NIST 800-53: Introduction to Security and Privacy Controls

This course will provide Executives, Assessors, Analysts, System Administrators and students with the foundational knowledge to understand NIST 800-53 Security and Privacy Controls. In this course, we will learn how 800-53 fits into the Risk Management Framework (RMF) since the knowledge is fundamental to understanding the importance of the security controls. After studying the steps in RMF, students will discover the history of the 800-53 document based on the revisions to the original. Understanding the history is essential since cybersecurity professionals may work at an organization that has not adopted the latest revision. After gaining the foundational knowledge of 800-53, students will delve into the components and structure of the security controls. The structure includes the control families and the reason NIST organized the controls to meet FIPS 200 guidance. After learning about the control family organization, we will discuss the differences between system, hybrid, and common controls since this hierarchical implementation of security delineates the boundaries of responsibility within an organization. With an understanding of the families, organization, and types of security controls, students are ready to learn about the internal structure of the 800-53 controls. Finally, we will learn about how cybersecurity professionals will encounter security controls, such as System Security Plans (SSP), Plan of Actions & Milestones (POA&M), risk assessments, or reports from automated security tools.

Course syllabus:

  1. Module 1: Getting to Know 800-53

  2. Module 2: Understanding 800-53 Controls

  3. Module 3: Conclusion

  4. Module 4: Course Assessment