Automation Support for Security Control Assessments: Software Asset Management

The National Institute of Standards and Technology (NIST) and the Department of Homeland Security (DHS) have collaborated to produce this report which describes a process that automates the test assessment method described in NIST Special Publication (SP) 800-53A for the security controls catalogued in SP 800-53. The process is consistent with the Risk Management Framework as described in SP 800-37 and the Information Security Continuous Monitoring (ISCM) guidance in SP 800-137. The multi-volume NIST Interagency Report 8011 (NISTIR 8011) has been developed to provide information on automation support for ongoing assessment. NISTIR 8011 describes how ISCM facilitates automated ongoing assessment to provide near real-time security-related information to organizational officials on the security posture of individual systems and the organization as a whole.