Framework: NIST 800-53 Audio Course

Welcome to the NIST 800-53 Audio Course

Episode 147 — Spotlight: Physical Access Control (PE-3)

Physical Access Control (PE-3) translates least privilege into the built environment by governing who may enter facilities, rooms, and cages that host systems, media, and network infrastructure. For…

Episode 146 — Spotlight: Risk Management Strategy (PM-9)

Risk Management Strategy (PM-9) defines how an organization articulates risk appetite, tolerance, priorities, and decision rules so that security and privacy controls are selected and operated with…

Episode 145 — Spotlight: System Security and Privacy Plans (PL-2)

System Security and Privacy Plans (PL-2) define how security and privacy controls are implemented, documented, and maintained for each system. For exam purposes, understand that PL-2 serves as the…

Episode 144 — Spotlight: Authority to Process Personally Identifiable Information (PT-2)

Authority to Process Personally Identifiable Information (PT-2) requires organizations to establish and document legal, regulatory, and policy bases for collecting and using PII. For exam readiness,…

Episode 143 — Spotlight: Personnel Screening (PS-3)

Personnel Screening (PS-3) ensures that individuals with system access undergo appropriate background investigations before being granted authorization. For exam purposes, understand that PS-3…

Episode 142 — Spotlight: Media Sanitization (MP-6)

Media Sanitization (MP-6) ensures that storage media containing sensitive information are properly cleared, purged, or destroyed before reuse or disposal. For exam purposes, understand that MP-6…

Episode 141 — Spotlight: Controlled Maintenance (MA-2)

Controlled Maintenance (MA-2) ensures that all maintenance activities—routine, preventive, or emergency—are performed under defined, authorized, and auditable conditions. For exam readiness,…

Episode 140 — Spotlight: Awareness Training (AT-2)

Awareness Training (AT-2) ensures that personnel understand security and privacy responsibilities commensurate with their roles and the organization’s risk environment. For exam readiness, recognize…

Episode 139 — Spotlight: Supply Chain Risk Management Plan (SR-2)

Supply Chain Risk Management Plan (SR-2) establishes how organizations identify, assess, and mitigate risks arising from suppliers, service providers, and dependencies. For exam purposes, understand…

Episode 138 — Spotlight: Component Authenticity (SR-11)

Component Authenticity (SR-11) focuses on verifying that hardware, software, and firmware components are genuine, unaltered, and obtained from trusted sources. For the exam, understand that SR-11…

Episode 137 — Spotlight: Supplier Assessments (SR-6)

Supplier Assessments (SR-6) verify that external vendors and service providers meet security and privacy requirements before and during their engagement. For exam readiness, recognize that SR-6…

Episode 136 — Spotlight: Supply Chain Controls and Processes (SR-3)

Supply Chain Controls and Processes (SR-3) ensure that products and services acquired or integrated into an organization’s environment meet established security and privacy requirements throughout…

Episode 135 — Spotlight: Authorization (CA-6)

Authorization (CA-6) is the formal, risk-based decision that a system may operate within defined conditions, made by an authorizing official who accepts residual risk backed by evidence. For exam…

Episode 134 — Spotlight: Continuous Monitoring (CA-7)

Continuous Monitoring (CA-7) sustains assurance between assessments by collecting, analyzing, and acting on security-relevant data with defined cadence and triggers. For exam purposes, CA-7 requires…

Episode 133 — Spotlight: Plan of Action and Milestones (CA-5)

Plan of Action and Milestones (CA-5) is the enterprise ledger for weaknesses, corrective actions, and accountability. For the exam, understand that CA-5 transforms assessment and monitoring results…

Episode 132 — Spotlight: Control Assessments (CA-2)

Control Assessments (CA-2) verify that implemented safeguards function as intended and achieve their stated objectives. For exam readiness, recognize that CA-2 requires assessment plans with defined…

Episode 131 — Spotlight: System Recovery and Reconstitution (CP-10)

System Recovery and Reconstitution (CP-10) ensures that after a disruption—malware outbreak, data corruption, hardware failure, or site loss—systems are restored to a known good state and returned to…

Episode 130 — Spotlight: Contingency Plan Testing (CP-4)

Contingency Plan Testing (CP-4) ensures that the organization’s recovery strategies and procedures are validated through realistic, periodic exercises. For exam readiness, understand that CP-4…

Episode 129 — Spotlight: System Backup (CP-9)

System Backup (CP-9) ensures that critical information, configurations, and software are copied and stored securely to enable rapid recovery after data loss or corruption. For exam purposes,…