NIST SP 800-53

NIST Special Publication 800-53 Revision 5, "Security and Privacy Controls for Information Systems and Organizations", is the US federal catalog of security and privacy controls.

Revision 5 was published September 2020, with an update in December 2020 and further releases since; Release 5.2.0 of August 27, 2025 added controls on software update integrity and cyber resiliency in response to Executive Order 14306.

The catalog holds roughly 1,200 controls and enhancements across twenty families (access control, audit and accountability, configuration management, incident response, supply chain risk management, PII processing and transparency, and so on).

Baselines for low, moderate, and high impact systems and the privacy baseline are published separately in SP 800-53B, and assessment procedures in SP 800-53A. FedRAMP, DoD's Cloud SRG, StateRAMP, and many private frameworks derive their control sets from it, and NIST SP 800-171 is a tailored subset.

SP 800-53 is a catalog, not a certification, so nobody certifies "to 800-53" directly; the assessment happens inside the program that adopts a baseline.

What the catalog demands in writing is, for each selected control, a policy and procedure (every family starts with a -1 control requiring exactly that), the implementation description in the system security plan, and evidence that the control operates.

Organizations therefore end up with a full set of family-level policies, a system security plan that addresses each control, a tailoring record, and assessment evidence mapped control by control.