NIST 800-53 Control Coverage
ReferencePublicUpdated 2026-04-08
Overview
Coverage levels:
- Full — SmoothGlue implements and enforces this control automatically
- Shared — SmoothGlue provides the mechanism; operator configures or manages it
- Operator — Outside SmoothGlue's scope; operator must implement
| Control Family | ID | Control Name | Coverage | SmoothGlue Implementation |
|---|---|---|---|---|
| Access Control | AC-2 | Account Management | Shared | Keycloak manages SSO accounts; operator manages user lifecycle |
| AC-3 | Access Enforcement | Full | Keycloak + AuthService enforce RBAC on all platform surfaces | |
| AC-4 | Information Flow Enforcement | Full | Kyverno default-deny + Istio mTLS enforce zero-trust flow | |
| AC-17 | Remote Access | Full | All remote access gated through Keycloak; no direct kubectl without SSO | |
| Audit & Accountability | AU-2 | Event Logging | Full | Loki aggregates logs from all platform components automatically |
| AU-3 | Content of Audit Records | Full | Alloy collector ensures structured, tamper-evident log format | |
| AU-9 | Audit Information Protection | Shared | Logs stored in Loki; operator configures retention period and export | |
| Configuration Management | CM-6 | Configuration Settings | Full | Kyverno admission policies enforce hardened configs at deploy time |
| CM-7 | Least Functionality | Full | Default-deny network policy; only explicitly permitted services run | |
| Identification & Authentication | IA-2 | Identification and Authentication | Full | Keycloak provides SSO; FIPS 140-2/3 cryptography for all auth tokens |
| IA-5 | Authenticator Management | Shared | Keycloak manages credentials; password policy configured by operator | |
| IA-7 | Authentication Module | Full | FIPS 140-2/3 validated modules used for all authentication | |
| Risk Assessment | RA-5 | Vulnerability Scanning | Full | Grype scans every image at build time via SBOM cross-reference |
| System & Communications Protection | SC-8 | Transmission Confidentiality | Full | Istio mTLS encrypts all inter-service traffic |
| SC-12 | Cryptographic Key Establishment | Full | Vault manages cryptographic keys; FIPS-validated operations | |
| SC-28 | Protection of Information at Rest | Shared | Vault encryption at rest; operator manages application data store encryption | |
| System & Information Integrity | SI-2 | Flaw Remediation | Shared | Platform Custodian patches platform components; operator patches applications |
| SI-3 | Malicious Code Protection | Full | NeuVector runtime behavioral analysis monitors all workloads | |
| SI-7 | Software and Firmware Integrity | Full | SBOM + image signing verifies artifact provenance end-to-end |
note
This table covers platform baseline controls. Application-level controls (AC-2 user lifecycle, AU-9 log export policy, SC-28 application data encryption) require operator implementation. See Shared Responsibility Model →