- ClassificationCategoryCybersecurityDomainCybersecurityFramework FamilyNIST Special Publications
- Regulatory ContextTypeControl FrameworkLegal InstrumentGuidelineSectorGovernment SectorIndustryGovernment & Public Sector
- Region / PublisherRegionGlobalRegion DetailUnited StatesPublisherNational Institute of Standards and Technology (NIST), Joint Task Force
- VersioningVersionSP 800-53B, baselines for SP 800-53 Rev. 5 (Release 5.2.0, August 27, 2025, no baseline changes)Effective DateOctober 2020 (cover date; the CSRC record says September 2020); updates as of December 10, 2020Issue DateOctober 2020 (cover date; the CSRC record says September 2020); updates as of December 10, 2020
- AdoptionAdoption ModelRegulatory ComplianceImplementation ComplexityHigh
- Official ReferenceOpen Link in New TabSource
License included / downloadable: Yes
SP 800-53B is a NIST publication, free of charge and not subject to copyright in the United States; NIST asks for attribution. The Control Baselines spreadsheet and the OSCAL baseline profiles are also free from NIST.
Framework text is licensed by its publisher and is included only where stated above.
- NIST SP 800-53B assigns controls from SP 800-53 Rev. 5 to low, moderate, and high security baselines and one privacy baseline.
- Published October 2020 with updates as of December 10, 2020; Release 5.2.0 of August 27, 2025 made no baseline changes.
- Implementing a minimum set of controls is mandatory for federal systems under OMB Circular A-130 and FISMA; others may use the baselines voluntarily.
- NIST's OSCAL profiles list 149 controls and enhancements in the low baseline, 287 moderate, 370 high, and 96 privacy.
- An organization categorizes under FIPS 199, applies the high water mark, selects the matching baseline, and tailors it under section 2.4.
Overview
NIST SP 800-53B, Control Baselines for Information Systems and Organizations, published in October 2020 with updates as of December 10, 2020, assigns controls from NIST SP 800-53 Rev. 5 to three security control baselines (low-impact, moderate-impact and high-impact) and to one privacy control baseline. For federal information systems, implementing a minimum set of controls from SP 800-53 Rev. 5 is mandatory under OMB Circular A-130 and the Federal Information Security Modernization Act (FISMA); any other organization that processes, stores or transmits information may use the baselines voluntarily (section 1.1).
The baselines are starting points, not finished control sets. An organization categorizes its system under FIPS 199, applies the high water mark of the confidentiality, integrity and availability impact levels, selects the matching baseline and then tailors it under section 2.4. NIST's OSCAL profiles for SP 800-53 release 5.2.0 list 149 controls and enhancements in the low baseline, 287 in the moderate baseline, 370 in the high baseline and 96 in the privacy baseline.
SP 800-53B is part of the SP 800-53 Rev. 5 family with SP 800-53A. NIST issued a minor release, Release 5.2.0, on August 27, 2025; it made no changes to the baselines, and the SP 800-53B version number was updated for consistency with SP 800-53 and SP 800-53A. The publication is free from NIST and is not subject to copyright in the United States.
Why does it matter?
SP 800-53B answers the question every federal system owner faces after categorization: which of the hundreds of controls in SP 800-53 Rev. 5 apply here? It does so by impact level, so a low-impact system and a high-impact system do not start from the same list, and it adds a privacy baseline for systems that process personally identifiable information. NIST expects tailoring to be defensible and recorded: every control in the selected baseline is accounted for, and any control tailored out carries a rationale in the system security and privacy plan, approved by responsible officials.
Key benefits include:
- Selection by impact level
Section 2.2 defines a low-impact system as one where all three security objectives are low, a moderate-impact system as one with at least one moderate and none high, and a high-impact system as one with at least one high.
- A separate privacy baseline
The privacy control baseline applies irrespective of impact level, and footnote 17 warns that using it does not mean an agency has met all its OMB A-130 privacy obligations.
- Tailoring that leaves a record
Section 2.4 requires the risk-based justification for tailoring decisions to be documented in system security and privacy plans, and says organizations do not arbitrarily remove controls.
- Stated assumptions
Section 2.3 lists the assumptions behind the baselines, such as persistent information, multi-user and networked systems, and an organization with the resources to implement the controls.
- Overlays for communities
Appendix C describes overlays for sectors, technologies and environments; footnote 38 cites an industrial control systems overlay in SP 800-82.
How does it work?
Section 2.2 starts with security categorization under FIPS 199, which rates each system low, moderate or high for confidentiality, integrity and availability. The high water mark concept, used in FIPS 200, sets the system's impact level, and the impact level selects one of the three security baselines in Chapter Three. Tables 3-1 to 3-20 mark each control and control enhancement with an x in the low, moderate, high or privacy column, and withdrawn controls are marked W with a note on where they went.
Section 2.4 tailors the baseline through six activities: identifying and designating common controls, applying scoping considerations, selecting compensating controls, assigning values to organization-defined parameters, supplementing the baseline with additional controls and enhancements, and providing specification information. Footnote 24 says it is inappropriate to tailor out controls that pertain to applicable federal legislative, regulatory or policy requirements, and OMB may prohibit tailoring specific controls.
Scoping considerations cover implementation and placement, operational and environmental factors (mobile, single-user, air-gapped, IoT and similar systems), technology, mission and business, security objectives, and legal and policy. For example, a system that is moderate-impact only because confidentiality or integrity is moderate, with low availability, may forgo availability-only controls such as CP-2(1), if a risk assessment supports the decision.
Key Elements
- Three security baselines
Low, moderate and high, selected by system impact level; the OSCAL release 5.2.0 profiles list 149, 287 and 370 controls and enhancements.
- One privacy baseline
An initial baseline of 96 controls and enhancements for federal agencies, tailored through privacy risk assessments that consider the nature of the PII processing.
- Chapter Three tables
Tables 3-1 to 3-20 follow the 20 control families of SP 800-53 Rev. 5, from Access Control (AC) to Supply Chain Risk Management (SR).
- Baseline assumptions
Section 2.3 names five working assumptions and five that the baselines do not address, such as insider threats, classified information and advanced persistent threats.
- Tailoring and capabilities
Section 2.4 defines tailoring; section 2.5 groups mutually reinforcing controls into capabilities, such as secure remote authentication through IA-2(1), IA-2(2), IA-2(8), IA-2(9) and SC-8(1).
- Overlays
Appendix C describes overlays that add, modify or remove controls for communities of interest, technologies and environments of operation.
What does it cover?
The baselines are for federal information and information systems, which include systems used or operated by an agency, a contractor of an agency or another organization on behalf of an agency. Systems designated as national security systems are not subject to FISMA requirements, though the controls may be selected for them, and CNSS Instruction No. 1253 provides their categorization and control selection guidance. Section 1.1 states that any organization that processes, stores or transmits information, including state, local and tribal governments and private sector organizations, can implement the baselines. The target audience in section 1.2 runs from authorizing officials and senior agency officials for privacy to system owners, assessors and auditors.
What are its objectives?
Section 1.1 states what the publication sets out to do.
Establish security and privacy control baselines for federal information systems and organizations.
Provide tailoring guidance so the baselines can be adapted to specific requirements and risks.
Help satisfy the security and privacy requirements in FISMA, the Privacy Act of 1974, selected OMB policies such as A-130 and designated Federal Information Processing Standards.
Supply working assumptions that inform control selection.
Give guidance on overlays for communities of interest.
Framework in Context
SP 800-53B derives its baselines from the control catalog in SP 800-53 Rev. 5, which NIST published in September 2020, and follows OMB A-130, FIPS 199 and FIPS 200. SP 800-37 sets out the Risk Management Framework and the two control selection approaches: the baseline approach this publication supports and an organization-generated approach it does not address. SP 800-30 guides the risk assessment, SP 800-60 the assignment of security categories and SP 800-18 the system security plan. NIST publishes mappings between SP 800-53 Rev. 5 and the Cybersecurity Framework, the Privacy Framework and ISO/IEC 27001:2022, and cautions that they are not always one-to-one.
Common Framework Mappings
NIST publishes mappings and crosswalks between SP 800-53 Rev. 5 and other frameworks, and warns against assuming equivalency from relationship tables alone; organizations map the baselines to the frameworks below with that caution in mind.
Mapped frameworks include:
CIS Controls v8.1
FedRAMP Rev. 5
HIPAA
ISO 27001:2022
ISO 27002:2022
NIST CSF 2.0
PCI DSS 4.0.1
SOC 2
How SmartSuite Supports NIST SP 800-53B
SmartSuite provides the system for managing controls, evidence, mappings, assessments, and reporting.
Use Compliance Management to hold the controls of the selected baseline as requirements, each linked to the policy, test and evidence that satisfies it, and Cyber & IT Risk for the security controls and vulnerabilities behind them. Third Party Risk Management tracks suppliers against the supply chain and acquisition controls, so tailoring decisions, inherited controls and evidence stay in one place.
Baseline Control Library
Load the controls and enhancements of the selected low, moderate or high baseline, plus the privacy baseline where it applies, as requirements with owner, status and linked evidence.
Tailoring Decisions
Record each tailoring action (common control, scoping consideration, compensating control, parameter value or supplement) with its risk-based rationale and approver, as section 2.4 expects.
Common Control Inheritance
Track which controls a common control provider supplies and which systems inherit them, with the provider's current implementation and assessment information.
System Categorization Record
Hold the confidentiality, integrity and availability impact levels for each system, the high water mark and the baseline selected.
Control Testing and Evidence
Schedule control tests and attach results and evidence to each control in Compliance Management.
Supplier and Acquisition Controls
Track suppliers against the SR and SA family controls in Third Party Risk Management, with assessments and contract requirements.
Related frameworks
CIS Controls v8.1 is a prioritized set of 18 Controls and 153 Safeguards, in three Implementation Groups, with a new Govern function.
FedRAMP Rev5 is the legacy FedRAMP certification type: NIST SP 800-53 Rev. 5 baselines, 3PAO assessment and agency authorization for cloud services used by U.S. agencies.
ISO/IEC 27001:2022 specifies requirements for an information security management system: Clauses 4 to 10, risk treatment, the Statement of Applicability and 93 Annex A controls.
MITRE ATT&CK is a free knowledge base of adversary tactics, techniques and sub-techniques from The MITRE Corporation, updated twice a year; the current release is v20.0.
NIST CSF 2.0 (CSWP 29, February 26, 2024) is the voluntary cybersecurity framework with six Functions including Govern, 22 Categories, 106 Subcategories, Profiles and Tiers.
Frequently Asked Questions For NIST Control Baselines (Revision 5)
It assigns controls and control enhancements from SP 800-53 Rev. 5 to three security control baselines (low-impact, moderate-impact and high-impact) and one privacy control baseline in Tables 3-1 to 3-20 of Chapter Three. Chapter Two explains how to select a baseline, the assumptions behind them, tailoring, and capabilities, and Appendix C gives guidance on overlays.
Section 2.2 uses the FIPS 199 security category of the system for confidentiality, integrity and availability, and the FIPS 200 high water mark sets the impact level. A system is low-impact only if all three objectives are low, moderate-impact if at least one is moderate and none is high, and high-impact if at least one is high. The impact level selects the baseline in Chapter Three.
For federal information and information systems, implementing a minimum set of controls from SP 800-53 Rev. 5 is mandatory under OMB Circular A-130 and FISMA (section 1.1). The privacy control baseline itself is not mandated by law or A-130. Nongovernmental organizations may use the publication on a voluntary basis, and national security systems are not subject to FISMA requirements.
Section 2.4 requires every control from the selected baseline to be accounted for. Tailoring decisions, with their risk-based justification, are recorded in the system security and privacy plans and approved by responsible officials. Organizations may not tailor out controls that pertain to applicable federal legislative, regulatory or policy requirements.
No. NIST issued SP 800-53 Release 5.2.0 on August 27, 2025, and its planning note says the SP 800-53B release includes no changes to the baselines. The SP 800-53B version number was updated for consistency with SP 800-53 and SP 800-53A.
Put this framework to work in SmartSuite
Manage controls, risks, evidence, and audits in one platform designed for modern governance, risk, and compliance.