NIST 800-53 Example Evidence

The table below lists commonly evidenced control areas for National Institute of Standards and Technology (NIST) 800-53 and the artifacts that typically satisfy them; attach these to your controls as evidence.

Control Area	Example Evidence
Separate environments	Screenshots from test and production environments showing they are distinct
Annual access reviews	Closed tickets documenting review of access lists for in-scope cloud environments, SaaS applications, infrastructure-as-code tools, and security tooling, with reviewer comments
Hardening standards	Infrastructure-as-code configurations applied when new infrastructure is deployed, plus formal documentation of deployment configurations
Annual risk assessment	The most recently completed risk assessment report
Risk remediation plan	Documented remediation plans for risks identified during the risk assessment
Annual penetration testing	Report from the most recent annual penetration test
Asset inventory	A documented listing of all assets (workstations, mobile devices, servers, databases) plus cloud console screenshots listing infrastructure
Architectural diagram	The approved architecture diagram
Network diagram	A documented network diagram showing segmentation of your cloud environments
Continuity and recovery testing	Results from the most recently completed business continuity or disaster recovery test
Timely security communication	Screenshots from communication tools showing how security events are routed to the appropriate personnel
Management roles and responsibilities	The roles and responsibilities section of your information security policy
Offboarding checklist	A completed termination checklist or help desk ticket for a recently departed employee
Vendor register and agreements	A centralized vendor inventory with vendor name, relationship owner, services description, and risk rating, plus a sample executed agreement
Vendor compliance monitoring	Records showing vendor assurance reports (System and Organization Controls 2 (SOC 2) Type II reports, International Organization for Standardization (ISO) 27001 certificates, or completed questionnaires) are obtained and reviewed annually
Authentication protocol	Screenshots of single sign-on (SSO) login, password authentication, and multi-factor authentication (MFA) enforcement for employees, plus MFA availability for customers
Role-based application access	Screenshots showing how application users are assigned roles
Session timeout and logout	Screenshots demonstrating logout when the browser closes and forced reauthentication after a defined inactivity period
Access provisioning	A documented access request form or ticket for a recent new hire
Unique server accounts	Screenshots showing production servers require login with unique accounts and block direct root login
Customer change notification	Example customer communications about changes and banners warning of downtime before maintenance
Emergency change management	Documented emergency change procedures for critical changes
Centralized log storage	Screenshots from the system where activity logs are stored
Operational monitoring	Monitoring system screenshots showing availability checks and personnel alert configuration
Intrusion detection	Threat detection service screenshots showing the service enabled, the threat types detected, and alert routing to personnel
Encrypted remote production access	Screenshots showing access is denied without a VPN connection and succeeds with one
Capacity monitoring	Evidence that management reviews processing capacity and usage reports quarterly
Autoscaling	Screenshots of autoscaling configuration for production compute
Backup monitoring	Tickets showing backup failures were monitored and resolved
Backup integrity	Screenshots demonstrating a complete and accurate restore from a backup snapshot, plus disaster recovery test records
Hardware media disposal	The data deletion policy documenting secure disposal procedures for hardware
Application input validation	Screenshots of data entry confirming the application accepts only valid values
Notice of privacy practices	Registration flow screenshots showing new users receive the privacy notice before completing sign-up
Public privacy policy	A screenshot of privacy practices posted on your website
Privacy policy inclusions	The published privacy notice from your website showing the required disclosures
Privacy policy acceptance	Registration screenshots showing users must explicitly agree to the privacy notice before sign-up completes
Minimal data collection	Screenshots of all information a user can enter when providing data through the application
Annual review of processing purposes	Minutes from management's yearly review of privacy policies
Purposeful use only	The section of your privacy notice stating personal data is used only for its declared purposes
Deletion requests	Example requests for deletion of personal information and evidence the data was deleted within the committed time
Data destruction policy	The formally documented data deletion policy
Authentication before access	Screenshots of a user authenticating before viewing their information
Self-service data updates	Screenshots of a user modifying their personal information within the application
Incident reporting process	Formally documented incident response procedures
Third-party breach reporting instructions	Executed contracts confirming third parties with access to personally identifiable information (PII) are told how to report breaches to you
Breach notification	Documented breach notification procedures and the template used to notify affected individuals
Field validation and confirmation	Screenshots confirming edit checks on application entry fields and prompts asking users to confirm accuracy before submission
Privacy contact information	The section of your public privacy notice giving contact details for inquiries, complaints, and disputes
Privacy inquiry portal	Screenshots showing how customers submit privacy inquiries, complaints, or disputes
Inquiry tracking	Tracking system screenshots with example submitted inquiries, their resolution, and corrective actions
Physical access policy	Current physical access control policy
Regression testing	An example of regression testing performed before a recent major release
Removable media encryption	Evidence that company-issued removable media devices are encrypted
File integrity monitoring	File integrity monitoring (FIM) software screenshots and examples of the tool detecting changes
OS patching cadence	Evidence from servers or patching systems showing operating systems are patched on the defined schedule
Continuous control monitoring	Compliance automation tooling showing continuous monitoring of controls, test results, and self-assessments
Incident response testing	The most recently completed incident response tabletop exercise
Change testing	Ticketing records for several changes showing testing occurred
Customer MFA	Application screenshots showing customers have the option of enabling MFA
Independent assessment	Internal audit testing evidence and the resulting audit report
Business continuity plan	Current business continuity plan
Business impact analysis	Completed business impact analysis, often part of the continuity plan
Vendor management policy	Current vendor management policy
Operating procedures and change oversight	Relevant sections of your information security management (ISMS) policy covering operating procedures, organizational change management, and monitoring plans
Telework and endpoints	The telework and endpoint device section of the information security policy
Event logging and secure transfer	The event logging and secure information transfer sections of the data protection policy
Asset management policy	Current asset management policy
Vulnerability management policy	Current vulnerability management policy
Threat assessment	A completed threat assessment plan, subscriptions to security advisory lists, and records of assessments performed
Data de-identification	Data classification and data protection policy sections covering de-identification
Configuration management plan	The configuration management appendix or section of your change management policy
Security community engagement	Subscriptions to security and privacy mailing lists and memberships in industry groups
Activity review	Tickets documenting reviews of audit logs, incident tracking reports, and system activity, with reviewer identification and dates
Designated security officials	Policy sections or job descriptions assigning information security responsibilities to named roles
Network connection approval	Documented testing and approval procedures for network connections and firewall or router changes, with supporting records
Dataflow diagram	A formal dataflow diagram including the date it was finalized
Firewall configuration standards	Documented firewall and router configuration standards with screenshots showing consistent application
Network administration roles	Job descriptions or a skills matrix covering network administrator roles and responsibilities
Approved services, protocols, and ports	Configuration standards listing approved services, protocols, and ports with approval and justification for each
Insecure services controls	Standards documenting any insecure services in use and screenshots of the compensating security features applied
Default-deny rules	Screenshots showing a final deny-all rule in firewall or router rule sets
Boundary segmentation	A network diagram showing a demilitarized zone (DMZ) or equivalent boundary zone, with configurations restricting traffic to approved services and ports
Private IP protection	Firewall or router configurations concealing internal addressing through NAT, proxies, or route advertisement filtering
Personal firewalls	Screenshots showing personal firewalls installed and active on portable devices, configured to standard, and not disableable by ordinary users
Default account management	Procedures requiring vendor default accounts to be changed, plus screenshots showing defaults removed, reconfigured, or disabled
Encryption key rotation	Procedures requiring default keys to be changed at deployment and when key holders leave, plus evidence of replacement
Wireless firmware updates	Wireless device hardening procedures and screenshots showing firmware updates applied
Configuration standard updates	System hardening procedures showing standards are updated as new vulnerabilities are identified
System configuration standards	Hardening procedures covering vendor default changes, one primary function per server, minimal enabled services, protections for required insecure services, security parameter settings, and removal of unnecessary functionality
One primary function per server	System configuration screenshots showing each component serves a single primary function
Minimal enabled services	Screenshots of the enabled services running on system components
Security parameters in standards	Server configuration standards containing the required security parameter settings
Documented enabled functions	Configuration documentation recording enabled functionality and the rationale for each enabled service
Insecure remote login prevention	Screenshots showing insecure remote login protocols such as Telnet cannot connect to internal systems
Vendor security procedures	The vendor management policy plus operational procedures such as vendor system hardening
Cryptographic key storage	Screenshots showing how cryptographic keys are stored securely
Key distribution	Documented procedures for distributing cryptographic keys securely
Encrypted transmission	An inventory of where data crosses open, public networks, documented protocol and algorithm standards, and configuration screenshots
Trusted keys and certificates	Documented procedures for accepting only trusted keys and certificates, with screenshots of those in use
Anti-malware coverage	Vendor documentation for anti-malware software in use and screenshots verifying detection and removal of malware types
Malware threat evaluation	Job descriptions for personnel evaluating malware threats plus screenshots of monitoring tools or mailing list memberships
Critical patching	Vendor patch lists for in-scope systems and screenshots showing critical security patches installed
Pre-production credential removal	Software development lifecycle (SDLC) procedures requiring test accounts, user IDs, and passwords to be removed before production deployment
Test and production duty separation	Procedures requiring separation of duties between test and production personnel, with access configuration screenshots
Test data controls	Screenshots showing live sensitive data is not used in non-production environments and test accounts are removed before activation
Secure coding training	Training records showing developers completed secure coding training, including common vulnerability avoidance, within the past year
Error handling standards	Development procedures preventing information leakage through error messages
High-risk vulnerability remediation	Development procedures addressing high-risk vulnerabilities identified through vulnerability management
Access control policy	A documented policy defining access needs per role, least privilege for privileged accounts, assignment by job function, and documented approval for all access
Role access definitions	Documented access needs for each role: the systems and data required and the privilege level for each
Access approval records	Screenshots of a user's assigned privileges alongside documented approval matching those privileges
Access control systems	Screenshots from the access control systems covering in-scope components
Role-based enforcement	Screenshots showing the access control system enforces privilege assignments by job classification and function
Privileged and general authorization	Identity management procedures plus documented authorization examples for administrative and general users
Inactive account removal	Procedures requiring removal or disabling of accounts inactive beyond a defined period, with access lists showing none remain
Third-party account management	Procedures requiring vendor accounts be enabled only when needed and disabled afterward, with supporting screenshots
Third-party access monitoring	Procedures and screenshots showing third-party access is monitored while active
Account lockout	Procedures and configuration screenshots showing accounts lock after a defined number of failed attempts
Lockout duration	Procedures and screenshots showing locked accounts stay locked for a defined period or until an administrator unlocks them
Idle session reauthentication	Procedures and configuration screenshots requiring reauthentication after a defined idle period
Authentication methods	Documented authentication guidance for workforce and administrator accounts, with system login screenshots
MFA for remote access	Configuration screenshots enforcing MFA for remote access to the internal network for administrative and general users
Authentication policy content	An accessible policy covering strong credential selection, credential protection, non-reuse of passwords, and reporting of suspected compromise
Individual authenticators	Policies requiring authentication mechanisms be assigned to individual accounts and never shared, with supporting configuration
Entry controls	Photos of badge readers or door access controls and screenshots showing consoles lock when unattended
Sensitive area monitoring	Photos showing cameras or access control mechanisms monitoring entry and exit points of sensitive areas
Tamper protection for physical controls	Photos showing cameras and access mechanisms are protected from tampering and disabling
Physical access data review	Documented procedures for reviewing data from cameras and access control mechanisms
Physical access data retention	Screenshots showing camera and access control data is retained for the required period
Public network jack restrictions	Procedures and photos showing publicly accessible network jacks are disabled unless explicitly authorized
Onsite identification	Physical access procedures covering badge issuance for personnel and visitors, handling access changes, and revoking expired or terminated identification
Role-based physical access	Access lists from the physical access system showing role-based assignment, plus offboarding records showing revocation
Visitor logs	Photos showing visitor logs in use for the facility and any server or data storage rooms
Visitor log contents	Log entries capturing the visitor's name, the firm they represent, and the personnel authorizing access
Visitor log retention	Evidence the visitor log is retained for the required period
Physical media security	Documented policies for physically securing all media, including computers, removable media, and paper records
Backup location review	A documented security review of the backup media storage location from within the past year
Media transfer procedures	Documented procedures covering distribution of all media types, including authorized couriers with tracking, transfer logging, and recent tracking records
Media classification	Screenshots or photos showing media classified and labeled by data sensitivity
Media inventory	Media storage procedures requiring periodic inventory, plus the documented inventory logs
Media destruction	Destruction policies requiring cross-cut shredding, incineration, or pulping of hard copy, secured containers for media awaiting destruction, and unrecoverable disposal of electronic media
Audit trails enabled	Screenshots showing audit trails are enabled and active on in-scope systems
Access linked to individuals	System user access lists showing access is tied to individual users
Privileged action logging	Audit log settings and sample logs capturing root and administrator actions
Audit trail access logging	Settings and sample logs showing all access to audit trails is itself logged
Failed access logging	Settings and sample logs capturing invalid or failed login attempts
Authentication change logging	Logs showing use of authentication mechanisms, privilege elevation, and changes to administrative accounts
Logging state changes	Settings showing that initialization, stopping, and pausing of logging are recorded
Log entry contents	Sample logs showing user ID, event type, date and time, event source, and the affected item or resource
Clock synchronization	Documented time synchronization procedures: a designated central time server receiving signals from an approved external source in a standard time reference, peered central servers, and systems synchronizing only from them
Time data access	Access lists and time settings showing time data is restricted to users with a business need
Protected audit trails	Screenshots showing audit trails cannot be altered and are accessible only to those with a business need, protected through access controls or physical and network segregation
Log integrity monitoring	FIM or change detection configured to alert if logs are altered, with settings, monitored files, and resulting alerts
Daily log review policy	A policy requiring at least daily review of security events and of logs from systems handling sensitive data, critical components, and security functions
Log retention	A documented retention policy plus screenshots showing recent months of logs remain immediately available for analysis
Security control failure detection	Procedures for detecting and reporting failures across firewalls, intrusion detection and prevention systems (IDS/IPS), FIM, anti-malware, physical and logical access controls, audit logging, and segmentation controls
Control failure alerting	Screenshots showing alerting configured for failures of critical security control systems
Control failure response	Procedures covering restoring security functions, documenting failure duration and root cause, addressing issues that arose, assessing residual risk, and preventing recurrence
Control failure records	Documented failure records including root cause, start and end times, and the remediation performed
Network access monitoring policy	Documented policies for monitoring access to network resources and sensitive data, stored where personnel can reach them
Wireless access point detection	Procedures for at least quarterly detection of authorized and unauthorized wireless access points, covering wireless cards, portable hotspots, and devices attached to network ports
Wireless monitoring alerts	Wireless IDS/IPS or network access control (NAC) alert configuration showing alerts generated and routed to personnel
Authorized wireless inventory	A documented inventory of authorized wireless devices with business justification for each
Rogue access point response	A wireless scan from the past quarter and response records showing unauthorized access points were handled per the incident response plan
Penetration testing methodology	Documented methodology based on an industry-accepted approach covering the full perimeter and critical systems, internal and external testing, segmentation validation, and application and network layer testing, with results retained
Penetration test scope	Scopes of work for recent external and internal tests defining the approved methodology, annual frequency, and retesting after significant changes, plus the reports
Change detection configuration	Change detection or FIM screenshots showing what is monitored, plus a documented list of monitored files
Change detection alerts	Alert recipient configuration and settings for periodic comparison of critical files
Change detection response	Documented procedures for responding to alerts from the change detection system
Monitoring and testing policy	Documented security monitoring and testing policies, stored where personnel can reach them
Remote access disconnect	Acceptable use policy requiring idle remote sessions be disconnected, with configuration screenshots
Third-party remote access	Policy requiring vendor remote access be enabled only when required and deactivated immediately after use
Remote data handling	Policy forbidding copying or storing sensitive data on local drives or removable media during remote access
Multiple awareness methods	A documented awareness program using several communication methods, such as web training, posters, memos, and meetings
Incident response plan	A documented plan addressing roles, responsibilities, and communication and contact strategies, including any externally required notifications
Responder training	Policies requiring periodic training for staff with incident response roles
Security alert response	Procedures for responding to alerts from monitoring systems including intrusion detection and prevention, firewalls, and FIM
Plan review and update	Incident response plan procedures for incorporating lessons learned and industry developments
Privacy program scope	Documentation summarizing the scope of your privacy program, drawing on your record of processing activities (ROPA)
Designated data protection officer	Documentation formally appointing a data protection officer
Sensitive information management	A data classification policy covering PII classification and handling, plus awareness materials on PII handling and issue reporting
Data subject consent	Documentation of how consent is obtained before processing, screenshots of consent mechanisms, and consent records
Record of processing activities	Completed ROPA covering each population whose data you process, such as customers, prospects, website visitors, and employees
Data processing agreements	The data processing agreement (DPA) template used when sharing PII with third parties and fully executed contracts incorporating it
Data protection impact assessments	Completed data protection impact assessment (DPIA) documentation prepared before high-risk processing begins
Special category data	ROPA entries identifying whether special categories of PII are collected and which allowable conditions are relied on
Data subject request tracking	Records of data subject requests received and the actions taken to resolve them
Shared account management	The shared account section of your system access control policy
Application allowlisting	Mobile device management (MDM) or endpoint screenshots showing approved applications and failed installation of non-approved software
Application denylisting	Screenshots showing prohibited applications and failed installation attempts for them
Anomaly detection baselines	Monitoring system configuration showing alerts for suspicious or anomalous activity, the notification recipients, and example triggered alerts
Test information management	Screenshots showing test data usage in test environments, formal approvals for copying production data, and the related SDLC policy section
Change management policy	Current change management policy
Competence records	Records showing personnel hold the qualifications listed in your skills matrix, such as resumes or copies of certifications
Core security policies	Current maintenance management, system and information integrity, system security planning, and system and services acquisition policies
Automated access management	Screenshots of the admin console used to manage accounts and enforce identification and authentication, such as identity and access management (IAM), privileged access management (PAM), or password manager tooling
High-risk account disabling	The system access control policy section describing how high-risk accounts are disabled
Encrypted information flow control	Screenshots of boundary protection device rules filtering on packet, header, or message content
Administrator-only unlocks	A documented procedure restricting account unlocks to authorized administrators, plus screenshots of administrative permissions
System use notification	A screenshot of the login banner outlining usage conditions before sign-in
Concurrent session limits	The policy section limiting concurrent sessions
Unauthenticated actions	A documented list of actions permitted without authentication, such as viewing public websites or knowledge bases
Remote privileged commands	Logs of authorized remote execution of privileged commands plus remote access control configuration
Wireless configuration authorization	Network configuration screenshots restricting wireless configuration changes to authorized users
Wireless signal management	A wireless signal survey report
External system controls	The information exchange section of your data protection policy
Information sharing controls	Data loss prevention (DLP) system configuration and rule sets, plus user role and permission screenshots
Public content management	Documented review and approval procedures for publishing content publicly
PII in audit records	Log management configuration showing PII identification, masking, or removal, with sample logs showing redaction
Log correlation	A security information and event management (SIEM) tool or scripts used to correlate and analyze collected audit records
Audit tool integrity	Measures protecting the integrity of audit tools, such as digital signatures or code signing certificates
Non-repudiation and log modification	Data protection policy sections covering logged activities and controls over administrator and operator logs
Baseline configurations	The change management policy plus baseline configuration files or templates defining desired system state, with prior versions retained
High-risk travel configuration	Documented procedures for securing systems traveling to designated high-risk locations
Automated configuration management	Screenshots from a configuration management tool such as Ansible, Puppet, or Chef
Cryptography in configuration management	Documentation showing cryptographic mechanisms are covered by the configuration management process
Role-based contingency training	Approved, current contingency training materials tailored to roles, plus records showing personnel received them
Alternate processing site	Disaster recovery and business continuity plans plus configuration documentation for the alternate site
Transaction recovery	Documented journaling and rollback procedures for recovering from failures on transaction-based systems
Device identification and authentication	Documented procedures ensuring devices are identified and authenticated before connecting, such as NAC or certificate-based authentication
Identifier management	Procedures defining who selects, assigns, and authorizes identifiers, plus screenshots of the tooling managing assignment
At-risk password management	The password policy plus evidence of screening against commonly used or compromised passwords
Public key validation	Documented procedures for validating public keys used in authentication, such as certificate revocation checks
Authenticator protection	Documented procedures protecting authenticators, such as password requirements and MFA
Obscured authentication feedback	Login screenshots showing password entry is masked
External user authentication	The unique user identification section of your system access control policy
Identity verification	The role-based access establishment and modification section of your system access control policy
Automated maintenance tracking	Systems demonstrating automated management of maintenance, repair, and replacement, such as asset management or ticketing tools
Maintenance tool control and support	Current maintenance management policy covering tool use, personnel authorization, and timely support
Remote maintenance sessions	Records showing proper authorization of maintenance activities plus screenshots showing secure connections during sessions
Media sanitization	Maintenance and asset management policy coverage of sanitization, plus documented sanitization testing procedures
Security resource planning	Documentation of the resources needed to implement security and privacy programs, and procedures for allocating them
Output device access	Asset management and physical security policy sections restricting access to output devices
Privacy program plan	Your documented privacy program plan
Data integrity board	A membership list and bios for the data integrity board, where one is required
Physical access monitoring	Current physical security policy
Privacy reporting	The privacy program plan, a sample privacy report, and evidence reports are shared with oversight bodies
Social media rules	Documented rules of behavior restricting social media and external site use, often in the acceptable use policy or code of conduct
Position risk designations	Procedures for assigning, reviewing, and updating risk designations for each position
Privacy Act statements	Processes for including Privacy Act statements on forms that collect information, where US federal requirements apply
Social Security number minimization	Procedures for identifying and eliminating unnecessary use of Social Security numbers
Matching programs	Documented matching program procedures, oversight board approvals, and agreement templates, where US federal requirements apply
Supply chain risk assessment	The vendor management policy, a vendor directory showing risk categorization, and records of vendor report reviews
Vulnerability disclosure response	Vulnerability management policy and incident response plan coverage of corrective actions for publicly discoverable information
Approved identity verification products	Procedures for selecting only approved personal identity verification products, where US federal requirements apply
System documentation	Architecture diagrams and system descriptions, plus procedures for obtaining, protecting, and distributing that documentation
Secure development process	Current SDLC policy
User and management function separation	System documentation identifying components and services, showing user functionality separated from system management
Shared system security	The data protection policy plus a copy of the system security plan
External connection limits	The system security planning policy plus a network diagram showing limited external connections
Authenticated proxies	A network diagram and evidence that traffic is managed through authenticated proxy servers
Fail-secure boundary devices	Incident response, disaster recovery, and system security planning coverage of boundary device failure behavior
Collaborative device controls	Screenshots showing mechanisms that prohibit remote activation of collaborative devices such as cameras and microphones
Mobile code management	The mobile code section of your system and information integrity policy
Session authentication	Current encryption policy
Execution domain separation	An architecture diagram and SDLC policy showing separate execution domains
System monitoring tools	The data protection policy plus screenshots from your threat detection or monitoring tooling
Unauthorized service monitoring	Detection service screenshots showing monitoring and alerting for unauthorized network services
Security function verification	System integrity and security planning policy coverage of verifying security and privacy functions
Integrity checks and automated response	FIM screenshots, examples of detected changes, and automated alerting to appropriate personnel on integrity violations
Code authentication	Screenshots of cryptographic mechanisms, such as digital signatures or trusted certificates, used to authenticate software
Spam protection	A screenshot of the spam protection mechanism in place
Memory protection	Screenshots of mechanisms preventing unauthorized code execution in system memory
Tamper protection	System integrity and physical security policy coverage of tamper protection procedures
Secure name resolution	Screenshots of mechanisms implementing secure name and address resolution services