NIST SP 800-190

What Is NIST SP 800-190?

NIST SP 800-190, titled "Application Container Security Guide," is a publication from the National Institute of Standards and Technology that provides authoritative guidance on securing container-based technologies. First released in 2017, it remains the primary reference standard for organizations building cloud native security practices around containers.

The document addresses risks specific to container environments that traditional security frameworks do not fully cover. It targets security engineers, DevOps teams, and compliance professionals working with technologies like Docker and Kubernetes in both federal and enterprise settings.

Unlike general cybersecurity frameworks, NIST SP 800-190 focuses on the container lifecycle from image creation through runtime operations. It recognizes that containers introduce unique attack surfaces that require dedicated controls and visibility.

The Five Core Security Concerns NIST SP 800-190 Addresses

NIST SP 800-190 structures its guidance around five interconnected risk areas:

Image risks: Vulnerabilities in base images, inclusion of malicious components, and use of outdated or unverified layers from public registries.
Registry risks: Inadequate access controls on image repositories, allowing unauthorized image retrieval or tampering.
Orchestrator risks: Misconfigured orchestration platforms that can expose administrative interfaces or permit excessive privilege escalation.
Container risks: Insecure runtime configurations, including containers running as root or sharing host namespaces unnecessarily.
Host OS risks: Vulnerabilities in the underlying host operating system that containers share, which can be exploited to break container isolation.

Each of these areas maps to specific countermeasures the framework recommends. Addressing all five is essential to building a complete container security framework that reduces attack surface across the full deployment stack.

How to Implement NIST SP 800-190 Guidance in Container Environments

Implementing NIST SP 800-190 requires a structured approach across build, deploy, and runtime phases of the container lifecycle.

At the build stage, organizations should:

Use minimal, hardened base images from trusted sources.
Scan images for known vulnerabilities using automated tools integrated into CI/CD pipelines.
Sign images cryptographically to establish and verify provenance before deployment.

At the registry and deployment stage:

Enforce role-based access controls on container registries.
Restrict which images can be pulled and deployed using admission controllers.
Maintain a current inventory of all running images and their associated vulnerabilities.

At runtime, teams should implement behavioral monitoring to detect anomalies such as unexpected process executions or network connections. Reviewing your top container security tools can help identify platforms that support these controls end to end.

Orchestrator hardening is equally important. Limiting API server access, enabling audit logging, and applying network policies are all consistent with NIST container security recommendations.

How SP 800-190 Maps to FedRAMP and Other Federal Compliance Frameworks

Federal agencies and contractors pursuing FedRAMP authorization often treat NIST SP 800-190 as a prerequisite for securing containerized workloads within a FedRAMP boundary. The publication aligns closely with NIST SP 800-53 controls, particularly those addressing configuration management, system integrity, and least privilege.

FedRAMP's container-related guidance references SP 800-190 explicitly when evaluating cloud native security architectures. Organizations using container platforms to host FedRAMP-authorized systems must demonstrate they have addressed the five core risk areas.

Beyond FedRAMP, SP 800-190 informs compliance with FISMA requirements and serves as a reference for DISA STIGs related to container deployments. Private sector organizations using cloud native security approaches also use it as a benchmark, even when not subject to federal mandates.

Why NIST SP 800-190 Compliance Remains Incomplete Across Most Container Environments

Despite the clarity of its guidance, full adherence to NIST SP 800-190 is rare. Several factors contribute to this gap.

Rapid deployment cycles create pressure to skip image scanning or bypass admission controls.
Teams lack runtime visibility into what containers are doing after they start, leaving behavioral risks undetected.
Image provenance tracking is inconsistently implemented, making it difficult to verify what is running in production.
Shared responsibility models in cloud environments create confusion about which controls fall to the customer versus the provider.
Orchestrator hardening is often deprioritized in favor of application feature delivery.

Organizations serious about cloud native security should evaluate whether their current tooling supports continuous compliance rather than point-in-time assessments. Exploring the best CWPP tools for container security can reveal coverage gaps across the container lifecycle.

FAQ

Is NIST SP 800-190 mandatory for federal agencies?

NIST SP 800-190 is not itself a mandatory standard, but federal agencies must comply with FISMA and NIST SP 800-53. Because SP 800-190 directly supports those requirements in container environments, it functions as de facto mandatory guidance for agencies deploying containerized workloads within federal boundaries.

How does NIST SP 800-190 address container image provenance?

The framework recommends cryptographically signing container images to verify their origin and integrity. It advises organizations to maintain trusted registries, validate signatures before deployment, and ensure no unsigned or unverified images enter production environments, establishing a clear chain of custody from build to runtime.

How does NIST SP 800-190 differ from CIS container security benchmarks?

NIST SP 800-190 provides broad risk-based guidance across the full container ecosystem, while CIS benchmarks offer prescriptive, technical configuration checklists for specific platforms like Docker and Kubernetes. Organizations typically use both together, applying SP 800-190 as the strategic framework and CIS benchmarks as the operational implementation layer.

Does NIST SP 800-190 cover Kubernetes orchestration security specifically?

Yes. The framework addresses orchestrator security as one of its five core risk areas. It covers concerns including API server exposure, role-based access controls, network segmentation, and audit logging. While it does not replace Kubernetes-specific hardening guides, it establishes the security principles that those guides operationalize.

How does NIST SP 800-190 guidance apply to serverless container environments?

Serverless containers reduce operator control over the host OS layer, which affects how some SP 800-190 controls are implemented. Organizations must rely more heavily on image hardening, registry controls, and runtime monitoring at the application layer, since infrastructure-level access is limited in managed serverless platforms.

‍