Products
Offset Anchor
Apply a baseline, tailor it, fill in the parameters, and work towards an authorization. For NIST SP 800-53 Rev. 5, on your own server.
It runs on one machine, inside your network. No cloud account, no license server, and nothing leaves the machine you install it on.
Community Edition · v0.2.31
Download Offset Anchor
tar xzf offset-anchor-0.2.31-linux-x64.tar.gz && cd offset-anchor && sudo ./install.sh anchor- 1Pull the image
docker pull ghcr.io/offsetsecurity/offset-anchor - 2Download the setup files
compose.yaml, env.example and README.txt
Download Docker files.zip · about 6 KB
Key features
- Baselines and tailoring
- Organization-defined parameters
- A Get ready plan that follows the Risk Management Framework to an authorization
- Every control explained in plain language, with NIST's own wording kept underneath
- Evidence held against each control, with its owner and how recent it is
- A risk register: every risk scored, treated and owned, and linked to the controls that reduce it
- Assets, policies with their review dates, tasks, incidents and findings
- HTTPS, backups and restore, an audit trail nobody can change, and signed one-click updates
Product details
| For | NIST SP 800-53 Rev. 5 |
|---|---|
| Version | v0.2.31 |
| License | Community Edition · Free |
| Runs on | Windows, Linux or Docker, on your own server |
| Support | info@offsetsecurity.net |
What you need
| A server | 64-bit Windows or Linux. Under 150 MB of memory at rest |
|---|---|
| Disk | About 300 MB, plus whatever evidence you upload |
| A port | One. 8080 unless you choose another |
| Anything else | No. It brings its own Node.js, and needs no database server |
Up to about 50 users. For more, talk to us first.
Install Offset Anchor
- Download OffsetAnchor-0.2.31-setup.exe
- Run it. Windows will warn you that the publisher is unknown, choose More info, then Run anyway. The installer is not code-signed yet
- It asks which port to use, and offers one that nothing else is using. Accept it, or type your own
- Finish. It installs itself as a background service, so it starts with Windows and keeps running with nobody signed in
- The shortcut on your desktop opens it in your browser
Your data is kept outside the program folder, in:
C:\ProgramData\Offset Security\Offset AnchorBack up the data folder in there and you have backed up everything.
To remove it: Settings, then Apps, then Offset Anchor, then Uninstall. Your data is left behind on purpose; delete that folder yourself if you want it gone.
Ubuntu, Debian, RHEL, Amazon Linux and SUSE. It installs as two systemd services.
- Download offset-anchor-0.2.31-linux-x64.tar.gz
- Unpack it and run the installer as root:
tar xzf offset-anchor-0.2.31-linux-x64.tar.gz
cd offset-anchor
sudo ./install.sh anchorIt picks a port nothing else is listening on and tells you which. To choose one yourself:
sudo PORT=8085 ./install.sh anchorAfterwards:
systemctl status offset-anchor # is it running
journalctl -u offset-anchor -f # watch the logsYour data is in /var/lib/offset-anchor.
To remove it: sudo ./uninstall.sh anchor from the unpacked folder. Add --delete-data only if you want the records gone too. There is no undo.
Docker runs the product without installing anything else on the machine, and it is the same on Windows and Linux.
If you have never used Docker, follow the step-by-step guide instead: Installing Offset Anchor on Docker. It starts with installing Docker itself and says what you should see after every command.
The short version, for somebody who knows Docker already:
- Download offset-anchor-0.2.31-docker.zip and unpack it
cp env.example .env, then fill in the two secrets it asks for- Change
HTTP_PORTandPUBLIC_URLtogether if 8080 is taken docker compose up -d
That pulls two images, the product and its updater, and starts three containers.
ghcr.io/offsetsecurity/offset-anchor
ghcr.io/offsetsecurity/offset-anchor-updaterYour data lives in a Docker volume, not in that folder, so it survives stopping and restarting. docker compose down keeps it; down -v deletes it, with no undo.
First steps, updates and help
After installing, whichever way
Open it in a browser at the address it gave you, http://localhost:8080 unless you chose another port.
The first screen asks you to create the administrator account. Do that straight away: until you do, anyone who can reach the address can create it.
Then, in order:
- Settings: add your colleagues, and your logo for the reports
- Settings, Email: point it at your mail server, so it can send reminders and password resets
- Get ready: the plan. Start at the top
HTTPS. Out of the box it serves plain HTTP and only answers this machine. To let colleagues reach it you must give it a certificate first. It refuses to answer the network without one, rather than putting passwords on the wire in clear. INSTALL.md, in the download, has the three lines this takes.
Updating it
An administrator installs updates from Settings. It checks with us, shows what is new, downloads it, checks our signature on it, installs it, and puts the old version back if the new one does not start.
Nothing is downloaded or installed until somebody asks for it.
Getting help
- In the product
Open Documentation in the menu. The guides are built in, so you can read them without leaving the product.
- In the download
INSTALL.md covers HTTPS, backups, restoring, moving to another machine, and what to do when something goes wrong. After installing, you'll find it in the
docsfolder.
Offset Anchor is not affiliated with, endorsed by, or certified by NIST.
Getting ready for an audit?
Our practitioners can help you set it up, scope your programme and close the gaps before your auditor arrives.
Prefer email? Write to info@offsetsecurity.net with your requirements.