# NIST SP 800-53: Security and Privacy Controls for Information Systems
NIST Special Publication 800-53 is the United States federal government's comprehensive catalog of security and privacy controls for information systems and organizations. Published and maintained by the National Institute of Standards and Technology (NIST), it serves as the foundational control framework for federal agencies subject to the Federal Information Security Modernization Act (FISMA) and as the authoritative source from which most other U.S. security compliance frameworks derive their requirements.
The publication currently stands at Revision 5, released in September 2020, with ongoing updates published as supplemental guidance. Revision 5 contains 20 control families encompassing more than 1,000 individual controls and control enhancements, organized into three baselines: Low (127 controls), Moderate (325 controls), and High (421 controls). The baseline selection corresponds to the potential impact of a security breach on organizational operations, assets, or individuals.
Understanding 800-53 requires understanding its position in a hierarchy of related publications. NIST 800-53 is the master catalog: it defines every security and privacy control a federal system might need, across all impact levels and system types. NIST SP 800-171 is a curated subset of 800-53, selecting the controls relevant specifically to protecting Controlled Unclassified Information (CUI) in non-federal systems. CMMC (Cybersecurity Maturity Model Certification) is the Department of Defense's assessment mechanism for verifying that contractors are actually implementing the 800-171 controls. The relationship is hierarchical: 800-53 is the source, 800-171 is a subset built for the private sector, and CMMC is the verification engine for that subset in the defense supply chain.
For organizations without a direct federal mandate, 800-53 Moderate serves as the most widely referenced implementation target in commercial security programs. Many SOC 2 auditors, cyber insurance underwriters, and enterprise procurement processes treat Moderate baseline coverage as a proxy for mature security posture.
NIST 800-53 is organized into 20 control families, each identified by a two-letter code. Controls within each family are numbered sequentially (e.g., AC-1 through AC-25). Each control includes a base requirement, supplemental guidance, related controls, and control enhancements that increase rigor for higher-impact systems.
The 20 control families map across all six domains of CDA's Planetary Defense Model, reflecting the reality that a comprehensive federal security program touches every layer of an organization's defense posture simultaneously.
Access Control (AC) [IAT]: 25 controls governing who can access what, under what conditions, and with what privileges. Includes account management (AC-2), access enforcement (AC-3), separation of duties (AC-5), least privilege (AC-6), remote access (AC-17), and wireless access (AC-18). For High baseline, adds advanced controls around session termination, information flow enforcement, and reference monitors. This is one of the most directly testable families: every requirement has a specific, observable system behavior that either exists or does not.
Awareness and Training (AT) [SPH]: 6 controls requiring documented security awareness programs, role-based training for individuals with elevated security responsibilities, and insider threat awareness. AT-2 (Literacy Training and Awareness) and AT-3 (Role-Based Training) are the primary requirements. Organizations frequently underinvest here relative to technical controls.
Audit and Accountability (AU) [TID]: 16 controls governing logging, log content, log review, audit record storage, and audit record protection. AU-2 (Event Logging) defines which categories of events must be logged. AU-12 (Audit Record Generation) requires specific system components to generate logs for defined event types. High-baseline enhancements add session audit capability, cross-organizational audit, and audit log synchronization with authoritative time sources.
Assessment, Authorization, and Monitoring (CA) [RGA]: 9 controls that define how security assessments are conducted, how systems are authorized to operate (Authority to Operate, or ATO), and how controls are monitored for continued effectiveness. CA-2 (Control Assessments), CA-3 (Information Exchange), CA-5 (Plan of Action and Milestones), and CA-7 (Continuous Monitoring) are the core requirements. This family is the administrative backbone of the entire Risk Management Framework (RMF) process.
Configuration Management (CM) [SPH]: 14 controls covering baseline configurations, configuration change control, security impact analysis, and least functionality. CM-2 (Baseline Configuration), CM-6 (Configuration Settings), and CM-7 (Least Functionality) are foundational. High-baseline adds automated central management and unauthorized software execution prevention. Configuration drift is one of the most common causes of audit findings and one of the most directly automatable controls.
Contingency Planning (CP) [RGA]: 13 controls requiring documented business continuity and disaster recovery capabilities: contingency plans (CP-2), contingency plan testing (CP-4), system backup (CP-9), and system recovery and reconstitution (CP-10). The key distinction from simple backup policies is the requirement to test recovery, not just perform it.
Identification and Authentication (IA) [IAT]: 13 controls governing identity proofing, authenticator management, multi-factor authentication, and device authentication. IA-2 (Identification and Authentication for Organizational Users) with its multi-factor enhancement is among the most consequential controls in the entire catalog, affecting the vast majority of privilege-related breach scenarios. IA-5 (Authenticator Management) governs password policies, key management, and PKI certificates.
Incident Response (IR) [TID]: 10 controls requiring documented incident response capabilities: incident response policy (IR-1), incident response training (IR-2), incident response testing (IR-3), incident handling (IR-4), incident monitoring (IR-5), and incident reporting (IR-6). High-baseline adds automated incident handling and integration with external organizations such as US-CERT.
Maintenance (MA) [SPH]: 6 controls governing how systems are maintained, by whom, using what tools, and from which locations. Particularly relevant for operational technology and systems with physical maintenance requirements. Remote maintenance controls (MA-4) are frequently underspecified in commercial environments.
Media Protection (MP) [DPS]: 8 controls covering the protection, sanitization, and disposal of system media containing sensitive information. MP-6 (Media Sanitization) and MP-7 (Media Use) address the physical data lifecycle. This family is especially relevant for organizations with physical storage media handling CUI or classified data.
Physical and Environmental Protection (PE) [SPH]: 20 controls governing facility access, physical access logs, visitor controls, monitoring of physical access, emergency shutoff, power equipment, and temperature/humidity controls for data centers. Frequently delegated to physical security teams who may not be engaged in the technical security program.
Planning (PL) [RGA]: 11 controls requiring documented security and privacy plans, rules of behavior, security and privacy architecture, and a central point of contact for privacy inquiries. PL-2 (System Security and Privacy Plans) and PL-8 (Security and Privacy Architectures) are foundational documentation requirements. The system security plan is the primary authorization artifact in the RMF process.
Program Management (PM) [RGA]: 32 controls that operate at the organizational level rather than the system level, governing enterprise risk management, security workforce development, insider threat programs, supply chain risk management programs, and privacy programs. PM controls are assessed at the organizational level and apply across all systems. This is the family that distinguishes a mature security program from a collection of technical controls.
Personnel Security (PS) [IAT]: 9 controls governing background checks, employment agreements, termination procedures, transfers, and personnel sanctions. PS-3 (Personnel Screening) and PS-4 (Personnel Termination) are the controls most frequently cited in insider threat scenarios. Access revocation timelines at termination are a recurring audit finding.
PII Processing and Transparency (PT) [DPS]: 8 controls (added in Rev. 5) addressing consent, privacy notices, purpose specification, information sharing with third parties, and privacy notice content. PT controls integrate privacy requirements directly into the security control catalog rather than treating them as a separate appendix, which was the approach in prior revisions.
Risk Assessment (RA) [RGA]: 10 controls requiring documented risk assessments, vulnerability monitoring, risk response planning, and privacy risk assessments. RA-3 (Risk Assessment) and RA-5 (Vulnerability Monitoring and Scanning) are the most operationally significant. High-baseline RA-5 enhancements require automated vulnerability scanning tools and comparison of results to previous scans to identify trends.
System and Services Acquisition (SA) [VSD]: 23 controls addressing security engineering principles, developer security architecture, supply chain risk management, developer configuration management, and security testing. SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) are particularly relevant for organizations building custom software. SA-9 (External System Services) governs requirements for cloud service providers and third-party systems.
System and Communications Protection (SC) [VSD, DPS]: 51 controls: the largest family in the catalog. Covers network segmentation, transmission confidentiality and integrity, network denial-of-service protection, boundary protection, cryptographic key establishment, and mobile code. SC-7 (Boundary Protection), SC-8 (Transmission Confidentiality and Integrity), and SC-28 (Protection of Information at Rest) address the most consequential data protection controls. SC-28 maps directly to CDA's Sovereign Data Protocol (SDP) methodology.
System and Information Integrity (SI) [TID, VSD]: 23 controls covering malicious code protection, system monitoring, security alerts and advisories, software firmware and information integrity, spam protection, and input validation. SI-2 (Flaw Remediation), SI-3 (Malicious Code Protection), and SI-7 (Software, Firmware, and Information Integrity) are the most operationally active controls in most environments.
Supply Chain Risk Management (SR) [VSD, RGA]: 12 controls added in Rev. 5 as a standalone family (previously distributed across SA and PM). Covers supply chain risk management plans, acquisition strategies, supplier assessments, notification requirements for compromises, and component authenticity. SR controls reflect NIST's response to incidents like SolarWinds and the growing recognition that supply chain integrity is a distinct security domain requiring dedicated controls.
The three baselines correspond to FIPS 199 impact categorization: Low, Moderate, and High. An organization determines its impact level based on the potential consequences of a confidentiality, integrity, or availability breach for each information type it processes.
Low baseline (127 controls) applies to systems where the impact of a breach is limited. Most internal tools with no external data would fall here. Moderate baseline (325 controls) applies to most federal systems and is the practical standard for commercial organizations seeking a defensible security program. High baseline (421 controls) applies to systems where a breach could have severe or catastrophic consequences: financial systems, critical infrastructure, national security systems.
For non-federal organizations, the Moderate baseline is the typical implementation target when 800-53 is selected as a reference framework. The additional 96 controls between Moderate and High address advanced scenarios (insider threat detection, non-organizational users, advanced encryption) that most commercial environments encounter eventually but can reasonably address in a maturity progression.
NIST 800-53 matters for three distinct reasons depending on who is reading this article.
For federal agencies and contractors, it is a legal requirement. FISMA mandates that federal agencies implement and assess 800-53 controls for all federal information systems. Agencies submit annual reports to OMB on their FISMA compliance posture. Contractors handling federal data must satisfy 800-53-derived requirements through specific program frameworks (FedRAMP for cloud services, CMMC for defense contractors, FISMA directly for certain agency work).
For commercial organizations, 800-53 is the most comprehensive available reference for building a security control program. No other public framework catalogs 1,000+ controls with this level of specificity, supplemental guidance, and cross-referencing. Organizations that outgrow NIST CSF (which is intentionally high-level) typically move toward 800-53 as their primary control reference.
For the security industry broadly, 800-53 is the origin point for most other frameworks. HIPAA Security Rule maps to it. PCI-DSS maps to it. SOC 2 Trust Services Criteria maps to it. ISO 27001 has significant overlap. Understanding 800-53 provides the underlying conceptual structure that makes all other frameworks faster to learn and implement.
The Rev. 5 release in 2020 introduced two changes with lasting impact. First, privacy controls were fully integrated into the main catalog rather than maintained as a separate appendix (previously SP 800-53 Appendix J). This reflects the recognition that privacy is a security property, not a separate compliance concern, and that the same control infrastructure that protects confidentiality should support privacy by design. Second, the Supply Chain Risk Management (SR) family was added as a standalone discipline, acknowledging that the supply chain represents a fundamentally different threat surface than traditional information security.
NIST 800-53 is the only framework in the compliance landscape that explicitly touches all six PDM domains simultaneously. This is what makes it the parent reference for CDA's Perpetual Compliance Assurance (PCA) methodology: when an organization's PCA control library is built on 800-53, it inherits the framework's complete domain coverage automatically.
The domain distribution is deliberate rather than coincidental. 800-53's architects recognized that information security cannot be reduced to any single domain. The same insight drives the PDM's concentric structure: DPS, VSD, SPH, IAT, TID, and RGA operate simultaneously, not sequentially. An access control failure (IAT) can expose sensitive data (DPS) through an unpatched vulnerability (VSD) while eluding detection (TID) because audit logging was disabled (RGA). 800-53 captures this interdependence through its extensive cross-references between control families.
For CDA engagements, the 800-53 control family mapping provides a structured handoff between domains. The IAT team owns AC and IA families. The TID team owns AU, IR, and SI families. The DPS team owns MP, PT, and SC-28. The VSD team owns SA, SC (network controls), and SR. The SPH team owns AT, CM, MA, and PE. The RGA domain owns CA, CP, PL, PM, RA, and the organizational PM controls that govern the entire program. This is not a rigid partition; every family has cross-domain implications. But the primary ownership structure ensures that each control has a named team responsible for its implementation and evidence collection.
The following TOP missions address 800-53 implementation directly:
RGA-R01 (Compliance Landscape Mapping, 16 hours): The entry point for any 800-53 engagement. This mission establishes which controls apply, at what baseline, and maps existing organizational controls against the 800-53 catalog. Identifies gaps and redundancies before any remediation work begins. For most organizations, the first surprise is discovering how many controls they partially satisfy through existing tools without formal documentation.
RGA-B01 (Risk Management Framework, 32 hours): Builds the documented Risk Management Framework process that 800-53's CA family requires. Includes system categorization per FIPS 199, system security plan development (PL-2), authorization boundary definition, and the initial control selection and scoping decisions. This is the foundational documentation that governs all subsequent 800-53 work.
RGA-B02 (Compliance Program Build, 60 hours): The most comprehensive RGA mission, this engagement translates the 800-53 control selection into an operational compliance program: evidence collection procedures, control ownership assignments, validation testing schedules, and the Plan of Action and Milestones (POA&M) process required by CA-5. For organizations pursuing an Authority to Operate or implementing PCA, this mission produces the control library that becomes the system of record.
RGA-H01 (Multi-Framework Compliance Alignment, 24 hours): Addresses the crosswalk problem at scale. When an organization is subject to 800-53 plus HIPAA, SOC 2, or ISO 27001, this mission performs the deduplication analysis that eliminates redundant evidence collection across frameworks. A properly executed crosswalk typically reduces the unique control count by 40 to 60 percent relative to managing each framework independently.
SPH-H01 (Automated Compliance Monitoring, 24 hours): Deploys the continuous monitoring infrastructure that 800-53's CA-7 control requires. Configuration-as-code, automated evidence collection for CM and AC controls, and drift detection alerting. This is where compliance transitions from documentation to operations.
SPH-B01 (Policy Framework Development, 40 hours): Every 800-53 control family begins with a policy (AC-1, AT-1, AU-1, etc.). These policy-level controls require documented procedures, defined frequencies of review, and assigned roles. This mission produces the policy suite that satisfies the -1 controls across all applicable families.
CDA's PCA methodology treats 800-53 as the primary control reference from which all other framework obligations are derived. Rather than building separate compliance tracks for 800-53, HIPAA, and SOC 2, PCA's framework crosswalk engine maps all three to a unified internal control library. Controls are defined once, evidence is collected once, and validation runs once. The frameworks are labels applied to controls, not separate programs.
For organizations with federal connections or DoD supply chain relationships, CDA begins every engagement with RGA-R01 to establish the precise 800-53 scope: which systems, which impact level, which baseline, and which overlays (Privacy, IoT, Industrial Control Systems) apply. This scoping decision drives everything downstream. Treating a Moderate-impact system as Low leaves significant gaps. Treating a Low-impact system as High wastes resources on controls that deliver no proportional risk reduction.
The PCA continuous monitoring infrastructure directly satisfies CA-7 (Continuous Monitoring), which requires organizations to develop a program that monitors controls on an ongoing basis rather than only during formal assessments. Organizations running PCA maintain a live compliance posture dashboard that provides the evidence trail CA-7 requires, making the formal ATO renewal or audit cycle a matter of presenting pre-existing evidence rather than performing emergency collection.
800-53 is the source framework. Every other major U.S. compliance obligation traces back to it. Organizations that build their security program on 800-53 acquire implicit coverage of HIPAA, CMMC, FedRAMP, and most commercial framework requirements at the same time.
Baseline selection is a risk decision, not a compliance decision. Choosing the wrong baseline creates either gaps (Low when Moderate is warranted) or waste (High when Moderate suffices). The FIPS 199 categorization process should be driven by honest assessment of impact, not by a desire to minimize control count.
The -1 controls (policy and procedures) are prerequisites for everything else. AC-1 must exist before AC-2 is assessed. Organizations that skip documentation in favor of technical implementation will fail audits on the policies they never wrote.
Rev. 5's integration of privacy controls (PT family) means that organizations can no longer treat privacy as a separate program. Privacy by design, consent management, and PII processing transparency now sit alongside encryption and access control in the same catalog, assessed by the same process.
Supply chain risk management (SR family) is no longer optional context. SR controls require documented processes for assessing supplier security posture, addressing compromises in the supply chain, and ensuring the authenticity of components. Organizations that have not built supplier assessment programs will find SR controls among their most significant gaps.
Multi-framework environments benefit most from 800-53 as a reference: because 800-53 is the source from which other frameworks derive, building a 800-53-mapped control library provides the most efficient path to satisfying multiple compliance obligations simultaneously.