NIST SP 800-53 · Revision 5
Security and privacy controls, grounded in your environment.
SP 800-53 provides a flexible catalog of security and privacy controls. Select and tailor controls to the mission, systems, information, and requirements that shape your organization’s risk.
Control families
A catalog that spans the system.
Access & accountability
Access control, identity, authentication, audit records, and accountability.
Operations & resilience
Configuration management, incident response, contingency planning, and system integrity.
Privacy & supply chain
Privacy protections, acquisition, external dependencies, and supply chain risk management.
Catalog reference: SP 800-53 Revision 5, including Release 5.2.0.
Baselines & tailoring
Choose a starting point. Document the decisions.
SP 800-53B supplies low-, moderate-, and high-impact security baselines, plus a privacy baseline. Tailoring adapts those starting points to the environment and applicable requirements.
Assessments & evidence
Connect each selected control to evidence.
SP 800-53A provides procedures for assessing implemented controls. Align the selected controls, assessment objectives, evidence, and evaluation approach. Record findings so they can inform remediation and risk decisions.
Related references