NIST SP 800-53 Rev. 5
NIST SP 800-53: the reference controls catalog
We implement NIST security and privacy controls so you meet US government requirements and raise your maturity.
What is NIST SP 800-53?
Over a thousand controls in 20 families
Special Publication 800-53 from the US NIST is a catalog of security and privacy controls for information systems and organizations.
It underpins FedRAMP for US government cloud services and is used alongside the NIST Cybersecurity Framework 2.0 and the Risk Management Framework.
Revision 5 is technology- and sector-neutral, which is why more and more banks, insurers and private companies adopt it.
Control families
From access to the supply chain
AU · Audit and accountability
CM · Configuration management
IA · Identification and authentication
IR · Incident response
RA · Risk assessment
SC · System and communications protection
SR · Supply chain risk management
Phases
How we implement it
- 1Categorization of systems by impact.
- 2Baseline selection and control tailoring.
- 3Implementation and documentation in the system security plan (SSP).
- 4Control assessment using SP 800-53A procedures.
- 5Plan of action and milestones (POA&M) to close gaps.
- 6Continuous monitoring and readiness for FedRAMP or client audits.
Baselines
Three levels based on impact
Low
For systems whose compromise would have a limited effect.
Moderate
Serious effect. The most widely used baseline, also in FedRAMP Moderate.
High
Severe or catastrophic effect on operations, assets or individuals.
There is also a privacy baseline, which applies when the system processes personal information.
Why NIST SP 800-53
A framework that speaks your clients’ language
US contracts
You meet the requirements of federal agencies and contractors.
Path to FedRAMP
Your cloud service is ready for authorization.
Mapping to ISO 27001
NIST publishes mappings to other frameworks, so you reuse your work.
Measurable controls
Each control has defined assessment procedures.
Who it applies to
Government, contractors and regulated sectors
- US government suppliers
- Cloud services pursuing FedRAMP
- Defense and aerospace
- Banks and insurers
- Critical infrastructure
- Companies seeking a detailed controls catalog
FAQ
What clients ask us most
What is NIST SP 800-53?
It is the security and privacy controls catalog of the US National Institute of Standards and Technology, now in revision 5.
Can you get certified?
It is not a certification: control compliance is assessed. For government cloud services, FedRAMP grants authorizations based on SP 800-53.
How is it different from the NIST Cybersecurity Framework?
The CSF defines high-level cybersecurity outcomes; SP 800-53 details the specific controls to achieve them.
Is it useful if I already have ISO 27001?
Yes. NIST publishes the mapping between both frameworks: you reuse much of the work and add the missing controls.
Need to demonstrate NIST controls?
We choose the right baseline and take you to an assessment without surprises.