![](https://csdnimg.cn/release/download_crawler_static/12174640/bg9.jpg)
NIST SP 800-70 REV. 4 NATIONAL CHECKLIST PROGRAM FOR IT PRODUCTS
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-70r4
minimally acceptable system configuration requirements and to ensure compliance with them [2].
Accordingly, Federal agencies, as well as vendors of products for the Federal government, should acquire
or implement and share such checklists using the NIST repository. NIST encourages checklist developers
to assert mappings to the security controls delineated in NIST Special Publication (SP) 800-53 to
facilitate FISMA compliance checking for Federal agencies.
1
Organizations should consider the availability of security configuration checklists during their IT product
selection processes.
When selecting checklists, checklist users should carefully consider each checklist’s degree of
automation, source, use of standards, and other relevant characteristics.
NIST recognizes that some checklists are more automated and standards-based than others. For example,
non-automated checklists provide prose-based descriptions of how a person can manually alter a
product’s configuration. Automated checklists are machine-readable. Automated checklists that fully
adhere to the Security Content Automation Protocol (SCAP), which are also known as SCAP content,
have all security settings documented in standardized SCAP formats; have undergone syntactic testing
using the NIST SCAP Content Validation Tool (SCAPVal)
2
for compliance to the SCAP-related
specifications; and include mappings between low-level security settings and high-level security
requirements.
When multiple checklists are available for a particular product, organizations should take into
consideration the degree of automation and use of standards of each checklist. Generally, SCAP
checklists can be used more consistently and efficiently than others. There may be other significant
differences among checklists; for example, one checklist may include software bundled with an operating
system (e.g., web browser and email client) while another checklist addresses that operating system only.
Another example is the assumptions on which the checklists are based (e.g., operational environment). A
checklist user should identify such differences and determine which checklist(s) seem appropriate and
merit further analysis.
Checklist source is particularly important for users from Federal civilian agencies, who should first search
for government-authorized or mandated checklists (e.g., mandated by Part 39 of the FAR [1]). In general,
these users should search for NIST-produced checklists, which are tailored for civilian agency use. If no
NIST-produced checklist is available, then agency-produced checklists from the Defense Information
Systems Agency (DISA) or the National Security Agency (NSA) should be used if available. If formal
government-authorized checklists do not exist, organizations are encouraged to use vendor-produced
checklists. If vendor-produced checklists are not available, other checklists that are posted on the NCP
website may be used.
Checklist users should customize and test checklists before applying them to production systems.
A checklist that is not mandatory for an organization to adopt should be considered a starting point for an
organization to customize. Although the settings are based on sound knowledge of security threats and
vulnerabilities, they cannot take into account organization-specific security and operational requirements,
existing security controls, and other factors that may necessitate changes. Organizations should carefully
evaluate the checklist settings and give them considerable weight, then make any changes necessary to
adapt the settings to the organization’s environment, requirements, policies, and security objectives. This
1
Organizations are also encouraged to include information in their checklists that supports mapping to other sets of
requirements, such as HIPAA.
2
SCAPVal is available for download for each SCAP version on the SCAP specification website at
https://scap.nist.gov/revision/index.html
.