THREATNOIR
Subscribe
Control frameworks and standards

NIST SP 800-53 Rev. 5

The detailed catalogue of security and privacy controls used by US federal agencies and widely reused elsewhere.

Official source Published by US National Institute of Standards and Technology. US government work in the public domain: we show the official control text.

What it is

NIST SP 800-53 is a large catalogue of security and privacy controls for information systems and organisations. It was created for US federal agencies under FISMA but is written to be technology and sector neutral, so many private organisations and other frameworks reuse it.

Who it applies to

  • US federal agencies and their information systems, where it is required through FISMA and OMB policy
  • Cloud providers selling to US government, through FedRAMP baselines built on 800-53
  • Contractors running federal systems on behalf of agencies
  • Organisations elsewhere that want a detailed, free control catalogue to build or check their own control set
Status
A NIST Special Publication. Revision 5 was published in 2020 and has received minor updates since; it is mandatory for US federal systems and voluntary for everyone else.
Enforcement
For federal agencies, compliance is checked through the Risk Management Framework (SP 800-37), with an authorising official accepting risk before a system runs, and through inspector general audits. FedRAMP assessments are carried out by accredited third party assessors. Outside government it is voluntary.

Key points

  • The catalogue is very large: you select a baseline that fits the system's impact level and then tailor it, rather than implementing everything
  • Revision 5 made controls outcome based and usable by any organisation, not only federal agencies
  • Privacy controls are integrated into the catalogue, with a dedicated PII processing and transparency family (PT)
  • Supply chain risk management became its own family (SR) in Revision 5
  • Controls are designed to be used with the Risk Management Framework: categorise, select, implement, assess, authorise and monitor
  • Many frameworks, including NIST CSF and CMMC through SP 800-171, map back to 800-53 controls

Where to start

  1. 1Decide whether you need it at all: outside US government work, NIST CSF or ISO 27001 is usually a lighter starting point
  2. 2If you do, categorise your system and pick the matching 800-53B baseline
  3. 3Tailor the baseline and document how each control is implemented in a system security plan
  4. 4Use 800-53A procedures to plan assessments and evidence collection

How it is structured

20 control familiesFrom Access Control (AC) and Audit and Accountability (AU) to Supply Chain Risk Management (SR)
Controls and control enhancementsEach control has a base statement, discussion and optional enhancements that add strength
SP 800-53B baselinesLow, moderate and high impact baselines plus a privacy baseline that select controls for a system
SP 800-53AAssessment procedures for testing whether controls work

A plain-language overview to help you learn, written by ThreatNoir. The official source prevails; this is not legal advice.

Items explained (96)

In the order of the framework itself.