dotnet-security-review-federal

What problem does it solve?

This Skill addresses the critical need for .NET applications to meet stringent federal security and compliance mandates, ensuring systems are secure and auditable for government environments.

Core Features & Use Cases

• NIST SP 800-53 Mapping: Maps OWASP findings to NIST controls and assesses federal-specific control families.
• FIPS Cryptography Audit: Verifies all cryptographic usage adheres to FIPS 140-2/3 standards.
• CUI Handling Assessment: Checks for proper handling, marking, and protection of Controlled Unclassified Information.
• DOE Overlay: Enforces DOE-specific requirements exceeding NIST baselines (e.g., password length, session timeouts).
• POA&M Generation: Produces federal-compliant reports with actionable Plan of Action and Milestones entries.
• Use Case: A .NET application intended for deployment within a Department of Energy (DOE) facility must undergo a security review that satisfies both general security best practices (OWASP) and specific federal regulations (NIST, FIPS, DOE Orders). This skill automates that comprehensive review process.

Quick Start

Run a federal security review on the current .NET project by executing the dotnet-security-review-federal skill.