NIST SP 800-53: Overview, Key Duties and Official Source

NIST SP 800-53

NIST Special Publication 800-53 Revision 5: Security and Privacy Controls for Information Systems and Organizations

The US federal catalogue of security and privacy controls, used to protect federal information systems and as the basis of FedRAMP and many other programmes.

Guidance standard Legally binding where it applies United States

What is NIST SP 800-53?

SP 800-53 is NIST’s comprehensive catalogue of security and privacy controls, from access control and incident response to supply chain risk management. Revision 5 made the controls outcome-based and usable by any organisation, not only federal agencies, and fully integrated privacy controls into the catalogue.

Who does it apply to?

US federal agencies must use it for their information systems under FISMA and FIPS 200. It is also mandatory in practice for cloud providers seeking FedRAMP authorisation, whose baselines derive from SP 800-53, and it is widely adopted by state governments, contractors and private organisations as a reference control set.

How does it work?

Control families: 20 families, such as AC (Access Control), AU (Audit and Accountability), CM (Configuration Management), IR (Incident Response), RA (Risk Assessment), SC (System and Communications Protection) and SR (Supply Chain Risk Management).
Baselines (SP 800-53B): starting sets of controls for low-, moderate- and high-impact systems, chosen through FIPS 199 categorisation, plus a privacy baseline. Organisations then tailor them.
Assessment (SP 800-53A): procedures for testing whether controls are implemented and effective.
Risk Management Framework (SP 800-37): the lifecycle that uses these controls: prepare, categorise, select, implement, assess, authorise and monitor.
Machine-readable formats: the catalogue and baselines are available in OSCAL for automation.

How does it relate to other frameworks?

NIST SP 800-171, which underpins CMMC, is derived from the moderate baseline for non-federal systems. NIST CSF 2.0 provides the higher-level outcomes, and official mappings link CSF, SP 800-53 and ISO/IEC 27001.

Sources and official references

Links go to the publisher's own site. Where a standard is sold or copyrighted, MajorCyber™ summarises it in original words and links to the official listing instead of reproducing its text.

This page is general educational information, not legal, audit or certification advice. Requirements depend on your organisation's circumstances and the current official text. MajorCyber™ is not affiliated with National Institute of Standards and Technology (NIST).