# NIST 800-53: Advanced Assessment, Tailoring, and Enterprise Program Management Course Canonical URL: ## Overview This advanced course moves participants from knowing what NIST 800-53 controls require to being able to apply, assess, tailor, and manage them across an enterprise. Participants run deep-dive control assessments using 800-53A procedures, reach organization-defined parameter (ODP) tailoring decisions and document the rationale behind them, construct program-level control overlays for specialized environments, judge control effectiveness with automated tooling, and lay out enterprise control governance programs. A single running scenario — an agency in the middle of a major system deployment with substantial cloud and OT components — carries through the entire course, and participants work it in sequence alongside the instructor. ## What you'll learn - Carry out full control assessments with NIST SP 800-53A procedures across all 20 control families. - Reach Organization-Defined Parameter (ODP) tailoring decisions and record the risk-based reasoning behind each one. - Construct a control overlay for a specialized system type — cloud, OT, AI/ML, or privacy-intensive — and justify every deviation. - Put automated assessment tooling to work, including SCAP, STIG checklists, and vulnerability scanners, and fold the output into manual 800-53A evidence. - Judge privacy control implementation across the PT and IP families and write up privacy risk findings. - Lay out an enterprise control inheritance architecture with Common Control Providers and the inheritance documentation to support it. - Connect 800-53 controls to NIST CSF, FedRAMP, CMMC, and sector-specific frameworks through a control mapping analysis. - Run a control program end to end: governance structure, control ownership assignments, and continuous improvement processes. ## Curriculum #### Module 1: Advanced Control Assessment Methodology – 800-53A Deep Dive - 800-53A assessment procedure structure: assessment objectives, determination statements, and potential assessment methods. - Examine, interview, and test: evidence sufficiency standards and documentation requirements for each method. - Assessment case mapping: linking determination statements to control implementations and evidence artifacts. - Depth and coverage parameters: what ‘basic,’ ‘focused,’ and ‘comprehensive’ assessment mean in practice. - Common assessment failures: scope gaps, evidence insufficiency, and other-than-satisfied determination errors. #### Module 2: Organization-Defined Parameters – Advanced Tailoring Decisions - ODP taxonomy: selection ODPs, assignment ODPs, and their impact on control meaning and assessment. - Risk-based ODP rationale: what makes an ODP defensible vs. arbitrary, and documentation standards. - High-risk ODPs: AC-2(j) account review frequency, AU-11 audit log retention, CA-7 monitoring frequency, SI-3 malicious code scanning. - ODP consistency across the SSP: ensuring related controls use compatible parameters and document dependencies. - AO-level ODP decisions: which ODPs require Authorizing Official approval vs. ISSO-level determination. #### Module 3: Control Tailoring, Scoping Guidance, and Compensating Controls - Scoping considerations: technology-related, physical infrastructure, public access, scalable, and common control scoping. - Compensating controls: when they’re allowed, documentation requirements, and assessment of compensating control effectiveness. - Control not applicable (NA) determinations: criteria, documentation, and AO approval requirements. - Parameter-based tailoring vs. control removal: the difference in risk exposure and documentation burden. - Overlay interaction with tailoring: how overlays override baseline tailoring and the precedence hierarchy. #### Module 4: Cross-Family Control Integration and Dependency Analysis - Control dependencies: how failures in foundational controls (AC-2, IA-5, AU-2) cascade to dependent controls. - Defense-in-depth architecture through 800-53: mapping layered controls across access, boundary, and audit families. - Control synergies: how complementary controls create compounding protection when implemented together. - Inherited control gaps: identifying where inheritance assumptions break and system-specific controls must compensate. - Control interaction with architecture: how architectural decisions (cloud, zero trust, microservices) change control applicability. #### Module 5: Control Overlays – Building and Applying Specialized Control Sets - NIST overlay concept: what overlays are, who creates them, and how they interact with Low/Moderate/High baselines. - Published federal overlays: Intelligence Community, DoD, privacy, cloud, ICS/OT, and AI/ML overlays. - Building a custom overlay: scope definition, control additions, parameter constraints, and implementation guidance format. - Overlay documentation requirements: purpose, applicability, tailoring rationale, and AO approval process. - Overlay application in assessment: how assessors treat overlay-added controls vs. baseline controls. #### Module 6: Automated Control Assessment – SCAP, STIGs, and Vulnerability Integration - SCAP content: XCCDF checklists, OVAL definitions, and CPE dictionaries, including structure and federal use. - DISA STIGs and SRGs: scope, applicability, and how STIG findings map to 800-53 control deficiencies. - Nessus/ACAS automated scanning: scan configuration, authenticated vs. unauthenticated scans, and result interpretation. - Integrating automated findings with 800-53A evidence: correlation, deduplication, and manual validation requirements. - Automation limitations: what scanners miss and why manual assessment remains essential for high-impact controls. #### Module 7: Privacy Controls – PT and IP Family Deep Dive - PT (PII Processing and Transparency) family: PT-1 through PT-8, including purpose, implementation, and assessment approaches. - Privacy risk assessment integration with security assessment: joint assessment planning and finding coordination. - System of Records Notice (SORN) and Privacy Impact Assessment (PIA) as control evidence: what ISSOs must verify. - Coordinating with agency Privacy Officers: roles, evidence handoffs, and joint finding resolution. #### Module 8: Specialized Environment Application – Cloud, OT, and AI/ML Control Sets - Cloud control application: FedRAMP-specific control enhancements, inherited control documentation, and CSP assessment evidence. - OT/ICS control tailoring: 800-82 overlay application, availability-first parameter adjustments, and compensating controls for legacy PLCs. - AI/ML control application: SA-8 security and privacy engineering principles applied to AI systems, SR family supply chain controls for models, and AI-specific awareness and training considerations. - Mobile and remote work control application: AC-20, IA-3, and SC-8 enhanced parameters for dispersed workforce environments. - Multi-environment system challenges: when a single system spans cloud, on-prem, and OT, including boundary and inheritance documentation. #### Module 9: Enterprise Control Inheritance Architecture and Common Control Providers - Common Control Provider (CCP) roles: agency-level, program-level, and site-level CCPs and their authorization relationships. - Inheritable control catalog: developing and maintaining an agency’s catalog of available inherited controls. - Inheritance documentation: how SSPs reference inherited controls, what evidence is required, and when inheritance breaks down. - Control inheritance gaps: identifying when an inherited control doesn’t fully satisfy a system’s implementation requirements. - CCP authorization: how CCPs maintain their own authorization and what triggers a CCP reauthorization that cascades to inheriting systems. #### Module 10: Cross-Framework Control Mapping – CSF, FedRAMP, CMMC, and Sector Requirements - NIST CSF to 800-53 mapping: using NIST’s published crosswalk to satisfy CSF outcomes through control implementation. - FedRAMP control baseline differences: FedRAMP-specific parameter requirements and how they interact with agency tailoring. - CMMC Level 2 mapping: satisfying CMMC requirements through existing 800-53 implementations, by way of the SP 800-171 requirements that CMMC draws on. - HIPAA, PCI DSS, and sector-specific requirements: using 800-53 as a common framework to satisfy multiple compliance obligations. - Cross-framework efficiency: designing a single control implementation that satisfies multiple framework requirements simultaneously. #### Module 11: Control Program Governance, Ownership, and Continuous Improvement - Control ownership model: assigning system owner, ISSO, and operational owner responsibilities for each control family. - Control evidence management: documentation standards, evidence retention policies, and audit-ready file organization. - Control program metrics: measuring implementation completeness, assessment coverage, and finding remediation velocity. - Continuous control improvement: feeding assessment findings, incident data, and threat intelligence into control enhancement cycles. - CISO-level program governance: control steering committee, ODP standardization decisions, and enterprise policy management. #### Module 12: Capstone – Full Control Program Simulation - Capstone scenario overview: agency undergoing major system deployment, FedRAMP transition, OT component addition, and upcoming assessment. - Integration challenge: applying advanced tailoring, overlays, inheritance architecture, and cross-framework mapping to a single complex program. - Program leadership decision-making: assessment prioritization, resource allocation, and risk acceptance sequencing. - After-action and improvement planning: translating simulation outcomes into real-world program improvements. ## Schedule - Jan 20, 2027 – Jan 22, 2027 — Live Online - Feb 23, 2027 – Feb 25, 2027 — Live Online - Mar 17, 2027 – Mar 19, 2027 — Live Online - Apr 9, 2027 – Apr 13, 2027 — Live Online - May 5, 2027 – May 7, 2027 — Live Online - Jun 28, 2027 – Jun 30, 2027 — Live Online - Jul 20, 2027 – Jul 22, 2027 — Live Online ## Instructors ### Wes Bryan — Instructor Wes Bryan resides in Gainesville, Florida, and has built his career around technology, education, and helping others understand complex subjects. He values continuous learning, clear communication, and practical problem-solving. Outside of work, Wesley enjoys running, hiking, fishing, and spending time outdoors. He also has a strong interest in music and literature, enjoys reading both fiction and nonfiction, as well as playing guitar. ### Chuck Moore — Instructor With more than 25 years of experience in IT and cybersecurity, Chuck has built a career on a strong foundation in security, networking, help desk operations, and technical training. He has helped organizations strengthen their security posture by identifying vulnerabilities, conducting threat assessments, implementing security controls, and ensuring compliance with industry standards. Combining extensive technical expertise with a passion for education, Chuck equips professionals with the knowledge and practical skills needed to recognize risks, risks and respond effectively. ## Pricing **Tuition:** $2049