Skip to content

v0.6.8 - NIST 800-53 Rev 5 Mapping Support

Choose a tag to compare

View all tags
@mrmez mrmez released this 14 Oct 03:09
· 78 commits to main since this release
v0.6.8
2b11aab

Release Date: October 13, 2025

What's New

NIST 800-53 Rev 5 Framework Crosswalk

AuditKit now supports NIST 800-53 Rev 5 scanning through an intelligent framework crosswalk system. Instead of building entirely new checks, we map your existing SOC2, PCI-DSS, and CMMC controls to NIST 800-53 control families.

Quick Example:

# Scan your AWS environment with 800-53 mapping
./auditkit scan -provider aws -framework 800-53

# See results with NIST control IDs
✓ Mapped CC6.6 → IA-2, IA-2(1), IA-5
✓ Mapped CC7.1 → AU-2, AU-3, AU-12
✓ Mapped CC6.1 → AC-2, AC-3, AC-17

[FAIL] IA-2, IA-2(1), IA-5 - Authentication Controls (via CC6.6)
[FAIL] AU-2, AU-3, AU-12 - Audit Logging (via CC7.1)
[FAIL] AC-2, AC-3, AC-17 - Access Controls (via CC6.1)

What You Get

Automated Technical Checks (~150 controls)

Control Families Covered:

  • Access Control (AC): 12 automated checks
  • Audit and Accountability (AU): 15 automated checks
  • Identification and Authentication (IA): 18 automated checks
  • System and Communications Protection (SC): 22 automated checks
  • System and Information Integrity (SI): 14 automated checks
  • Plus 14 more families: CA, CM, IR, MA, MP, PE, PL, PM, PS, RA, SA, SR (3-8 checks each)

Framework Crosswalk Mappings

The crosswalk intelligently maps:

  • SOC2 → 800-53: CC6.6 (MFA) → IA-2, IA-2(1), IA-5
  • PCI-DSS → 800-53: Requirement 8.3.1 (MFA) → IA-2(1), IA-5(1)
  • CMMC → 800-53: AC.L1-3.1.1 → AC-2, AC-3

Report Generation

  • PDF reports with 800-53 control IDs and evidence checklists
  • HTML reports with interactive control navigation
  • Shows source control so you know where the mapping came from

How It Works

1. Framework Crosswalk Engine

New pkg/mappings/crosswalk.go provides intelligent control mapping:

// Check if a control has 800-53 mappings
if crosswalk.ControlHas800_53(control.Frameworks, control.ID) {
    // Get the NIST 800-53 IDs
    nist80053IDs := crosswalk.Get800_53String(control.Frameworks, control.ID)
    // Result: "IA-2, IA-2(1), IA-5"
}

2. Dual Lookup Strategy

Primary: Uses your control's framework mappings

Frameworks: map[string]string{
    "SOC2": "CC6.6",
    "PCI":  "8.3.1",
}
// Crosswalk looks up: SOC2 CC6.6 → IA-2, IA-2(1), IA-5

Fallback: Uses control ID directly

Control: "CC6.6"
// Crosswalk looks up: CC6.6 → IA-2, IA-2(1), IA-5

This means all controls get mapped, even if they don't have explicit framework mappings!

3. Clean Output

Control IDs are cleaned and truncated for readability:

  • Long IDs (>60 chars) truncated to prevent page overflow
  • Unicode characters (→, •, —) converted to ASCII
  • Source control shown in parentheses: "(via CC6.6)"

Important Limitations

What's NOT Included (FREE Version)

Organizational Controls (~850 controls)

  • Policies and procedures
  • Training records and documentation
  • Risk assessments and management plans
  • Business continuity and disaster recovery
  • Physical security controls
  • Third-party assessments

These require manual documentation and cannot be automated.

What's NOT Included (Any Version)

This is not:

  • A complete NIST 800-53 certification tool
  • A FedRAMP authorization package
  • A replacement for security assessors
  • A vulnerability scanner

This IS:

  • An automated technical control checker
  • A gap analysis tool for 800-53 readiness
  • A mapping between SOC2/PCI/CMMC and 800-53
  • A starting point for 800-53 compliance

Getting Started

Installation

# Clone and build
git clone https://github.com/guardian-nexus/auditkit
cd auditkit/scanner
go build ./cmd/auditkit

# Or download from releases
wget https://github.com/guardian-nexus/auditkit/releases/download/v0.6.8/auditkit-linux-amd64
chmod +x auditkit-linux-amd64

Basic Usage

# Run 800-53 scan
./auditkit scan -provider aws -framework 800-53

# Verbose output with mapping details
./auditkit scan -provider aws -framework 800-53 -verbose

# Generate PDF report
./auditkit scan -provider aws -framework 800-53 -format pdf -output report.pdf

# See all controls (no truncation)
./auditkit scan -provider aws -framework 800-53 --full

Azure Support

# Configure Azure credentials
az login
export AZURE_SUBSCRIPTION_ID="your-subscription-id"

# Run 800-53 scan on Azure
./auditkit scan -provider azure -framework 800-53

What's Changed

New Files

  • pkg/mappings/crosswalk.go - Framework crosswalk engine
  • pkg/mappings/framework-crosswalk.yaml - Control mappings database

Modified Files

  • cmd/auditkit/main.go - Added 800-53 framework validation and filtering
  • pkg/report/pdf.go - Added 800-53 report sections and control ID handling
  • pkg/report/html.go - Added 800-53 framework label support

New Functions

  • Get800_53ByControlID() - Direct control ID to 800-53 lookup
  • Get800_53StringByControlID() - Formatted string output
  • ControlHas800_53() - Check if control has 800-53 mapping
  • Get800_53String() - Get comma-separated 800-53 IDs
  • cleanString() - Unicode character cleanup for PDFs

Bug Fixes

  • Fixed PDF generation errors with long control IDs (now truncated at 60 chars)
  • Fixed unicode character handling in control names and evidence text
  • Fixed framework detection for controls without explicit framework mappings
  • Improved error handling when crosswalk YAML fails to load

Breaking Changes

None. This release is fully backward compatible. Existing scans (SOC2, PCI, CMMC, HIPAA) work exactly as before.

What's Next

Planned Features

  • v0.7.0: Prowler integration for complete 1000+ control coverage
  • v0.7.1: GCP provider support
  • v0.8.0: FedRAMP baseline analysis (LOW/MODERATE/HIGH)
  • v0.9.0: Kubernetes compliance scanning

Community Requests

See our roadmap for planned features and vote on what you'd like to see next.

Assets 8
Loading