Case Study

Sovereign Department Automates NIST SP 800-53 Across Classified Networks

How a national digital infrastructure department automated NIST SP 800-53 assessment inside an accredited enclave, without a single byte of evidence crossing the boundary.

1,189

Controls Assessed Continuously

Zero

Evidence Bytes Leaving the Enclave

6w → 2d

Authority to Operate Package Assembly

100%

Findings Mapped to a Named Control Owner

Client Profile

Company: Department of Digital Infrastructure
Industry: Sovereign Government
Company Size: 14,000+ Personnel
Location: Riyadh, Saudi Arabia
Engine Deployed: Zelar Trust AI Engine V4

The Challenge

An assessment regime whose evidence could not leave the network it described.

The department operated classified networks assessed against the full NIST SP 800-53 moderate baseline — over a thousand controls, reassessed on an authority-to-operate cycle. Every tool that could have automated the work was a hosted service, and a hosted service means evidence in transit to somebody else's infrastructure.

So assessment stayed manual. Control assessors worked inside the enclave, read systems, and wrote control narratives by hand. Assembling an authority-to-operate package took six weeks of that work, and by the time the package reached the accreditation authority parts of it described a configuration that had since changed.

Ownership was the quieter failure. Findings landed in a document rather than against a person, so remediation depended on whoever read the report recognising their own systems in it. Controls with no obvious owner reliably surfaced again in the next cycle, unchanged.

The Solution

Zelar Trust deployed as a self-contained assessment node inside the accredited boundary. It carries no outbound dependency: models, control catalogue, and evidence store all sit within the enclave, and the node is configured with no egress path at all rather than one that is merely unused.

Inside that boundary, the engine assesses all eighteen control families continuously against live system state and maps every finding to the system owner responsible for the control. Assessors moved from writing narratives to reviewing and signing generated ones, and the accreditation package became an export of current state rather than a six-week reconstruction.

Authority to Operate Package Assembly

Before Zelar (6 Weeks of Manual Control Narratives)

With Zelar (2 Days of Reviewed Machine Output)

* Assessment evidence is generated, signed and stored inside the accredited boundary. The node holds no egress path, so sovereignty is a deployment property rather than a policy commitment.

The Results

Authority-to-operate package assembly fell from six weeks to two days, and the two days are review rather than authorship. The accreditation authority receives control narratives generated from the state of the systems on the day of submission, with the assessment run that produced each one referenced beside it.

Every one of the department's findings now carries a named control owner, which changed what happens after the report. Remediation is tracked against people rather than documents, and the recurring set of ownerless controls that survived previous cycles has closed.

“Every vendor we spoke to solved this by moving our evidence somewhere else. That is not a compromise we are permitted to make, and it is not one we wanted to make. Zelar runs inside the boundary with nothing to phone home to, and our assessors spend their week on judgement instead of transcription.”

Nadia Haddad

Head of Cyber Accreditation, Department of Digital Infrastructure

Implementation Timeline

The department moved from manual control narratives to continuous in-enclave assessment across five phases.

Phase 1
Boundary & Accreditation Review
The accredited enclave, its systems and its authorisation boundary are mapped against the applicable NIST SP 800-53 baseline before anything is deployed.
Phase 2
In-Enclave Node Deployment
Zelar Trust installs as a self-contained node with its models, control catalogue and evidence store inside the boundary, and no outbound path configured.
Phase 3
Control Family Onboarding
All eighteen control families are wired to live system state, replacing point-in-time narratives with continuously reassessed control status.
Phase 4
Owner Assignment
Every control is bound to the system owner accountable for it, so findings route to a person rather than accumulating in a report.
Phase 5
Accreditation Package Export
Authority-to-operate submissions are exported from current state, with the assessment run behind each narrative referenced for the authority to verify.

Bring Continuous Audit Readiness to Your Organization

Understand where your governance, risk and compliance obligations stand today, and what continuous oversight would change. Our advisors will walk you through it.

Assess Your Cyber Governance Talk to a CISOaaS Advisor

Managed cyber governance for organizations that need continuous CISO leadership, Cyber GRC expertise and operational governance — without building the entire capability in-house.

CISO Governance Brief — practical insights on cyber governance, regulatory developments, risk, compliance and CISO leadership.