NIST publishes draft guidance update on automating tests for continuous monitoring controls

The National Institute of Standards and Technology is asking stakeholders for feedback on the first updated draft volume of a publication on automating assessments for continuous monitoring and cybersecurity controls from NIST Special Publication 800-53, as part of a process to modernize guidance related to the NIST risk management framework.

NIST Internal Report 8011 “provides a methodology for identifying testable controls from the Special Publication (SP) 800-53 control catalog that share common defense objectives in support of information security continuous...