.%20TODO(brand):%20replace%20with%20the%20master%20vector%20from%20the%20brand%20files.%20--%3e%3cdefs%3e%3clinearGradient%20id='rudratic-mark'%20x1='0'%20y1='195'%20x2='0'%20y2='828'%20gradientUnits='userSpaceOnUse'%3e%3cstop%20offset='0'%20stop-color='%235a0bd8'%20/%3e%3cstop%20offset='1'%20stop-color='%23a5157c'%20/%3e%3c/linearGradient%3e%3c/defs%3e%3cg%20fill='url(%23rudratic-mark)'%3e%3cpath%20d='M253%20448%20545%20195l60%2070-292%20252z'%20/%3e%3cpath%20d='M348%20558%20473%20450v200L348%20768z'%20/%3e%3cpath%20d='M523%20405%20640%20305l83%2097-141%20120%20153%20128-102%2087-110-97z'%20/%3e%3cpath%20d='m663%20763%2072-61v126z'%20/%3e%3c/g%3e%3c/svg%3e){kind=small}
Compliance supportNIST SP 800-53 and CSF 2.0
Evidence for NIST access control and audit controls
NIST SP 800-53 Rev. 5 sets out controls for account management, least privilege, remote access, audit and authentication, and the NIST Cybersecurity Framework 2.0 groups them under Protect and Detect. SWOT produces evidence for the controls privileged access touches.
The products help produce evidence for these controls. Whether a control is met depends on your configuration, scope and independent assessment.
What the NIST controls ask for
- 01
Manage and limit privilege
Accounts are managed through their life, and privileged rights are limited to what each task needs.
- 02
Know and log the user
Users are identified and strongly authenticated, and their actions are logged.
- 03
Protect and review the logs
Audit information is protected, reviewed and acted on.
See it work
Control by control
Choose a NIST SP 800-53 control to see the SWOT evidence that supports it.
AC-2
Account management
The clause asks
Manage system accounts, including privileged accounts, through their life.
SWOT evidence
Accounts provisioned from your directory, grants requested and approved, and expiries enforced.
SWOT PAMAC-6
Least privilege
The clause asks
Allow only the access users need for their tasks; restrict and log privileged functions.
SWOT evidence
Just-in-time grants scoped to one target and window; every privileged command logged.
SWOT PAMAC-17
Remote access
The clause asks
Authorise, monitor and control remote access.
SWOT evidence
All privileged sessions through the proxy or gateway, recorded and scored live.
SWOT PAMAU-2
Event logging
The clause asks
Identify the events to log and log them.
SWOT evidence
Logins, grants, sessions, commands and policy edits on the audit trail.
SWOT PAMAU-6
Audit review and reporting
The clause asks
Review and analyse audit records for unusual activity, and report findings.
SWOT evidence
Risk scores, alerts and command search; events sent to your SIEM.
SWOT Cloud PAMAU-9
Protection of audit information
The clause asks
Protect audit information from unauthorised access, change and deletion.
SWOT evidence
A SHA-256 hash chain, insert-only audit tables and Object Lock storage for recordings.
SWOT PAMIA-2
Identification and authentication
The clause asks
Uniquely identify and authenticate users, with MFA for privileged accounts.
SWOT evidence
SSO over SAML or OIDC with TOTP or step-up MFA.
SWOT Cloud PAMCM-8
System component inventory
The clause asks
Keep an accurate, current inventory of system components.
SWOT evidence
Continuous agentless discovery with one record per device, matched on MAC before IP.
SWOT Radar1 of 8 clauses viewed
The products help produce evidence for these controls. Whether a control is met depends on your configuration, scope and independent assessment.
The products
What each product does here
- SWOT PAMPrivileged access managementLeast privilege, just-in-time access, MFA, monitoring and protected auditExplore SWOT PAM
- SWOT Cloud PAMMulti-cloud PAM for AWS, Azure, GCPThe same controls for the AWS, Azure and GCP management planeExplore SWOT Cloud PAM
- SWOT RadarAsset, identity and access discoveryAsset inventory and who can log in to each hostExplore SWOT Radar
Does SWOT make us NIST compliant?
NIST publications are frameworks, not certifications. SWOT produces evidence relevant to controls such as AC-2, AC-6, AC-17, AU-2, AU-6, AU-9, IA-2 and CM-8; how you apply them depends on your baseline and assessment.
How does this map to the NIST Cybersecurity Framework 2.0?
Privileged access controls sit mainly under Protect (identity management, authentication and access control) and Detect (continuous monitoring), with asset inventory under Identify.
Does it support zero trust?
SWOT applies zero trust ideas to privileged access: no standing rights, every session authenticated and authorised, and every action inspected and logged.
See it on your own systems
A walk-through of SWOT PAM, SWOT Cloud PAM and SWOT Radar with the team that builds them.