Leveraging Cyber Security Framework to Identify the SP 800 53 Security and Privacy Controls for Cloud‐based Information Systems

NIST developed information system risk management and guidelines that assist agencies in implementing integrated, organization‐wide programs to manage information security risk, and further developed Cloud Security Assessment Tool (CSAT) to facilitate in this matter. However, NIST’s CSAT needs further improvement and implementation of new functions such that it can be commercialized as an enterprise tool. In this project, InfoBeyond advocates the development of a user‐friendly, efficient, reliable, and generic CSAT Tool. Our CSAT will be delivered as a tool: (i) an Enterprise CSAT standalone version (Phase I), and (ii) a CSRC Cloud version (Phase II). Specifically, our CSAT overcomes the NIST’s CSAT limitations such as failing FIPS policy due to outdated MS internal configuration, insecure software architecture, requiring MS Excel for report generation and database repopulation, and running single operating platform. Further, our CSRC implements new features, such as additional SP 800 series data for risk management, technical user credential management service, and built‐in database editor. All these improvements or new features facilitate government agencies’ adoption of secure cloud solution effectively through friendly GUI. For CSAT efficiency, our CSAT is implemented in an MVC software framework to achieve enterprise‐level runtime performance with scalability for many users.