Security Review — Federal Overlay
"Compliance is the floor, not the ceiling."
— NIST Cybersecurity Framework guidance
Core Philosophy
This is a language-agnostic federal overlay, not a standalone review. It assumes the OWASP Top 10
baseline has already been covered by a base <lang>-security-review (.NET / Python / PHP / Rust / React)
and adds the regulatory, cryptographic, and procedural requirements of U.S. federal systems —
particularly DOE and national-laboratory environments.
Non-negotiables:
- Base review first, always. Run the matching
<lang>-security-review; OWASP coverage is a prerequisite. A federal review that skips the baseline is incomplete.
- NIST SP 800-53 Rev 5 is the framework. Every finding maps to a control family (AC, IA, SC, AU, SI, …).
- Compliance is legally binding. FISMA, FIPS, EO 14028 — gaps can revoke an ATO. Findings are POA&M entries, not suggestions.
Workflow
Shared skeleton: CONFIRM BASE → MAP → ASSESS → REPORT.
CONFIRM BASE Verify a base <lang>-security-review ran and its findings are available. If not, run it first.
MAP Map every base finding to its NIST SP 800-53 control family (references/nist-800-53-mapping.md).
Assign a FIPS 199 impact level (Low/Moderate/High) by data sensitivity.
ASSESS Apply the four federal dimensions below; each gap is a new finding with a control ID.
REPORT Emit the POA&M (references/poam-template.md) + federal executive summary with impact levels.
Federal Dimensions
| Dimension |
What to verify |
Control family |
| NIST 800-53 mapping |
Every finding cites the control it violates; missing controls flagged |
AC · IA · SC · AU · SI · CM |
| FIPS 140-2/3 crypto |
Only FIPS-validated modules/algorithms for security functions (per-language table below); no MD5/SHA1/DES; approved RNG |
SC-13 |
| CUI handling |
CUI not in logs, dev/test data, or error output; encrypted in transit (TLS 1.2+) and at rest; access-controlled (references/cui-handling.md) |
MP · SC · AC |
| EO 14028 supply chain |
SBOM produced; dependencies provenance-checked; signed artifacts |
SR · SA |
| DOE Order 205.1B |
DOE cybersecurity program requirements where applicable (references/doe-cybersecurity.md) |
PM |
FIPS 140-2/3 crypto — per-language approved usage
| Language |
Use (FIPS-validated) |
Avoid for security functions |
| .NET |
CNG / System.Security.Cryptography in FIPS mode; Aes, SHA256+, RandomNumberGenerator |
MD5, SHA1, DES, RNGCryptoServiceProvider deprecated paths |
| Python |
cryptography in FIPS mode; hashlib SHA-256+; secrets/os.urandom |
hashlib.md5/sha1 for security, random for tokens |
| PHP |
openssl_* with AES-GCM, sodium_*, password_hash (Argon2id) |
md5, sha1, mcrypt, mt_rand/uniqid |
| Rust |
ring / rustls / aws-lc-rs (FIPS module); sha2, getrandom |
custom crypto, md5/sha1 crates for security |
| React/TS |
Do crypto server-side behind FIPS-validated TLS; crypto.getRandomValues / Web Crypto only for non-secret nonces; tokens in httpOnly cookies |
any client-side encryption/hashing as a security control, Math.random for tokens, secrets shipped in the bundle (VITE_/NEXT_PUBLIC_) |
Deeper FIPS module/algorithm detail: fips crypto requirements.
Output Template
Federal executive templates: federal executive templates.
## Federal Security Review — [System]
**Base review**: [<lang>-security-review, date] · **Categorization (FIPS 199)**: [Low/Moderate/High]
**Frameworks**: NIST SP 800-53 Rev 5 · FIPS 140-2/3 · EO 14028 · DOE 205.1B
### Executive Summary
[Posture vs ATO. The most serious compliance gap in plain language. Recommendation.]
### POA&M (Plan of Action & Milestones)
| ID | Weakness | NIST Control | Severity | Impact | Remediation | Milestone |
|----|----------|--------------|----------|--------|-------------|-----------|
| P-01 | [finding] | SC-13 | High | Moderate | [fix] | [date] |
Full POA&M format: poam template.
AI Discipline Rules
- Never run alone. If no base
<lang>-security-review has been performed, run it first — this overlay maps and extends it; it does not replace OWASP coverage.
- Every finding gets a control ID. "Weak crypto" is not a federal finding; "SC-13 violation: SHA1 used for token signing at
auth.py:88" is.
- FIPS is about validated modules, not just strong algorithms. AES in a non-validated library is still a FIPS gap in a federal context.
- CUI is the high-stakes data class. Treat any CUI in logs, test fixtures, or error output as a Critical finding.
Integration with Other Skills
dotnet / python / php / rust-security-review — The required base review this overlay extends; run one first.supply-chain-audit — SBOM / provenance / CVE depth for the EO 14028 dimension.dotnet-security-review-federal / python-security-review-federal — Superseded by this shared overlay (removed 2026-06-03).
Source: michaelalber/ai-toolkit — distributed by TomeVault.
1---2name: michaelalber-ai-toolkit-security-review-federal3description: Security Review — Federal Overlay4---56# Security Review — Federal Overlay78> "Compliance is the floor, not the ceiling."9> — NIST Cybersecurity Framework guidance1011## Core Philosophy1213This is a **language-agnostic federal overlay**, not a standalone review. It assumes the OWASP Top 1014baseline has already been covered by a base `<lang>-security-review` (`.NET` / `Python` / `PHP` / `Rust` / `React`)15and adds the regulatory, cryptographic, and procedural requirements of U.S. federal systems —16particularly DOE and national-laboratory environments.1718**Non-negotiables:**191. **Base review first, always.** Run the matching `<lang>-security-review`; OWASP coverage is a prerequisite. A federal review that skips the baseline is incomplete.202. **NIST SP 800-53 Rev 5 is the framework.** Every finding maps to a control family (AC, IA, SC, AU, SI, …).213. **Compliance is legally binding.** FISMA, FIPS, EO 14028 — gaps can revoke an ATO. Findings are POA&M entries, not suggestions.2223## Workflow2425Shared skeleton: `CONFIRM BASE → MAP → ASSESS → REPORT`.2627```28CONFIRM BASE Verify a base <lang>-security-review ran and its findings are available. If not, run it first.2930MAP Map every base finding to its NIST SP 800-53 control family (references/nist-800-53-mapping.md).31 Assign a FIPS 199 impact level (Low/Moderate/High) by data sensitivity.3233ASSESS Apply the four federal dimensions below; each gap is a new finding with a control ID.3435REPORT Emit the POA&M (references/poam-template.md) + federal executive summary with impact levels.36```3738## Federal Dimensions3940| Dimension | What to verify | Control family |41|---|---|---|42| **NIST 800-53 mapping** | Every finding cites the control it violates; missing controls flagged | AC · IA · SC · AU · SI · CM |43| **FIPS 140-2/3 crypto** | Only FIPS-validated modules/algorithms for security functions (per-language table below); no MD5/SHA1/DES; approved RNG | SC-13 |44| **CUI handling** | CUI not in logs, dev/test data, or error output; encrypted in transit (TLS 1.2+) and at rest; access-controlled (references/cui-handling.md) | MP · SC · AC |45| **EO 14028 supply chain** | SBOM produced; dependencies provenance-checked; signed artifacts | SR · SA |46| **DOE Order 205.1B** | DOE cybersecurity program requirements where applicable (references/doe-cybersecurity.md) | PM |4748### FIPS 140-2/3 crypto — per-language approved usage4950| Language | Use (FIPS-validated) | Avoid for security functions |51|----------|----------------------|------------------------------|52| **.NET** | CNG / `System.Security.Cryptography` in FIPS mode; `Aes`, `SHA256+`, `RandomNumberGenerator` | `MD5`, `SHA1`, `DES`, `RNGCryptoServiceProvider` deprecated paths |53| **Python** | `cryptography` in FIPS mode; `hashlib` SHA-256+; `secrets`/`os.urandom` | `hashlib.md5/sha1` for security, `random` for tokens |54| **PHP** | `openssl_*` with AES-GCM, `sodium_*`, `password_hash` (Argon2id) | `md5`, `sha1`, `mcrypt`, `mt_rand`/`uniqid` |55| **Rust** | `ring` / `rustls` / `aws-lc-rs` (FIPS module); `sha2`, `getrandom` | custom crypto, `md5`/`sha1` crates for security |56| **React/TS** | Do crypto **server-side** behind FIPS-validated TLS; `crypto.getRandomValues` / Web Crypto only for non-secret nonces; tokens in httpOnly cookies | any client-side encryption/hashing as a security control, `Math.random` for tokens, secrets shipped in the bundle (`VITE_`/`NEXT_PUBLIC_`) |5758Deeper FIPS module/algorithm detail: [fips crypto requirements](references/fips-crypto-requirements.md).5960## Output Template6162Federal executive templates: [federal executive templates](references/federal-executive-templates.md).6364```markdown65## Federal Security Review — [System]66**Base review**: [<lang>-security-review, date] · **Categorization (FIPS 199)**: [Low/Moderate/High]67**Frameworks**: NIST SP 800-53 Rev 5 · FIPS 140-2/3 · EO 14028 · DOE 205.1B6869### Executive Summary70[Posture vs ATO. The most serious compliance gap in plain language. Recommendation.]7172### POA&M (Plan of Action & Milestones)73| ID | Weakness | NIST Control | Severity | Impact | Remediation | Milestone |74|----|----------|--------------|----------|--------|-------------|-----------|75| P-01 | [finding] | SC-13 | High | Moderate | [fix] | [date] |76```7778Full POA&M format: [poam template](references/poam-template.md).7980## AI Discipline Rules8182- **Never run alone.** If no base `<lang>-security-review` has been performed, run it first — this overlay maps and extends it; it does not replace OWASP coverage.83- **Every finding gets a control ID.** "Weak crypto" is not a federal finding; "SC-13 violation: SHA1 used for token signing at `auth.py:88`" is.84- **FIPS is about validated modules, not just strong algorithms.** AES in a non-validated library is still a FIPS gap in a federal context.85- **CUI is the high-stakes data class.** Treat any CUI in logs, test fixtures, or error output as a Critical finding.8687## Integration with Other Skills8889- **`dotnet` / `python` / `php` / `rust`-security-review** — The required base review this overlay extends; run one first.90- **`supply-chain-audit`** — SBOM / provenance / CVE depth for the EO 14028 dimension.91- **`dotnet-security-review-federal` / `python-security-review-federal`** — Superseded by this shared overlay (removed 2026-06-03).9293---94> Source: [michaelalber/ai-toolkit](https://github.com/michaelalber/ai-toolkit) — distributed by [TomeVault](https://tomevault.io).95<!-- tomevault:4.0:skill_md:2026-06-10 -->
tomevault-io