NIST SP 800-53 Baseline Selector

Example Conversation

You: We’ve completed our organization profile. MedVault is categorized as FIPS 199 High with HIPAA, FedRAMP, PCI-DSS, and SOX overlays. Let’s select and tailor our baseline.

Agent: I’ve loaded your organization profile. Based on the FIPS 199 High categorization, I’ll start with the High baseline which includes approximately 428 controls across all 20 families. Now I’ll apply each of your four regulatory overlays.

Starting with the base High baseline and adding overlay-specific controls:

Overlay	Additional Controls	Key Families Affected
HIPAA (SP 800-66 Rev 2)	+12	AC, AU, IA, SC, IR, PT
FedRAMP High	+18	All families (enhanced parameters)
PCI-DSS v4.0	+8	AC, AU, CM, SC, SI
SOX (COSO 2013)	+6	AC, AU, CM, IA, PS

Total after overlays: 472 controls across 20 families. Would you like to review the full catalog, or should we proceed to tailoring?

You: Let’s tailor. We’re fully cloud-hosted on AWS, so most PE (Physical and Environmental Protection) controls are handled by AWS under the shared responsibility model. Can we remove those?

Agent: Good call. For a cloud-hosted system, many PE controls shift to the CSP. However, I need to be careful – some PE controls still apply even in cloud environments (like PE-2 Physical Access Authorizations for your office spaces and PE-6 Monitoring Physical Access to server rooms if you have any on-premise equipment).

Here are the PE controls I recommend removing with justification:

Control	Name	Justification
PE-3	Physical Access Control	Cloud-hosted; physical data center access controlled by AWS under SOC 2 and FedRAMP authorization
PE-4	Access Control for Transmission	Cloud-hosted; network cabling and transmission infrastructure managed by AWS
PE-5	Access Control for Output Devices	No on-premise output devices processing PHI; all printing restricted to secure virtual desktop
PE-13	Fire Protection	Cloud-hosted; fire suppression managed by AWS data centers per FedRAMP requirements
PE-14	Environmental Controls	Cloud-hosted; HVAC and environmental monitoring managed by AWS
PE-15	Water Damage Protection	Cloud-hosted; water damage protections managed by AWS data centers

I’ll keep PE-2 (Physical Access Authorizations) and PE-6 (Monitoring Physical Access) since you have office space in Austin. Shall I proceed with these removals?

You: Yes, that looks right. Proceed.

Agent: I’ve applied the tailoring. Let me run check_baseline_completeness to validate…

Result: PASS – Baseline is complete and well-formed.

• Baseline Level: High
• Total Controls Selected: 466
• Overlays Applied: HIPAA, FedRAMP, PCI-DSS, SOX
• Tailoring Removals: 6 (all with documented justification)
• Critical families present: AC (25), SC (38), SI (19), AU (16)

The tailored-control-catalog.json file is saved. You can now proceed to policy authoring or control standards.

Sample Output Excerpt

The skill produces a tailored control catalog JSON. Here is a representative excerpt showing the structure with baseline controls, overlay additions, and tailoring removals.

{
  "baseline_level": "High",
  "overlays_applied": ["HIPAA", "FedRAMP", "PCI-DSS", "SOX"],
  "controls": [
    {
      "id": "AC-1",
      "name": "Policy and Procedures",
      "family": "AC",
      "source": "baseline",
      "overlay_source": null
    },
    {
      "id": "AC-2",
      "name": "Account Management",
      "family": "AC",
      "source": "baseline",
      "overlay_source": null
    },
    {
      "id": "AC-2(1)",
      "name": "Automated System Account Management",
      "family": "AC",
      "source": "baseline",
      "overlay_source": null
    },
    {
      "id": "AC-2(13)",
      "name": "Disable Accounts for High-Risk Individuals",
      "family": "AC",
      "source": "overlay",
      "overlay_source": "HIPAA"
    },
    {
      "id": "AU-3(1)",
      "name": "Additional Audit Information",
      "family": "AU",
      "source": "overlay",
      "overlay_source": "FedRAMP"
    },
    {
      "id": "SC-28(1)",
      "name": "Cryptographic Protection",
      "family": "SC",
      "source": "overlay",
      "overlay_source": "PCI-DSS"
    }
  ],
  "tailoring_removals": [
    {
      "id": "PE-3",
      "justification": "Cloud-hosted on AWS; physical data center access controlled by AWS under SOC 2 Type II and FedRAMP High authorization."
    },
    {
      "id": "PE-13",
      "justification": "Cloud-hosted; fire suppression systems managed by AWS data centers per FedRAMP requirements and AWS SOC 2 report."
    },
    {
      "id": "PE-14",
      "justification": "Cloud-hosted; HVAC and environmental monitoring managed by AWS under shared responsibility model."
    }
  ]
}

Extension Tools

check_baseline_completeness

Reads the tailored control catalog JSON and validates control IDs, baseline coverage, overlay documentation, and tailoring removals.

The tool also normalizes common field naming variants (e.g., applied_overlays to overlays_applied, fips_199_level to baseline_level) and filters out controls with a “Removed” status that were accidentally placed in the controls array.

Getting Started

Complete the Organization Profile skill first – the Baseline Selector reads organization-profile.json to determine the FIPS 199 impact level and applicable regulations.

Once the profile is ready, start a session with the Baseline Selector skill active. The agent will:

1. Load your FIPS 199 categorization and select the corresponding base baseline
2. Apply each regulatory overlay and show which controls are added
3. Walk you through tailoring – removing controls that don’t apply to your environment (with required justification)
4. Validate the final catalog with check_baseline_completeness
5. Save tailored-control-catalog.json for all downstream skills

Have these decisions ready:

• Whether your environment is cloud-hosted, on-premise, or hybrid (affects PE family tailoring)
• Any compensating controls for controls you want to remove
• Whether you need to add controls beyond the baseline for specific business requirements