NIST SP 800-53 (Security and Privacy Controls)

NIST SP 800-53 (Security and Privacy Controls)

Purpose

Apply NIST SP 800-53 to select, implement, and assess a comprehensive catalog of security and privacy controls for federal and federal-adjacent systems.

Frameworks & Standards

Prompt Template

You are applying the NIST SP 800-53 (Security and Privacy Controls) framework.

CONTEXT:
- Current task: [[task_description]]
- Domain: security & compliance
- Stakeholders: [[stakeholder_roles]]

FRAMEWORK APPLICATION:
1. **Identify**: What aspect of NIST SP 800-53 applies to this situation?
2. **Analyze**: Break down the problem using framework principles:
   - Apply relevant framework principles to the context
3. **Synthesize**: Combine insights into actionable recommendations
4. **Validate**: Check recommendations against framework guidelines

OUTPUT STRUCTURE:
- Framework Application: Which principles were used and why
- Analysis: Step-by-step application to the specific context
- Recommendations: Prioritized actions based on framework guidance
- Limitations: Any constraints or assumptions in the application

QUALITY CHECKS:
□ All recommendations align with NIST SP 800-53 principles
□ Ethical considerations have been evaluated
□ Stakeholder impacts have been considered
□ Next steps are clear and actionable

Core Principles

NIST SP 800-53 organizes controls into families. Selected families include:

• Access Control (AC): Who can access what and how
• Audit & Accountability (AU): Logging and audit trails
• Configuration Management (CM): Secure baseline configurations
• Incident Response (IR): Incident handling procedures
• Risk Assessment (RA): Risk identification and analysis
• System & Communications Protection (SC): Network and boundary controls
• System & Information Integrity (SI): Malware, patching, monitoring

Applications & Use Cases

Reference Materials

• NIST SP 800-53 Rev 5 - NIST (National Institute of Standards and Technology)

Usage Guidelines

• Start with context: Clearly define the problem space before applying framework
• Adapt, don't adopt: Customize framework application to your specific situation
• Document decisions: Record how and why framework principles were applied
• Review outcomes: Evaluate results to improve future framework application
• Share learnings: Contribute insights back to team knowledge base

Collaboration Protocol

• Apply independently unless a task explicitly requires another skill or framework
• Use structured handoff format: [Context] -> [Framework Applied] -> [Open Questions] -> [Next Action]

Ethical Guidelines

• ALWAYS apply principle of least privilege
• NEVER store sensitive data in plaintext or logs
• ALWAYS follow responsible disclosure practices

Success Metrics

• Clarity: Framework application produces clearer decision rationale
• Consistency: Similar situations receive similar framework-guided analysis
• Stakeholder Alignment: Framework language improves cross-functional understanding
• Outcome Quality: Decisions show improved consideration of relevant factors
• Learning: Framework application generates insights for future improvement

Related Skills

• No directly related skills defined

Testing Strategy

• Validate that recommendations clearly map back to NIST SP 800-53 principles
• Review one real example and one edge case before adopting the output
• Confirm stakeholder, ethical, and operational constraints were considered
• Document adjustments made when the framework needed adaptation for context

Copyright (c) 2026 iSystematic Inc. Maxim is a product of iSystematic Inc.
SPDX-License-Identifier: BSL-1.1 (Apache-2.0 after 4 years)
See LICENSE at repo root. Framework definitions are reference material; value is delivered via Maxim's licensed runtime (pack-engine, MCP tools, dispatch, MemPalace).