NIS800–53 Analysis Part 3: Breaking the Family Mold with Overlapping Communities

An analysis of overlapping communities to create more realistic and flexible cybersecurity regulation families.

In our last chapter, **“Human-Independent analysis of the NIS800–53 regulations”, we continued the villain arc we began by [analyzing the flaws in the original NIS800–53 families](https://medium.com/@lior0110/analysis-of-the-nis800-53-regulations-are-the-nis-families-real-03148755da3a?source=friends_link&sk=e6b351d9df599508763b44bf6ccea677)**. We moved beyond human-defined relationships, utilizing a pipeline of NLP methods to enable machines to define the connections between NIST800–53 regulations.

While our automated, crisp-clustering methods created more statistically sound families than the originals, they still had a fundamental flaw: they forced every regulation into one, and only one, family.

This limitation ignores a simple truth: regulations are not monolithic. A control for “Access Control” might be deeply intertwined with “Identification and Authentication.” Forcing it into a single box is a convenient simplification, but it’s not reality.

In this article, we take the next logical step. We’re breaking the single-family rule by exploring overlapping communities. To do this, we’re upgrading our toolkit with the powerful CDlib library, allowing for a more sophisticated and realistic analysis of the regulations network.

Building on a Machine-Made Foundation

We begin where we left off, using the combined relationship data from our three NLP methods: normalized BM25, SentenceTransformer, and SaaS embeddings. As a quick check, we confirmed that this combined approach provides a rich network with over 60% more connections than any single method, suggesting each NLP model captures unique aspects of the relationships between controls. This rich, machine-generated graph is the foundation for our new analysis.

A New Toolkit: Welcome, CDlib

To move beyond the limitations of our previous analysis, we employed the CDlib library, a comprehensive package for community detection in networks. This allowed us to not only test a wider range of advanced algorithms but also to evaluate them with a new suite of sophisticated scoring metrics, from link modularity to hub dominance.

Our analysis was a two-act play:

Act 1: Finding the Best-in-Class Crisp Communities

Before diving into the complexities of overlap, we first benchmarked a new set of advanced crisp (non-overlapping) community detection algorithms from the CDlib library. The goal was to find methods that produced the most balanced and statistically robust families. After extensive testing, the top performers are:

• Fluid — is best behaved (like last time).
• Greedy Modularity — is doing good (like last time), lacking in: internal_edge_density, z_modularity, and hub_dominance.
• Leiden — similar to Greedy Modularity but better balance.
• Louvain — similar to Greedy Modularity but better balance and a slightly more communities number.
• pyCombo — is bad at: triangle_participation_ratio, internal_edge_density, and hub_dominance. needs to say that it gives 20 Communities like Default NIS800–53 Communities.
• RB Pots — is bad at: max_odf, internal_edge_density, and hub_dominance.
• regularized_spectral_clustering — is bad at: avg_transitivity and scaled_density.
• Spinglass — can be unbalanced and is bad at: scaled_density and expansion. Also gives the least number of Communities.

Crucially, all these methods provided a new, much stronger baseline for what a well-structured set of non-overlapping families should look like, exceeding the performance of the original NIS800–53 families.

Act 2: The Quest for Overlapping Families

This was the main event. Our primary goal was to find algorithms that could assign a single regulation to multiple families. However, we had one critical requirement: every single regulation must be assigned to at least one community. We can’t afford to leave any controls out.

This “100% node coverage” requirement proved challenging, and many algorithms were disqualified. Ultimately, two methods successfully met the criteria:

1. CONGA (Cluster-Overlap Newman-Girvan Algorithm): A native overlapping algorithm that successfully grouped all regulations.
2. EnDNTM (Ensemble Detangler for Non-Deterministic Tie-breaking Methods): A fascinating ensemble method. We fed it the results from our best-performing crisp algorithms, and it intelligently created overlapping communities based on their consensus and disagreements. To fine-tune its output, we experimented with four variations, adjusting community size and testing the impact of including the aggressive Spinglass algorithm in the ensemble.

The Results: A Surprising Twist

After running all the selected crisp and overlapping algorithms, we compared their performance against the original NIS800–53 families using a wide array of metrics. The results are summarized in the table below, where greener is better and redder is worse compared to the default families.

Image representing the provided results table

The analysis revealed several key insights:

• Dominance Over Default: The verdict is in. Nearly every new method, both crisp and overlapping, proved superior to the original NIS800–53 families across most statistical measures. This reinforces our ongoing conclusion that the default families are suboptimal and ready for a machine-led redesign.
• Crisp Methods Are Still Formidable: The top-tier crisp algorithms from CDlib are not to be underestimated. They produced highly cohesive and well-balanced families, proving that even a non-overlapping approach, when data-driven, is a massive improvement.
• Overlapping is Not a Silver Bullet (Score-wise): In a surprising turn, a more realistic model didn’t automatically translate to superior scores on every metric. Neither CONGA nor the EnDNTM ensemble method could definitively outperform the best crisp methods across the board. While they excelled in some areas, their gains came with clear trade-offs, such as weaker performance in key metrics like internal_edge_density and hub_dominance.

Final Conclusion: A More Realistic — and Promising — Model

While the overlapping community methods didn’t sweep the board on every statistical metric, they represent a significant conceptual leap forward. The machine uprising has evolved; it’s no longer about just finding better-defined boxes, but about acknowledging that the boxes themselves should have permeable walls.

The fact that regulations can belong to more than one group is both intuitive and practical. The EnDNTM method is particularly promising here, as it builds its overlapping structure from an ensemble of high-performing crisp partitions — a “best of all worlds” approach.

Our journey shows that while human intuition can point us in the right direction (toward more flexible, overlapping structures), a truly superior, off-the-shelf solution still eludes us because generic network algorithms may not fully grasp the nuances of regulatory text. The path forward is clear: it’s time to move from applying existing algorithms to designing new, domain-specific ones that can navigate the unique complexities of regulatory frameworks. The rebellion hasn’t failed; it has just defined its next mission.

Explore the Analysis

For those who want to explore the data, reproduce the results, or examine the code behind this analysis, the complete Python notebook is available on **GitHub**.