🕸️ Ada Research Browser

README.md
Home›Research Reports›README.md
← Back

NIST SP 800-171 R2 Compliance Scanner

A comprehensive Python-based network security assessment tool that scans networks and endpoints for compliance with NIST SP 800-171 Rev 2 requirements. The scanner automatically generates compliance reports in multiple formats, calculates SPRS scores, creates network topology diagrams, and produces Plan of Action & Milestones (POA&M) documents.

🚀 Features

🔍 Network Discovery & Scanning

🎯 NIST SP 800-171 Compliance Assessment

📊 SPRS Score Calculation

📈 Network Topology Visualization

📋 Multi-Format Reporting

🛠️ Installation

Prerequisites

1. Install Nmap

Windows: - Download from https://nmap.org/download.html - Run installer as Administrator - Ensure nmap is added to system PATH

Linux (Ubuntu/Debian):

sudo apt-get update
sudo apt-get install nmap

macOS:

brew install nmap

2. Install Python Dependencies

pip install -r requirements.txt

Requirements File

Create requirements.txt:

python-nmap==0.7.1
pandas>=1.3.0
jinja2>=3.0.0
pdfkit>=1.0.0
openpyxl>=3.0.0
requests>=2.25.0
networkx>=2.6.0
matplotlib>=3.5.0
numpy>=1.21.0

3. Additional Requirements for PDF Generation

Linux:

sudo apt-get install wkhtmltopdf

Windows: - Download from wkhtmltopdf.org

macOS:

brew install wkhtmltopdf

🚦 Quick Start

Basic Network Scan

python nist_compliance_scanner.py 192.168.1.0/24

Multiple Network Ranges

python nist_compliance_scanner.py 10.0.0.0/8 192.168.0.0/16 172.16.0.0/12

Custom Port Scanning

python nist_compliance_scanner.py 192.168.1.0/24 --ports "22,80,443,3389,5432"

Skip Topology Generation (Faster)

python nist_compliance_scanner.py 192.168.1.0/24 --no-topology

Verbose Output

python nist_compliance_scanner.py 192.168.1.0/24 --verbose

📝 Usage Examples

Enterprise Network Assessment

# Comprehensive scan of corporate network
python nist_compliance_scanner.py 10.0.0.0/8 \
    --ports "21,22,23,25,53,80,110,135,139,143,443,445,993,995,3389" \
    --output-dir /reports/quarterly_assessment \
    --verbose

Quick Security Check

# Fast scan without topology for immediate results
python nist_compliance_scanner.py 192.168.1.0/24 \
    --no-topology \
    --ports "22,80,443"

DMZ Assessment

# Focus on web-facing services
python nist_compliance_scanner.py 203.0.113.0/24 \
    --ports "80,443,8080,8443" \
    --output-dir /reports/dmz_scan

📊 Command Line Options

Option Description Default
networks Network ranges to scan (required) -
--ports Comma-separated ports to scan 22,23,53,80,135,139,443,445,993,995
--output-dir Output directory for reports reports
--no-topology Skip network topology generation False
--verbose, -v Enable verbose logging False

📁 Output Files

The scanner generates the following files in the output directory:

reports/
├── compliance_report_YYYYMMDD_HHMMSS.html    # Interactive HTML report
├── compliance_report_YYYYMMDD_HHMMSS.pdf     # Professional PDF document
├── compliance_report_YYYYMMDD_HHMMSS.json    # Machine-readable data
├── compliance_report_YYYYMMDD_HHMMSS.xml     # Structured XML format
├── compliance_report_YYYYMMDD_HHMMSS.txt     # Plain text report
├── poam_YYYYMMDD_HHMMSS.xlsx                 # POA&M Excel spreadsheet
├── network_topology.png                       # Network diagram
├── network_topology_subnets.png              # Subnet overview
└── nist_compliance.log                       # Detailed log file

🎨 Report Features

HTML Reports

POA&M Excel Documents

Network Topology Diagrams

🔧 Configuration

Custom Control Assessment

Extend the ComplianceAssessor class to add custom compliance checks:

def assess_custom_control(self, system: SystemInfo) -> ComplianceResult:
    # Custom assessment logic
    return ComplianceResult(
        control_id="3.X.X",
        control_name="Custom Control",
        # ... other fields
    )

Custom Report Templates

Modify the HTML template in ReportGenerator.generate_html_report() to customize report appearance and content.

🔐 Security Considerations

Permissions

Firewall Considerations

Data Protection

🐛 Troubleshooting

Common Issues

Nmap Not Found

Error: nmap program was not found in path

Solution: Install nmap and ensure it's in system PATH

Permission Denied

Error: Permission denied during scan

Solution: Run with elevated privileges (Administrator/sudo)

No Hosts Found

Found 0 active hosts

Solutions: - Verify network range is correct - Check firewall settings - Ensure network connectivity - Try different scan arguments

PDF Generation Failed

Error generating PDF report

Solution: Install wkhtmltopdf

Debug Mode

Enable verbose logging for detailed troubleshooting:

python nist_compliance_scanner.py 192.168.1.0/24 --verbose

📖 NIST SP 800-171 Controls

The scanner currently assesses the following control families:

🤝 Contributing

We welcome contributions! Please follow these guidelines:

  1. Fork the repository
  2. Create a feature branch (git checkout -b feature/amazing-feature)
  3. Commit your changes (git commit -m 'Add amazing feature')
  4. Push to the branch (git push origin feature/amazing-feature)
  5. Open a Pull Request

Development Setup

git clone https://github.com/yourusername/nist-compliance-scanner.git
cd nist-compliance-scanner
pip install -r requirements.txt
pip install -r requirements-dev.txt  # Development dependencies

Code Style

📄 License

This project is licensed under the GNU General Public License version 3 (GNU GPLv3) - see the LICENSE file for details.

⚠️ Disclaimer

This tool is provided for legitimate security assessment purposes only. Users are responsible for:

The authors are not responsible for any misuse of this tool or any damages resulting from its use.

🙏 Acknowledgments

📞 Support

🗺️ Roadmap

Upcoming Features

Version History

Made with ❤️