NIST SP 800-53 is the catalog of security and privacy controls published by the US National Institute of Standards and Technology for protecting information systems, organizations and individuals. Its full title is “Security and Privacy Controls for Information Systems and Organizations”, and it is one of the most influential security standards in cybersecurity, mandatory for US federal systems and widely adopted voluntarily elsewhere.
The catalog does not prescribe a single configuration. It offers a large library of controls and control enhancements from which an organization selects, tailors and implements a set that matches its risk, then assesses whether those controls work as intended.
How the NIST SP 800-53 control catalog is structured
The catalog groups controls into 20 control families in Revision 5, each identified by a two-letter code. A control such as AC-2 Account Management has a base statement, a discussion, related controls and optional control enhancements numbered in parentheses, for example AC-2(1) for automated account management.
Many controls contain organization-defined parameters, placeholders such as a review frequency or a lockout threshold that each organization fills in. This mechanism lets one catalog serve very different environments without hard-coding values that only fit some of them.
The table lists the control families of Revision 5 with their focus.
| Code | Family | Focus |
|---|---|---|
| AC | Access control | Accounts, permissions, least privilege, remote access |
| AT | Awareness and training | Security and privacy training |
| AU | Audit and accountability | Logging, log review, retention |
| CA | Assessment, authorization and monitoring | Control assessment, authorization, continuous monitoring |
| CM | Configuration management | Baselines, change control, inventories |
| CP | Contingency planning | Backup, alternate sites, recovery |
| IA | Identification and authentication | Identities, multifactor authentication, authenticators |
| IR | Incident response | Handling, reporting, testing response capability |
| MA | Maintenance | Controlled and remote maintenance |
| MP | Media protection | Media access, marking, sanitization |
| PE | Physical and environmental protection | Facility access, power, fire, climate |
| PL | Planning | Security and privacy plans, rules of behavior |
| PM | Program management | Organization-wide security and privacy program |
| PS | Personnel security | Screening, termination, transfers |
| PT | PII processing and transparency | Authority, purpose, consent, privacy notices |
| RA | Risk assessment | Categorization, risk assessment, vulnerability scanning |
| SA | System and services acquisition | Secure development, acquisition, external services |
| SC | System and communications protection | Boundary protection, cryptography, separation |
| SI | System and information integrity | Flaw remediation, malware protection, monitoring |
| SR | Supply chain risk management | Supplier assessment, provenance, tamper resistance |
Baselines and how controls are selected
Control selection starts from security categorization. Under FIPS 199, a system is rated low, moderate or high impact for confidentiality, integrity and availability, and the highest rating usually sets the baseline. The baselines themselves were moved in Revision 5 into a companion publication, SP 800-53B.
| Baseline | Used when | Character |
|---|---|---|
| Low | Loss would have limited adverse effect | Essential hygiene controls |
| Moderate | Loss would have serious adverse effect | Most common baseline for business systems |
| High | Loss would have severe or catastrophic effect | Many enhancements, strict monitoring |
| Privacy | System processes personally identifiable information | Applied alongside a security baseline |
After selecting a baseline, organizations tailor it: they scope out controls that do not apply, assign parameter values, add compensating controls and supplement the baseline with controls for specific threats. Tailoring decisions must be documented and justified in the system security plan.
Where SP 800-53 fits in the NIST publication family
SP 800-53 is one part of a connected set. The Risk Management Framework in SP 800-37 describes the process, SP 800-53 supplies the controls and SP 800-53A defines assessment procedures for testing them.
| Document | Role | Relationship to SP 800-53 |
|---|---|---|
| SP 800-37 | Risk Management Framework | Process that selects and authorizes controls |
| SP 800-53A | Assessment procedures | How each control is examined, interviewed or tested |
| SP 800-53B | Control baselines | Starting sets for low, moderate, high and privacy |
| FIPS 199 and FIPS 200 | Categorization and minimum requirements | Inputs that drive baseline choice |
| NIST CSF | Outcome-based framework | High-level functions mapped to detailed controls |
| SP 800-171 | Protecting controlled unclassified information | Derived subset for nonfederal systems |
Compared with ISO/IEC 27001, SP 800-53 is far more detailed and prescriptive at control level, while ISO 27001 centers on a certifiable management system. Compared with the CIS Controls, it is broader and more formal but less prioritized for small teams. FedRAMP builds its cloud authorization baselines directly on SP 800-53.
Changes introduced in Revision 5
Revision 5, first published in 2020 and since updated in minor releases, made the catalog outcome-based and organization-neutral. Control statements no longer name the responsible entity, so the catalog can be used by any organization, not only federal agencies.
- Privacy controls were integrated into the main catalog instead of a separate appendix.
- Supply chain risk management became its own SR family.
- Baselines moved to SP 800-53B, separating the catalog from its selection guidance.
- New controls address state-of-the-practice topics such as cyber resiliency and secure engineering.
- The catalog is published in machine-readable OSCAL formats in addition to documents.
Practical pitfalls in implementing SP 800-53
The size of the catalog creates its own risks. Organizations often fall into checklist compliance, documenting controls on paper without verifying that they work. Other common problems are unassigned parameters, inherited controls that nobody verifies with the provider and stale system security plans that no longer describe reality.
Effective programs use continuous monitoring, automate evidence collection where possible and treat control assessment as a recurring activity rather than a one-time audit before authorization.
Another frequent mistake is selecting the high baseline by default for every system. Over-specification consumes budget and attention on controls that add little value, while genuinely critical assets receive no extra scrutiny. A careful categorization and documented tailoring rationale usually produce stronger protection than simply adopting the largest control set.
Understanding it simply
NIST SP 800-53 is like a very large cookbook of protective measures. It does not tell every kitchen to cook the same meal. Instead, each organization decides how sensitive its systems are, picks a starting menu of recipes, adjusts the quantities and then checks that the dishes actually turned out right.
The key idea is choose, adapt and verify: pick the controls that fit your risk, set the details and prove they work.
Applied in practice
A software company wants to sell a case management platform to a US federal agency. Its system processes sensitive but unclassified records, so the team categorizes it as moderate impact and starts from the moderate baseline.
The team assigns parameter values, for example locking accounts after a defined number of failed logons and reviewing audit logs weekly. It documents which physical controls are inherited from its cloud provider and adds the privacy baseline because the platform stores personal data.
An independent assessor then tests the controls using SP 800-53A procedures. Gaps in configuration baselines and incident response testing are recorded in a remediation plan, and after fixes the agency grants an authorization to operate, followed by monthly continuous monitoring reports.