NIST SP 800-53 / FedRAMP Moderate Compliance Assessment

Map a project's architecture and codebase to the FedRAMP Moderate baseline (NIST SP 800-53 Rev 5). Produces a phased assessment with AWS shared responsibility inheritance using the FedRAMP dual inheritance model, gap analysis, and risk-rated remediation guidance.

Output

All output goes to docs/compliance/. Create the directory if it doesn't exist.

File	Purpose
phase1-discovery.md	Architecture discovery results
phase2-nist-mapping.md	FedRAMP Moderate control mapping with inheritance
phase3-gap-analysis.md	Gap analysis with risk-rated remediation
assessment-summary.md	Executive summary with posture dashboard

Before writing any phase output, read references/phase-templates.md for the required output structure and field definitions.

Smart Re-run

Before starting any phase, check if previous phase outputs exist. If they do:

1. Read the existing output and compare against current project state (file modification times, git diff)
2. If significant changes detected, re-run that phase
3. If no changes, report "Phase N output is current — skipping"
4. Always ask: "Previous assessment found. Re-run from scratch or smart re-run?"

Critical Rules

• Evidence over assumption: Every "Implemented" status must cite a file path or pattern. If no evidence, mark "Not Implemented" or ask.
• Don't inflate compliance: When uncertain, mark "Partially Implemented" with notes.
• No fabricated controls: Only map controls from the FedRAMP Moderate baseline in references/nist-fedramp-controls.md. Verify against official sources when uncertain.
• Dual inheritance model: Apply both FedRAMP Moderate CRM (AWS P-ATO) and generic NIST 800-53 shared responsibility. For non-FedRAMP NIST assessments, apply generic shared responsibility only.
• USA context: Applies to US-based AWS workloads. Flag resources deployed outside US regions when data residency is relevant.
• FedRAMP ATO relevance: When the target has or is pursuing a FedRAMP ATO, reference the AWS Audit Manager FedRAMP Moderate framework for the current CRM.
• Phase checkpoints are mandatory: Always pause between phases for user input.
• Smart re-run is default: If previous outputs exist, offer smart re-run first.

Error Handling

Scenario	Action
Phase 0 URLs unreachable	Skip validation, warn user, proceed with cached control data in references/nist-fedramp-controls.md
No IaC files detected	Report "No IaC detected — assessment limited to application code and docs." Proceed with available evidence.
No architecture docs found	Report "No architecture documentation found." Ask user to describe architecture before proceeding.
Empty or minimal codebase	Report "Insufficient codebase for meaningful assessment." Ask user whether to proceed with manual input or stop.
Ambiguous control status	Mark "Partially Implemented" with notes explaining the ambiguity. Never guess.

Phase 0 — Framework Validation

Runs first, before any assessment work. Validates control data against official sources.

1. Fetch the NIST CSRC SP 800-53 Rev 5 page (https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final) to verify control families and IDs
2. Fetch the FedRAMP.gov documents and templates page (https://www.fedramp.gov/documents-templates/) to verify the FedRAMP Moderate baseline control selection
3. Compare both sources against the control tables in references/nist-fedramp-controls.md
4. If differences found: update references/nist-fedramp-controls.md and report changes
5. If no differences: report "Phase 0 complete — all controls match official sources"

Fallback: If either URL is unreachable or returns unparseable content, skip validation for that source. Warn the user which source could not be verified and proceed using the cached control data in references/nist-fedramp-controls.md. Do not block the assessment.

If official source URLs change or are uncertain, read references/official-references.md for current authoritative links before retrying.

Phase 1 — Architecture Discovery

1.1 — Detect Tech Stack

Scan the project root for technology indicators:

Indicator	Detection
Language	package.json, requirements.txt/pyproject.toml, go.mod, Cargo.toml, pom.xml/build.gradle
IaC	cdk.json (CDK), *.tf (Terraform/OpenTofu), template.yaml (CloudFormation/SAM), Crossplane *.yaml
Containers	Dockerfile, docker-compose.yml
CI/CD	.github/workflows/, buildspec.yml, .gitlab-ci.yml, Jenkinsfile

1.2 — Analyze Codebase

Scan for security-relevant patterns: IAM/access control, encryption, logging/auditing, network, data protection, backup/recovery, configuration management, incident response.

For IaC-specific detection patterns, apply these defaults: CDK — scan lib/**/*.ts for L2/L3 constructs; Terraform — scan *.tf for resource and data blocks; CloudFormation/SAM — scan template.yaml for Properties; Crossplane — scan *.yaml for apiVersion: aws.crossplane.io.

1.3 — Read Architecture Docs

Search for docs/ARCHITECTURE.md, docs/DESIGN.md, README.md, cdk.json, pipeline definitions.

1.4 — Produce Output

Before writing output, read references/phase-templates.md "Phase 1" section for required fields. Write docs/compliance/phase1-discovery.md.

1.5 — User Checkpoint

Present the Phase 1 summary and ask:

• "Does this accurately represent your architecture?"
• "Any out-of-band security controls not visible in code (SCPs, SSO, manual configs)?"

Wait for confirmation before Phase 2.

Phase 2 — Control Mapping

Before starting this phase, read references/nist-fedramp-controls.md for the control families and IDs to map. Read references/phase-templates.md "Phase 2" section for required field definitions (Status, Inheritance, Evidence, Notes, FedRAMP ATO Note) and output structure.

Before writing output, read references/phase-templates.md "Phase 2" section for required fields. Write docs/compliance/phase2-nist-mapping.md.

User Checkpoint

Present posture breakdown and uncertain controls. Ask: "Any controls where you have additional context?" Wait for confirmation before Phase 3.

Phase 3 — Gap Analysis

For every control marked Not Implemented or Partially Implemented, produce a risk-rated remediation entry. Before writing output, read references/phase-templates.md "Phase 3" and "Risk Rating Criteria" sections for the gap entry format and risk levels.

Write:

• docs/compliance/phase3-gap-analysis.md — ordered by risk rating, then effort
• docs/compliance/assessment-summary.md — executive summary

Present the executive summary and top recommended actions.

Example

User: "Assess this project for FedRAMP Moderate compliance."

Actions:

1. Phase 0 — Fetch NIST/FedRAMP sources, verify control tables (or skip with warning if unreachable)
2. Phase 1 — Detect CDK + TypeScript stack, find CloudTrail config in lib/monitoring.ts, IAM policies in lib/iam.ts, VPC in lib/network.ts. Write phase1-discovery.md. Ask user to confirm architecture.
3. Phase 2 — Map each control from references/nist-fedramp-controls.md. Example: AC-3 "Implemented" citing lib/iam.ts:42 (least-privilege policy), SC-28 "AWS FedRAMP Shared" citing lib/storage.ts:18 (S3 SSE-KMS). Write phase2-nist-mapping.md. Ask user about uncertain controls.
4. Phase 3 — Gap entries for controls like AU-11 "Not Implemented" (no log retention policy found), risk-rated Critical. Write phase3-gap-analysis.md and assessment-summary.md. Present top remediations.

Output: 4 files in docs/compliance/ with evidence-backed control mapping, risk dashboard, and prioritized remediation plan.

References

• Control family tables: references/nist-fedramp-controls.md
• Output format templates: references/phase-templates.md
• Official documentation links: references/official-references.md