NIST SP 800-53 Rev. 4

Why does it matter?

Rev. 4 carried weight because FIPS 200 made it the only source of a federal baseline: Section 3 of that standard says agencies must select one of the three appropriately tailored security control baselines in NIST SP 800-53 and must use the most current version as amended. From April 2013 until Rev. 5 took over, every FISMA authorization and most contract clauses that said "NIST 800-53" meant this text. Systems authorized against it are still in operation, open findings still cite its control numbers, and the Rev. 4 to Rev. 5 analysis that NIST published as supplemental material to Rev. 5 starts from the structure described on this page.

Key benefits include:

• One catalog for the federal enterprise

Appendix F gave seventeen control families, each control with supplemental guidance, enhancements, references and a priority and baseline allocation line, so agencies, assessors and vendors used one control vocabulary.

• Baselines sized to impact

Appendix D allocated controls to the low, moderate and high baselines by the FIPS 200 impact level, so a system's protection grew with the harm a loss of confidentiality, integrity or availability could cause (Section 3.1).

• Tailoring with a written rationale

Section 3.2 allowed common controls, scoping, compensating controls, parameter values and supplementation, on condition that each decision was defensible and recorded in the security plan.

• Overlays for communities of interest

Section 3.3 and the Appendix I template let a sector, technology or environment publish one specialized control set instead of tailoring system by system.

• Privacy beside security

Appendix J added eight privacy control families under the Senior Agency Official for Privacy or Chief Privacy Officer (SAOP/CPO), each aligned with one Fair Information Practice Principle, seven years before the integrated Rev. 5 catalog.

How does it work?

A Rev. 4 control has a fixed layout (Section 2.2): the control statement, supplemental guidance, control enhancements, references, and a priority and baseline allocation summary. Each control carries a family identifier and a number, for example AC-2 Account Management, and enhancements are numbered in parentheses, so the Table D-2 entry AC-2 (1) (2) (3) (4) is the moderate-baseline reading of that control. Section 2.4 lets a control be designated common (inherited by many systems), system-specific or hybrid, which decides who implements and documents it. Section 2.6 and Appendix E treat assurance, the confidence that a control is implemented correctly and operating as intended, as distinct from the functionality the control provides.

Selection follows Chapter 3. The organization categorizes the system under FIPS 199 for confidentiality, integrity and availability, takes the highest value as the FIPS 200 impact level (the high water mark) and picks the matching baseline from Appendix D (Section 3.1). It then tailors the baseline: designating common controls, applying scoping considerations such as mobility, single-user operation, limited connectivity and public access, selecting compensating controls from Appendix F, assigning values to organization-defined parameters, and supplementing the baseline where a risk assessment demands it (Section 3.2). Table D-1 priority codes P1 to P3 order the implementation; P0 marks a control that no baseline selects.

Every decision is written down. Section 3.4 requires the resulting control set and the rationale, including any control tailored out, to be documented in the security plan so the authorizing official can make an informed authorization decision; Figure 4 draws the path from initial baseline, through tailoring, to the tailored baseline. The process is iterative and is revisited as risk assessments change. Section 3.5 applies the same process from a requirements perspective to new systems, where the controls in the security plan become a specification for development, and from a gap-analysis perspective to legacy systems facing major upgrades, modifications or outsourcing.

Key Elements

• Seventeen families in Appendix F, PM in Appendix G

AC, AT, AU, CA, CM, CP, IA, IR, MA, MP, PE, PL, PS, RA, SA, SC and SI hold the system-level controls; the Program Management family (PM) in Appendix G covers the organization-wide information security program.

• Three baselines in Table D-2 (Appendix D)

The low, moderate and high columns show the control and the enhancements selected, or Not Selected; Appendix D describes the baselines as hierarchical, with each impact level meeting a stronger set of requirements than the one below.

• Priority codes (Table D-1)

P1 first, P2 next, P3 last, and P0 for a control selected in no baseline; the codes sequence implementation and are never used to decide what to select.

• Tailoring guidance (Section 3.2)

Six actions: identifying common controls, applying scoping considerations, selecting compensating controls, assigning parameter values, supplementing the baseline and providing additional specification information.

• Overlays (Section 3.3 and Appendix I)

A fully specified set of controls, enhancements and parameter values for a community of interest, technology or environment, built with the Appendix I template.

• Privacy control catalog (Appendix J)

Eight families, AP, AR, DI, DM, IP, SE, TR and UL, grounded in the Privacy Act of 1974, Section 208 of the E-Government Act of 2002 and OMB policy.

• Documentation of the selection (Section 3.4)

The security plan records the agreed control set, the tailoring rationale and the use restrictions the organization imposes, and is the basis of the authorization decision.

What does it cover?

Rev. 4 applied to federal information systems other than national security systems, by way of FIPS 200 and OMB Circular A-130; its Authority page adds that nongovernmental organizations may use it voluntarily and that the text is not subject to copyright in the United States. It covered the security controls of Appendix F, the organization-level program management controls of Appendix G and the privacy controls of Appendix J, while CNSS Instruction 1253 governed national security systems. Since September 23, 2021 none of this is current: FIPS 200 points to the most current version of SP 800-53 as amended, which is Rev. 5, and Rev. 4 remains relevant only to systems whose existing authorization still rests on it.

What are its objectives?

The abstract of Rev. 4 states what the catalog set out to do:

Protect organizational operations, assets, individuals, other organizations and the Nation from hostile cyber attacks, natural disasters, structural failures and human error.

Provide controls that are customizable and implemented as part of an organization-wide process for managing information security and privacy risk.

Address security and privacy requirements derived from legislation, Executive Orders, policies, directives, regulations, standards and mission or business needs.

Describe how to develop overlays, specialized control sets for particular missions, technologies or environments of operation.

Treat security from both a functionality perspective and an assurance perspective, so that systems built from component products are sufficiently trustworthy.

Framework in Context

Rev. 4 sat inside the Risk Management Framework of SP 800-37 Rev. 1: categorize under FIPS 199 (RMF Step 1), select from this catalog (RMF Step 2), then implement, assess, authorize and monitor, with SP 800-53A Rev. 4 supplying the assessment procedures. Rev. 5 (September 23, 2020, errata December 10, 2020, Release 5.2.0 August 27, 2025) replaced it, split the baselines into SP 800-53B and added the privacy and supply chain families; NIST published a Rev. 4 to Rev. 5 analysis and an Appendix J to Rev. 5 privacy mapping as supplemental material. The current RMF is SP 800-37 Rev. 2, which OMB Circular A-130 requires agencies to follow.

Common Framework Mappings

NIST SP 800-53 Rev. 4 is commonly mapped to the frameworks that reused its control numbering while it was current, which is why older crosswalks, assessment tools and vendor questionnaires still cite Rev. 4 identifiers.

Mapped frameworks include:

CIS Controls v8.1

COBIT 2019

FedRAMP Rev. 5

HIPAA (NIST SP 800-66 Rev. 2)

ISO 27001:2022

ISO 27002:2022

NIST CSF 2.0

PCI DSS 4.0.1

SOC 2