NIST SP 800-53
21 rules checking NIST SP 800-53 Rev. 5 compliance, with FIPS baseline applicability. LOW baseline rules apply to all federal systems, MODERATE adds controls for systems processing sensitive information.
| Rule ID | Severity | NIST Reference | Baseline | Category | Summary |
|---|---|---|---|---|---|
| NIST-NET-001 | CRITICAL | AC-4 | MODERATE | Information Flow Enforcement | Unrestricted any-to-any information flow |
| NIST-NET-002 | CRITICAL | AC-4 | MODERATE | Information Flow Enforcement | Overly broad source address |
| NIST-NET-003 | CRITICAL | AC-4 | MODERATE | Information Flow Enforcement | Overly broad destination address |
| NIST-NET-004 | CRITICAL | AC-4, CM-7 | LOW | Least Functionality | All ports or wide port range permitted |
| NIST-NET-005 | HIGH | AC-4, CM-7 | LOW | Least Functionality | All protocols permitted |
| NIST-NET-020 | HIGH | SC-8, SC-8(1) | MODERATE | Insecure Services | Unencrypted protocol detected |
| NIST-NET-021 | CRITICAL | CM-7, SC-8 | LOW | Insecure Services | Deprecated or broken protocol detected |
| NIST-NET-023 | HIGH | SC-8, IA-5(1) | MODERATE | Insecure Services | Insecure authentication protocol detected |
| NIST-NET-040 | CRITICAL | CM-7, SC-7 | LOW | High-Risk Service Exposure | High-risk port from broad source |
| NIST-NET-042 | CRITICAL | SC-7, CM-7 | LOW | High-Risk Service Exposure | High-risk port from broad/public source |
| NIST-NET-043 | CRITICAL | SC-7, CM-7 | LOW | High-Risk Service Exposure | Database port exposed to external network |
| NIST-NET-044 | CRITICAL | CM-7, SC-7 | LOW | High-Risk Service Exposure | Container/orchestration API exposed |
| NIST-NET-045 | CRITICAL | CM-7, SC-7 | LOW | High-Risk Service Exposure | IPMI/BMC exposed from non-management |
| NIST-NET-046 | CRITICAL | SC-7, AC-4 | LOW | High-Risk Service Exposure | ICS/SCADA protocol ports permitted |
| NIST-NET-050 | CRITICAL | AC-17, SC-7 | LOW | Remote Access Controls | Direct remote admin access from external |
| NIST-NET-052 | HIGH | AC-17, SC-7 | LOW | Remote Access Controls | Admin protocol from broad source |
| NIST-NET-061 | MEDIUM | SC-7, CM-7 | LOW | DNS and Covert Channels | DNS-over-HTTPS to known DoH providers |
| NIST-NET-062 | MEDIUM | SC-7, SC-7(9) | MODERATE | DNS and Covert Channels | Direct external DNS from protected segment |
| NIST-NET-070 | INFO | AC-4, SI-4 | LOW | Encrypted Tunnel Visibility | SSH tunnelling risk |
| NIST-NET-071 | INFO | AC-4, SC-7, SI-4 | LOW | Encrypted Tunnel Visibility | VPN tunnel in protected segment |
| NIST-NET-072 | INFO | SI-4, AC-4 | LOW | Encrypted Tunnel Visibility | Outbound HTTPS inspection blind spot |
The Severity column, like the Rules tab, shows the worst-case severity a rule can emit. Some rules emit a lower severity in less exposed cases:
- NIST-NET-002 and NIST-NET-003 are CRITICAL for an
anyor /16-or-wider address, and HIGH for a /17 to /20. - NIST-NET-004 is CRITICAL when all ports are permitted, and HIGH for a range of more than 100 ports.
ICMP flows
ICMP has no ports, so an ICMP flow never triggers NIST-NET-004 ("all ports or wide port range"). The address rules still apply.
L2TP (UDP 1701)
NIST-NET-021 fires on any rule that permits UDP 1701, even when IKE (UDP 500) and NAT-T (UDP 4500) are permitted as well. With L2TP/IPSec, L2TP packets travel inside ESP (IP protocol 50), or inside UDP 4500 with NAT-T, so a firewall never needs to permit cleartext UDP 1701. A rule that does permit it allows unprotected L2TP sessions. For L2TP/IPSec, permit only UDP 500, UDP 4500 and ESP.
ICS/SCADA protocols
NIST-NET-046 fires for any flow that permits Modbus (502), S7comm (102), EtherNet/IP (44818) or BACnet (47808), including traffic within a single subnet. This is by design: these protocols have no authentication or encryption, so every rule that permits them deserves review. Confirm that the path stays inside a dedicated, segmented OT network.