NIST SP 800-53
What it is
NIST Special Publication 800-53, Security and Privacy Controls for Information Systems and Organizations, is the master catalog of security and privacy controls used across the US federal government. Revision 5 is current, superseding Rev 4 in 2020 and updated with errata in 2022.
Who it applies to
It’s not a certification you “pass” — it’s the control library that FISMA, FedRAMP, and StateRAMP draw from. Implement any of those programs and you’re implementing 800-53 controls, whether or not you reference it by name.
Disclaimer. Not legal/compliance advice. Verify against the live publication. Verified 2026-05-29.
How the catalog is organized
Controls are grouped into 20 control families, each with a two-letter prefix. The ones with the biggest engineering footprint are in bold:
| Family | Name | Family | Name |
|---|---|---|---|
| AC | Access Control | MP | Media Protection |
| AU | Audit & Accountability | PE | Physical & Environmental |
| AT | Awareness & Training | PL | Planning |
| CM | Configuration Management | PM | Program Management |
| CP | Contingency Planning | PS | Personnel Security |
| IA | Identification & Authentication | PT | PII Processing & Transparency |
| IR | Incident Response | RA | Risk Assessment |
| MA | Maintenance | CA | Assessment, Authorization & Monitoring |
| SC | System & Communications Protection | SR | Supply Chain Risk Management |
| SI | System & Information Integrity | SA | System & Services Acquisition |
Rev 5 added the SR (Supply Chain) family and integrated privacy controls throughout the catalog rather than isolating them in a separate appendix. This makes privacy a first-class engineering concern alongside security, not an afterthought applied at the end.
Baselines and how levels are chosen
800-53 itself is the full catalog — all controls, all families. SP 800-53B defines baselines: pre-selected subsets for Low / Moderate / High impact systems. The impact level comes from FIPS 199, which categorizes a system by the worst-case impact of losing confidentiality, integrity, or availability — taking the high-water mark across all information types the system processes.
FedRAMP then tailors the 800-53B baselines for cloud, producing the 156 / 323 / 410-control baselines described in FedRAMP. Tailoring means adding cloud-specific requirements (like shared responsibility documentation) and removing controls that don’t apply in a cloud deployment model.
Anatomy of a control
Each control has an ID, a statement, optional control enhancements, and supplemental discussion that provides context for implementation. Example:
AC-2 Account Management — “Manage system accounts, including establishing, activating, modifying, reviewing, disabling, and removing accounts…” with enhancements like AC-2(3) Disable Accounts and AC-2(12) Account Monitoring for Atypical Usage.
Higher baselines pull in more enhancements of the same base control — that’s largely why High has more controls than Moderate, rather than entirely different controls. Understanding this layered structure helps engineers scope work: start with the base control, then layer in enhancements as the baseline demands.
OSCAL — machine-readable controls
NIST publishes 800-53 (and the baselines) in OSCAL (Open Security Controls Assessment Language) — JSON/XML/YAML. OSCAL lets you express your System Security Plan, control implementations, and assessment results as data, not prose, and validate them automatically against the published schema. It is the foundation of the FedRAMP 20x direction and of this platform’s OSCAL evidence viewer.
Related resources
- FedRAMP — tailors these baselines for cloud
- FISMA — the program that mandates 800-53 for federal systems
- NIST 800-63 (IAL/AAL/FAL) — the identity-specific companion standard
- Security Overview
Sources (verified 2026-05-29)
| Claim | Source |
|---|---|
| Control catalog, families, Rev 5 | NIST SP 800-53 Rev 5 |
| Control baselines (Low/Mod/High) | NIST SP 800-53B |
| Impact categorization | FIPS 199 |
| Machine-readable format | NIST OSCAL |