SecurityUSA

NIST SP 800-53

Organise a tailored security and privacy control programme

Bring control ownership, implementation evidence and assessment follow-up into one working record.

Full title
NIST Special Publication 800-53 Revision 5, Security and Privacy Controls for Information Systems and Organizations
Issued by
National Institute of Standards and Technology (NIST), Joint Task Force
Current release
Revision 5 published September 2020. Latest catalogue release 5.2.0, 27 August 2025.
Applies to
Mandatory for US federal information systems other than national security systems. Used voluntarily by many other organisations.
Nature
Control catalogue. Baselines are in SP 800-53B and assessment procedures in SP 800-53A. There is no NIST certification.
Structure
20 control families containing more than 1,000 controls and control enhancements

Overview

What SP 800-53 is

NIST SP 800-53 is a catalogue of security and privacy controls for information systems and organisations. Each control describes a safeguard, such as account management, audit logging or supply chain risk planning, with discussion, related controls and optional enhancements that add strength. Organisations select and tailor controls from the catalogue according to their risk, mission and legal obligations.

Revision 5, published in September 2020, made the controls outcome-based so that they can be used by any organisation, not only federal agencies. It integrated privacy controls into the main catalogue, added the PII Processing and Transparency and Supply Chain Risk Management families, and moved the control baselines out into a companion publication, SP 800-53B. Assessment procedures for every control are in SP 800-53A.

NIST now updates the catalogue through numbered releases in its Cybersecurity and Privacy Reference Tool. Release 5.1.1 in November 2023 added a control on identity providers and authorisation servers (IA-13) with supporting enhancements. Release 5.2.0, finalised on 27 August 2025 in response to Executive Order 14306, added SA-15(13), SA-24 and SI-02(07), revised SI-07(12) and updated guidance on software updates and patches, secure development, testing and software integrity. It did not change the SP 800-53B baselines.

For US federal agencies, FIPS 200 makes the use of SP 800-53 mandatory for systems other than national security systems, and the NIST Risk Management Framework in SP 800-37 sets out how controls are selected, implemented, assessed, authorised and monitored. Programmes such as FedRAMP build their baselines on it. Outside government, organisations use it as a comprehensive control library and map it to NIST CSF 2.0, ISO 27001 and other frameworks.

Who it applies to

SP 800-53 is used by:

  • US federal agencies, for information systems other than national security systems, under FISMA and FIPS 200
  • Cloud and technology providers seeking US federal authorisations, such as through FedRAMP
  • Contractors and service providers operating systems on behalf of US federal agencies
  • State and local government bodies that adopt it as their control standard
  • Private organisations that want a detailed, openly available control catalogue
  • Organisations mapping several frameworks to one common control set

National security systems follow Committee on National Security Systems guidance, which builds on SP 800-53. Contractors holding Controlled Unclassified Information in their own systems usually work to NIST SP 800-171, which is derived from SP 800-53.

Structure

How the catalogue is organised

Twenty families, each identified by a two-letter code. Every control has a control statement, discussion, related controls and references, and many have enhancements. Organisation-defined parameters let the organisation set values such as frequencies.

Govern

Governance, planning and risk

PL Planning
Policy and procedures, system security and privacy plans, rules of behaviour, security and privacy architectures and baseline selection.
PM Program Management
Organisation-wide controls: information security and privacy programme plans, senior officials, resourcing, enterprise architecture, risk strategy and measures of performance.
RA Risk Assessment
Security categorisation, risk assessment, vulnerability monitoring and scanning, criticality analysis and threat hunting.
CA Assessment, Authorization, and Monitoring
Control assessments, plans of action and milestones, system authorisation, continuous monitoring, penetration testing and internal system connections.
People

People and awareness

AT Awareness and Training
Literacy training and awareness, role-based training, and training records.
PS Personnel Security
Position risk designation, screening, termination and transfer, access agreements and external personnel security.
Access

Identity and access

AC Access Control
Account management, access enforcement, least privilege, separation of duties, session controls, remote and wireless access, and mobile devices.
IA Identification and Authentication
Identification and authentication of users, devices and services, authenticator management, re-authentication, identity proofing and, since 5.1.1, identity providers and authorisation servers.
Systems

Configuration, maintenance and media

CM Configuration Management
Baseline configurations, change control, security impact analysis, least functionality, system component inventory and software usage restrictions.
MA Maintenance
Controlled maintenance, maintenance tools, nonlocal maintenance, maintenance personnel and timely maintenance.
MP Media Protection
Media access, marking, storage, transport, sanitisation and use.
PE Physical and Environmental Protection
Physical access authorisations and control, monitoring, visitor records, power, fire and environmental protection, and alternate work sites.
Protect

System protection and integrity

SC System and Communications Protection
Boundary protection, separation of functions, transmission confidentiality and integrity, cryptographic key management and protection of information at rest.
SI System and Information Integrity
Flaw remediation, malicious code protection, system monitoring, security alerts, software and information integrity, and information handling. Release 5.2.0 added SI-02(07) and revised SI-07(12).
Detect and respond

Audit, incidents and continuity

AU Audit and Accountability
Event logging, content of audit records, storage capacity, review, analysis and reporting, time stamps, protection and retention of audit information.
IR Incident Response
Incident response training, testing, handling, monitoring, reporting and assistance, and the incident response plan.
CP Contingency Planning
Contingency plans, training and testing, alternate storage and processing sites, telecommunications, system backup and recovery.
Supply chain

Acquisition, development and supply chain

SA System and Services Acquisition
Resource allocation, system development life cycle, acquisition process, developer configuration management, testing and security engineering principles. Release 5.2.0 added SA-15(13) and SA-24.
SR Supply Chain Risk Management
New in Revision 5: supply chain risk management plans, provenance, acquisition strategies, supplier assessments, notification agreements and component authenticity.
Privacy

Privacy

PT PII Processing and Transparency
New in Revision 5: authority and purpose for processing personally identifiable information, privacy notices, consent and specific categories of PII.
Companions

Companion publications

SP 800-53B Control Baselines
Low, moderate and high security control baselines tied to FIPS 199 impact levels, a privacy control baseline, and tailoring guidance.
SP 800-53A Assessment Procedures
Assessment objectives and methods (examine, interview and test) for every control and enhancement, updated alongside each catalogue release.
SP 800-37 Risk Management Framework
The seven steps for using the controls: Prepare, Categorize, Select, Implement, Assess, Authorize and Monitor.

Implementation roadmap

How to implement it, step by step

A typical sequence, following the steps of the NIST Risk Management Framework in SP 800-37.

  1. 1

    Prepare

    Set roles, a risk management strategy and organisation-wide common controls. Identify the system, its mission and its stakeholders.

    OutputsRisk management strategyCommon controls list
  2. 2

    Categorise the system

    Define the system boundary and determine its impact level for confidentiality, integrity and availability, using FIPS 199 for federal systems.

    OutputsSystem boundarySecurity categorisation
  3. 3

    Select and tailor controls

    Start from the SP 800-53B baseline for that impact level, plus the privacy baseline where PII is processed. Tailor by scoping, assigning parameter values and adding controls or enhancements for specific risks or overlays.

    OutputsTailored control setParameter values
  4. 4

    Document the plan

    Record in the system security and privacy plans how each control is implemented, who provides it, and whether it is common, hybrid or system-specific.

    OutputsSystem security planPrivacy plan
  5. 5

    Implement

    Put the controls into operation and keep evidence that they work as described.

    OutputsImplementation recordsConfiguration evidence
  6. 6

    Assess

    Test the controls using SP 800-53A procedures. Record weaknesses and track them in a plan of action and milestones.

    OutputsAssessment reportPOA&M
  7. 7

    Authorise

    For federal systems, an authorising official reviews the package and accepts the residual risk by granting authorisation to operate.

    OutputsAuthorisation packageAuthorisation decision
  8. 8

    Monitor continuously

    Monitor controls and changes, reassess as needed, report status and track new catalogue releases such as 5.2.0.

    OutputsContinuous monitoring strategyStatus reports

Audit and evidence guide

What auditors look for, and the evidence to keep

There is no NIST certification for SP 800-53. For federal systems, controls are assessed by independent assessors under SP 800-53A and an authorising official decides whether to grant authorisation. Agencies’ programmes are also reviewed through annual FISMA evaluations by Inspectors General. Other organisations use internal audit or third-party assessments.

The federal assessment and authorisation cycle

  1. Step 1

    Security and privacy plans

    The plans describe the system, its boundary, categorisation and how each selected control is implemented.

  2. Step 2

    Control assessment

    Assessors examine documents, interview staff and test mechanisms using the SP 800-53A procedures, and produce an assessment report.

  3. Step 3

    Plan of action and milestones

    Weaknesses that are not fixed straight away are recorded with owners, resources and dates.

  4. Step 4

    Authorisation decision

    The authorising official weighs the residual risk and grants, or denies, authorisation to operate.

  5. Step 5

    Continuous monitoring

    Controls are monitored and reassessed on a defined frequency, supporting ongoing authorisation.

What reviewers look for

  • A system boundary and security categorisation that match reality
  • Baseline selection and tailoring decisions with recorded rationale
  • Organisation-defined parameter values that are set and followed
  • System security and privacy plans that describe actual implementation
  • Common and inherited controls documented, with evidence from the provider
  • Account management, least privilege and privileged access reviews
  • Audit logging, review and retention
  • Flaw remediation, vulnerability scanning and patch timelines
  • Contingency plan testing and backup recovery
  • Plans of action and milestones tracked to closure

Key dates and cycles

Revision 5 publishedSeptember 2020
Release 5.1.1November 2023
Release 5.2.027 August 2025
FISMA independent evaluationAnnual
Control assessments and reviewsAt defined frequencies
Continuous monitoringOngoing

Evidence to keep, by area

Examples to guide your evidence library. Your auditor or regulator decides what is sufficient.

Planning

  • Security categorisation
  • System security and privacy plans
  • Tailoring rationale
  • Parameter values

Access

  • Account reviews
  • Privileged access records
  • Authentication configuration
  • Separation of duties matrix

Configuration

  • Baseline configurations
  • Change records
  • Component inventory
  • Software usage records

Monitoring and audit

  • Audit log configuration
  • Log review records
  • Security alerts handled

Vulnerabilities

  • Scan results
  • Flaw remediation records
  • Penetration test reports

Resilience

  • Contingency plan
  • Contingency plan tests
  • Backup and restore records
  • Incident response tests

Supply chain and privacy

  • Supply chain risk management plan
  • Supplier assessments
  • Privacy notices
  • PII processing authority

Assessment

  • Assessment report
  • POA&M
  • Authorisation decision
  • Monitoring reports

Areas that often need attention

  • Plans that describe intended rather than actual implementation
  • Organisation-defined parameters left blank or not followed
  • Inherited controls claimed without evidence from the provider
  • POA&M items open well past their planned dates
  • Log review that is configured but not performed
  • Contingency plans not tested
  • Supply chain and privacy families treated as out of scope without justification
  • Catalogue release changes, such as 5.2.0, not assessed for impact

How Netra helps

Where each part of the work lives in Netra

Netra loads the selected SP 800-53 controls as requirements, tasks and policies. Work done for one control also counts towards other frameworks wherever the same safeguard applies.

Each control owned and tracked

Task Engine

Controls arrive as tasks with owners and due dates. Recurring tasks cover reviews and tests at the frequencies set in parameter values.

Status for each family and control

Compliance Centre

Status is derived from completed tasks and evidence, never typed in, so assessors can trace each status to the work.

Policies and procedures (the -1 controls)

Policy Hub

A policy library generated at onboarding, with a policy score that rises as the work behind each policy is done.

Risk assessment (RA) and POA&M-style tracking

Risk Manager

A risk register with inherent and residual heatmaps, with risks reduced as linked tasks complete.

Control assessments

Audit Centre

Run internal and external assessments end to end, with findings and corrective actions, using evidence in a tamper-evident vault.

Supply chain risk (SR) and external services

Third-Party Risk

Finds vendors from what Accounts and Purchase pay, assesses them through a vendor portal and records decisions with ratings.

Component inventory (CM-8)

Asset Management

Assets linked to the tasks and controls that apply to them.

Status reporting

Dashboard & Reports

A live Posture Score and a one-click report for leadership.

Netra organises work and evidence for selected controls. It does not grant an authorisation to operate, is not a FedRAMP or federal assessor, is not a SIEM or vulnerability scanner, and does not by itself establish compliance.

Common questions

More questions about Netra

Related frameworks

View all frameworks
Security

NIST SP 800-171

Build a clear record of how you protect CUI

Security

NIST CSF 2.0

Connect cyber governance with day-to-day action

Security

ISO 27001:2022 (Security Controls)

Make security controls visible through completed work

See NIST SP 800-53 in Netra

See how Netra connects your framework requirements with tasks, evidence and audit follow-up.