitive, user-friendly Web interface
• Analyze & report on gaps for the entire enterprise, business unit, department or any logical grouping
• Manage & track remediation plans after gaps have been identified
• Demonstrate compliance by assessing a representative sample of applications, processes, infrastructure elements, data centers, third-party service providers (TSP) and more