> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/wazuh/wazuh-dashboard-plugins/llms.txt
> Use this file to discover all available pages before exploring further.

# NIST 800-53 Compliance

> NIST Special Publication 800-53 security controls monitoring in Wazuh

## Overview

NIST Special Publication 800-53 provides a comprehensive catalog of security and privacy controls for federal information systems and organizations. Developed by the National Institute of Standards and Technology (NIST), this framework is widely adopted by government agencies and private sector organizations for risk management and security control implementation. Wazuh helps organizations monitor and assess NIST 800-53 control effectiveness through security event correlation and automated monitoring.

## NIST 800-53 Controls Coverage

Wazuh maps security events to NIST 800-53 controls through the `rule.nist_800_53` field. The compliance requirements are defined in:

**Source:** `plugins/main/common/compliance-requirements/nist-requirements.ts`

## Control Families

### Access Control (AC)

> **AC.2 - Account Management**
>
> Identifies and selects the following types of information system accounts to support organizational missions/business functions.
>
> **Control Requirements:**
>
> * Define authorized account types
> * Assign account managers
> * Establish account conditions
> * Monitor account usage
> * Authorize access appropriately
> * Review accounts periodically
> * Remove or disable unnecessary accounts
>
> **Monitored by:**
>
> * Account creation events
> * Account deletion/disabling events
> * Account modification alerts
> * Privileged account usage
> * Account lifecycle violations
>
> **Wazuh Detection:** User account changes, account provisioning events, unauthorized account creation, dormant account detection

> **AC.6 - Least Privilege**
>
> The organization employs the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions.
>
> **Control Requirements:**
>
> * Implement least privilege access
> * Restrict privileged functions
> * Audit privileged operations
> * Review privilege assignments
> * Limit elevated privileges
>
> **Monitored by:**
>
> * Privilege escalation attempts
> * Unnecessary privilege usage
> * Privileged command execution
> * Access control violations
> * Sudo and su command usage
>
> **Wazuh Detection:** Privilege abuse, unnecessary administrative access, privilege escalation attempts, sudo violations

> **AC.7 - Unsuccessful Logon Attempts**
>
> Enforces a limit of consecutive invalid logon attempts by a user during a time period.
>
> **Control Requirements:**
>
> * Define maximum failed attempts
> * Implement account lockout
> * Set lockout duration
> * Log failed attempts
> * Alert on brute force patterns
>
> **Monitored by:**
>
> * Failed authentication events
> * Account lockout events
> * Brute force attack patterns
> * Multiple failed login attempts
>
> **Wazuh Detection:** Authentication failures, brute force attacks, account lockouts, credential stuffing attempts

> **AC.12 - Session Termination**
>
> The information system automatically terminates a user session after a defined condition or event.
>
> **Control Requirements:**
>
> * Define session timeout periods
> * Implement automatic logout
> * Terminate inactive sessions
> * Log session events
>
> **Monitored by:**
>
> * Session timeout events
> * Inactive session detection
> * Session termination logs
> * Long-running session alerts
>
> **Wazuh Detection:** Session timeout violations, idle session warnings, abnormal session durations

### Audit and Accountability (AU)

> **AU.5 - Response to Audit Processing Failures**
>
> The information system alerts organization-defined personnel or roles in the event of an audit processing failure and takes organization-defined actions (e.g., shut down information system, overwrite oldest audit records, stop generating audit records).
>
> **Control Requirements:**
>
> * Define audit failure conditions
> * Identify personnel to alert
> * Specify failure response actions
> * Monitor audit system health
> * Prevent audit loss
>
> **Monitored by:**
>
> * Audit system failures
> * Log storage capacity issues
> * Logging service failures
> * Audit record loss
>
> **Wazuh Detection:** Wazuh agent failures, log collection errors, storage capacity alerts, audit system health issues

> **AU.6 - Audit Review, Analysis, and Reporting**
>
> Reviews and analyzes information system audit records for indications of inappropriate or unusual activity.
>
> **Control Requirements:**
>
> * Review audit records regularly
> * Analyze for security incidents
> * Report findings appropriately
> * Identify unusual activity patterns
> * Integrate with incident response
>
> **Monitored by:**
>
> * All security events
> * Anomalous activity patterns
> * Security incident indicators
> * Compliance violations
>
> **Wazuh Detection:** Wazuh provides the audit review mechanism through real-time analysis and alerting
>
> > [!NOTE]
> >
> > Wazuh's core functionality directly implements this control by performing continuous audit review and analysis.

> **AU.8 - Time Stamps**
>
> Uses internal system clocks to generate time stamps for audit records and records time stamps that can be mapped to Coordinated Universal Time (UTC).
>
> **Control Requirements:**
>
> * Synchronize system clocks
> * Use authoritative time sources
> * Generate accurate timestamps
> * Maintain time correlation
> * Protect time synchronization mechanisms
>
> **Monitored by:**
>
> * Time synchronization failures
> * Clock skew detection
> * NTP service status
> * Time source availability
>
> **Wazuh Detection:** NTP failures, time synchronization errors, clock drift alerts, timestamp anomalies

> **AU.9 - Protection of Audit Information**
>
> The information system protects audit information and audit tools from unauthorized access, modification, and deletion.
>
> **Control Requirements:**
>
> * Restrict audit log access
> * Protect audit tools
> * Prevent log tampering
> * Monitor audit system access
> * Implement log integrity controls
>
> **Monitored by:**
>
> * Unauthorized log access
> * Audit file modifications
> * Audit tool tampering
> * Log deletion attempts
>
> **Wazuh Detection:** File integrity monitoring on log files, unauthorized log access, log tampering attempts

> **AU.12 - Audit Generation**
>
> The information system provides audit record generation capability for auditable events, allows personnel to select which events are audited, and generates audit records.
>
> **Control Requirements:**
>
> * Define auditable events
> * Implement audit record generation
> * Allow selective auditing
> * Capture required audit data
> * Support forensic analysis
>
> **Monitored by:**
>
> * All system security events
> * Configurable event monitoring
> * Custom rule generation
>
> **Wazuh Detection:** Wazuh generates audit records for all configured events through its rule engine

### Security Assessment and Authorization (CA)

> **CA.3 - System Interconnections**
>
> Authorizes connections from the information system to other information systems through Interconnection Security Agreements, documents interface characteristics and security requirements, and reviews/updates agreements.
>
> **Control Requirements:**
>
> * Document system interconnections
> * Authorize connections
> * Define security requirements
> * Monitor connection usage
> * Review agreements regularly
>
> **Monitored by:**
>
> * Unauthorized network connections
> * New system interconnections
> * Unusual network traffic
> * Inter-system communication
>
> **Wazuh Detection:** Unauthorized network connections, new network services, unusual inter-system traffic

### Configuration Management (CM)

> **CM.1 - Configuration Management Policy and Procedures**
>
> Develops, documents, and disseminates a configuration management policy. Reviews and updates the current configuration management policy and procedures.
>
> **Control Requirements:**
>
> * Establish CM policy
> * Define CM procedures
> * Document configuration standards
> * Review and update regularly
> * Disseminate to stakeholders
>
> **Monitored by:**
>
> * Configuration changes
> * Policy violations
> * Unauthorized modifications
>
> **Wazuh Detection:** Configuration file changes, policy violation alerts, unauthorized system modifications

> **CM.3 - Configuration Change Control**
>
> The organization determines the types of changes to the information system that are configuration-controlled.
>
> **Control Requirements:**
>
> * Define configuration items
> * Establish change control process
> * Review change requests
> * Document changes
> * Test changes before implementation
> * Track configuration baselines
>
> **Monitored by:**
>
> * System configuration changes
> * Unauthorized modifications
> * Configuration baseline deviations
> * Change control violations
>
> **Wazuh Detection:** File integrity monitoring alerts, system configuration changes, unauthorized modifications

> **CM.5 - Access Restrictions for Change**
>
> The organization defines, documents, approves, and enforces physical and logical access restrictions associated with changes to the information system.
>
> **Control Requirements:**
>
> * Restrict change access
> * Define authorized personnel
> * Enforce change controls
> * Monitor change activities
> * Audit configuration changes
>
> **Monitored by:**
>
> * Unauthorized change attempts
> * Configuration modification events
> * Access control violations during changes
>
> **Wazuh Detection:** Unauthorized configuration changes, privilege abuse during changes, access violations

### Identification and Authentication (IA)

> **IA.4 - Identifier Management**
>
> The organization manages information system identifiers by receiving authorization, selecting appropriate identifiers, assigning to intended entity, preventing reuse, and disabling after period of inactivity.
>
> **Control Requirements:**
>
> * Authorize identifier assignment
> * Select unique identifiers
> * Prevent identifier reuse
> * Disable inactive identifiers
> * Monitor identifier lifecycle
>
> **Monitored by:**
>
> * Identifier creation/deletion
> * Duplicate identifier detection
> * Inactive identifier usage
> * Unauthorized identifier changes
>
> **Wazuh Detection:** Account lifecycle events, duplicate user detection, inactive account usage

> **IA.5 - Authenticator Management**
>
> The organization manages information system authenticators by verifying identity, establishing initial authenticator content, ensuring sufficient strength, and establishing administrative procedures.
>
> **Control Requirements:**
>
> * Verify identity before issuing
> * Establish authenticator strength
> * Protect authenticator content
> * Change default authenticators
> * Implement password policies
> * Monitor authenticator compromise
>
> **Monitored by:**
>
> * Weak password usage
> * Default credential usage
> * Authenticator changes
> * Compromised credential detection
>
> **Wazuh Detection:** Weak authentication attempts, default credential usage, authentication policy violations

> **IA.10 - Adaptive Identification and Authentication**
>
> The organization requires that individuals accessing the information system employ organization-defined supplemental authentication techniques or mechanisms under specific circumstances or situations.
>
> **Control Requirements:**
>
> * Define high-risk scenarios
> * Implement adaptive authentication
> * Require additional factors when needed
> * Monitor authentication context
> * Adjust security based on risk
>
> **Monitored by:**
>
> * High-risk access attempts
> * Geographic anomalies
> * Unusual access patterns
> * Multi-factor authentication events
>
> **Wazuh Detection:** Anomalous login locations, unusual access times, high-risk authentication patterns

### System and Services Acquisition (SA)

> **SA.11 - Developer Security Testing and Evaluation**
>
> The organization requires the developer of the information system, system component, or information system service to create and implement a security assessment plan.
>
> **Control Requirements:**
>
> * Require security testing
> * Define assessment criteria
> * Review test results
> * Address identified flaws
> * Conduct penetration testing
>
> **Monitored by:**
>
> * Application security events
> * Code vulnerability exploitation
> * Security testing activities
> * Flaw remediation tracking
>
> **Wazuh Detection:** Application attacks, exploitation attempts, security testing artifacts, vulnerability exploitation

### System and Communications Protection (SC)

> **SC.2 - Application Partitioning**
>
> The information system separates user functionality (including user interface services) from information system management functionality.
>
> **Control Requirements:**
>
> * Separate user and admin functions
> * Implement role-based interfaces
> * Restrict management access
> * Monitor privilege usage
>
> **Monitored by:**
>
> * Management function access
> * Privilege usage patterns
> * Separation violations
>
> **Wazuh Detection:** Management interface access from user contexts, privilege boundary violations

> **SC.7 - Boundary Protection**
>
> The information system monitors and controls communications at the external boundary of the system and at key internal boundaries within the system.
>
> **Control Requirements:**
>
> * Define security boundaries
> * Implement boundary controls
> * Monitor boundary traffic
> * Control information flows
> * Deploy managed interfaces
>
> **Monitored by:**
>
> * Boundary crossing attempts
> * Firewall events
> * Network perimeter violations
> * Unauthorized external connections
>
> **Wazuh Detection:** Firewall alerts, boundary violation attempts, unauthorized network traffic

> **SC.8 - Transmission Confidentiality and Integrity**
>
> The information system protects the confidentiality and integrity of transmitted information.
>
> **Control Requirements:**
>
> * Implement encryption for transmission
> * Use secure protocols
> * Protect data in transit
> * Verify transmission integrity
> * Prevent interception
>
> **Monitored by:**
>
> * Unencrypted transmissions
> * Insecure protocol usage
> * Man-in-the-middle attempts
> * Data transmission integrity failures
>
> **Wazuh Detection:** Unencrypted connections, insecure protocol usage (HTTP, FTP, Telnet), transmission security violations

### System and Information Integrity (SI)

> **SI.2 - Flaw Remediation**
>
> The organization identifies, reports, and corrects information system flaws; tests software and firmware updates for effectiveness; and installs security-relevant updates within organization-defined time period.
>
> **Control Requirements:**
>
> * Identify system flaws
> * Report vulnerabilities
> * Test patches and updates
> * Install updates timely
> * Verify remediation effectiveness
> * Track flaw remediation
>
> **Monitored by:**
>
> * Vulnerability detection
> * Missing patch detection
> * Unpatched system identification
> * Exploitation attempts on known flaws
>
> **Wazuh Detection:** Vulnerability scanner integration, missing patch alerts, exploitation attempts, outdated software detection

> **SI.3 - Malicious Code Protection**
>
> The organization employs malicious code protection mechanisms at information system entry and exit points to detect and eradicate malicious code.
>
> **Control Requirements:**
>
> * Deploy anti-malware solutions
> * Update malware signatures
> * Scan files and downloads
> * Monitor for malicious activity
> * Quarantine detected threats
> * Configure automatic updates
>
> **Monitored by:**
>
> * Malware detection events
> * Anti-virus status
> * Signature update failures
> * Malicious code execution
> * Ransomware activity
>
> **Wazuh Detection:** Malware alerts, virus detection, ransomware indicators, anti-virus events, suspicious file execution

> **SI.7 - Software, Firmware, and Information Integrity**
>
> The organization employs integrity verification tools to detect unauthorized changes to organization-defined software, firmware, and information.
>
> **Control Requirements:**
>
> * Implement integrity monitoring
> * Define critical files
> * Detect unauthorized changes
> * Alert on integrity violations
> * Use cryptographic hashes
> * Verify code signatures
>
> **Monitored by:**
>
> * File integrity violations
> * Unauthorized file modifications
> * System file changes
> * Critical file alterations
>
> **Wazuh Detection:** File Integrity Monitoring (FIM) alerts, unauthorized system changes, binary modifications, configuration tampering
>
> > [!TIP]
> >
> > Enable Wazuh FIM on critical system directories, binaries, and configuration files to implement this control.

## Using the NIST 800-53 Dashboard

### Accessing NIST 800-53 Compliance View

**1. Open NIST Module**

Navigate to the NIST 800-53 section in the Wazuh Dashboard overview.

**2. Review Control Families**

The dashboard displays controls organized by family (AC, AU, CA, CM, IA, SA, SC, SI).

**3. Filter by Control Family**

Click on control family categories to view specific controls.

**4. Analyze Control Effectiveness**

Review security events indicating control failures or violations.

### Dashboard Components

The NIST 800-53 dashboard includes:

* **Top controls by alert count** - Identifies controls with most violations
* **Control family distribution** - Shows coverage across control families
* **Control effectiveness metrics** - Tracks control implementation success
* **Compliance trend analysis** - Historical view of control adherence

**Source:** `plugins/main/public/components/overview/nist/dashboards/dashboard-panels.ts`

### Data Source Implementation

The NIST 800-53 data source filters events by the `rule.nist_800_53` field:

```typescript theme={null}
const KEY_EXIST = 'rule.nist_800_53';
```

**Reference:** `plugins/main/public/components/common/data-source/pattern/events/nist-800-53/nist-800-53-data-source.ts:5`

## Event Columns

NIST 800-53 events table displays:

* Timestamp
* Rule description
* **NIST 800-53 control** (`rule.nist_800_53` field)
* Alert level
* Control family
* Agent information

**Source:** `plugins/main/public/components/overview/nist/events/nist-columns.tsx:8`

## Compliance Reporting for NIST 800-53

### Control Naming Convention

NIST 800-53 controls follow the pattern `[FAMILY].[NUMBER]`:

* **AC.2** - Access Control family, control #2
* **AU.6** - Audit and Accountability family, control #6
* **SI.7** - System and Information Integrity family, control #7

### Generating NIST 800-53 Reports

**1. Define Assessment Period**

Select the date range for the NIST 800-53 assessment.

**2. Select Control Baseline**

Focus on controls from your baseline (Low, Moderate, or High).

**3. Filter by Control Family**

Generate reports by control family for organized assessments.

**4. Document Control Effectiveness**

Export evidence of control implementation and effectiveness.

**5. Include Continuous Monitoring Data**

Demonstrate ongoing control effectiveness through historical data.

## Control Baselines

NIST 800-53 defines three security control baselines:

**Low-Impact Systems**

Minimal controls for low-impact systems where loss would have limited adverse effects.

**Key Controls:**

* AC.2, AC.7, AU.6, AU.8, SI.3, SI.7

Wazuh helps monitor baseline low controls effectively.

**Moderate-Impact Systems**

Enhanced controls for moderate-impact systems where loss would have serious adverse effects.

**Key Controls:**

* All Low controls plus AC.6, AU.5, AU.9, AU.12, CM.3, IA.5

Wazuh provides comprehensive monitoring for moderate baseline.

**High-Impact Systems**

Comprehensive controls for high-impact systems where loss would have severe or catastrophic adverse effects.

**Key Controls:**

* All Moderate controls plus IA.10, CA.3, CM.5, SA.11, SC.7, SC.8

Wazuh supports high baseline implementation monitoring.

## Continuous Monitoring

NIST 800-53 requires continuous monitoring of security controls. Wazuh provides:

> **Real-time Control Assessment**
>
> Continuous evaluation of control effectiveness through real-time event monitoring.

> **Automated Reporting**
>
> Generate control assessment reports showing compliance status over time.

> **Deviation Detection**
>
> Immediate alerts when controls fail or are bypassed.

> **Trend Analysis**
>
> Historical view of control effectiveness and compliance trends.

## Integration with Risk Management Framework (RMF)

Wazuh supports NIST RMF phases:

| RMF Step | Wazuh Support |
| - | - |
| **Categorize** | Identify system impact level for control selection |
| **Select** | Map Wazuh rules to required NIST 800-53 controls |
| **Implement** | Deploy monitoring for implemented controls |
| **Assess** | Use Wazuh data to assess control effectiveness |
| **Authorize** | Provide evidence for authorization decision |
| **Monitor** | Continuous monitoring through real-time alerting |

## Control Overlays and Tailoring

Wazuh supports monitoring for various NIST 800-53 overlays:

* **Privacy Overlay** - Controls for protecting PII
* **Cloud Computing Overlay** - Controls for cloud environments
* **Industrial Control Systems (ICS) Overlay** - Controls for SCADA/ICS

## Crosswalk with Other Frameworks

NIST 800-53 maps to other frameworks monitored by Wazuh:

| NIST 800-53 | PCI DSS | HIPAA | GDPR |
| - | - | - | - |
| AU.9 | 10.5.2 | - | IV\_32.2 |
| SI.7 | 11.5 | 164.312.c.2 | II\_5.1.f |
| SI.3 | 5.1, 5.2 | - | IV\_35.7.d |
| AC.7 | 8.1.6 | 164.312.a.2.I | IV\_32.2 |

**Reference:** `plugins/main/common/dashboards/dashboard-definitions/overview/nist/vis-states.ts:1051`

## Requirement Data Structure

The complete NIST 800-53 requirements mapping:

```typescript theme={null}
export const nistRequirementsFile = {
  'AC.2': 'ACCOUNT MANAGEMENT - Identifies and selects...',
  'AC.6': 'LEAST PRIVILEGE - Employs the principle...',
  'AC.7': 'UNSUCCESSFUL LOGON ATTEMPTS - Enforces a limit...',
  'AC.12': 'SESSION TERMINATION - Automatically terminates...',
  'AU.5': 'RESPONSE TO AUDIT PROCESSING FAILURES...',
  'AU.6': 'AUDIT REVIEW, ANALYSIS, AND REPORTING...',
  'AU.8': 'TIME STAMPS - Uses internal system clocks...',
  'AU.9': 'PROTECTION OF AUDIT INFORMATION...',
  'AU.12': 'AUDIT GENERATION - Provides audit record...',
  'CA.3': 'SYSTEM INTERCONNECTIONS - Authorizes connections...',
  'CM.1': 'CONFIGURATION MANAGEMENT POLICY...',
  'CM.3': 'CONFIGURATION CHANGE CONTROL...',
  'CM.5': 'ACCESS RESTRICTIONS FOR CHANGE...',
  'IA.4': 'IDENTIFIER MANAGEMENT...',
  'IA.5': 'AUTHENTICATOR MANAGEMENT...',
  'IA.10': 'ADAPTIVE IDENTIFICATION AND AUTHENTICATION...',
  'SA.11': 'DEVELOPER SECURITY TESTING...',
  'SC.2': 'APPLICATION PARTITIONING...',
  'SC.7': 'BOUNDARY PROTECTION...',
  'SC.8': 'TRANSMISSION CONFIDENTIALITY AND INTEGRITY...',
  'SI.2': 'FLAW REMEDIATION...',
  'SI.3': 'MALICIOUS CODE PROTECTION...',
  'SI.7': 'SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY...',
};
```

**Full definition:** `plugins/main/common/compliance-requirements/nist-requirements.ts:12`

## Best Practices

> **Focus on Your Baseline**
>
> Prioritize monitoring controls from your applicable baseline (Low, Moderate, or High).

> **Enable FIM for SI.7**
>
> Use file integrity monitoring to implement control SI.7 effectively.

> **Continuous Monitoring**
>
> Leverage Wazuh for NIST-required continuous monitoring (control CA-7).

> **Control Tailoring**
>
> Customize Wazuh rules to align with your organization's control tailoring.

> **Integration with POA\&M**
>
> Use Wazuh alerts to track control weaknesses in your Plan of Action & Milestones.

> **Regular Assessments**
>
> Generate periodic control assessment reports for RMF compliance.

## Related Documentation

* [Compliance Overview](/compliance/overview)
* \[File Integrity Monitoring(/modules/file-integrity-monitoring) - Implements SI.7
* \[Log Analysis(/modules/threat-hunting) - Implements AU.6
* \[Vulnerability Detection(/modules/vulnerability-detection) - Supports SI.2
* \[Incident Response(/guides/threat-analysis) - Supports IR family controls


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.