NIST SP 800-53 Rev. 4 (High Impact Baseline)

Why does it matter?

A high rating on one objective is enough: a system whose loss of availability would be severe takes the whole high baseline even if its confidentiality is low, because FIPS 200 uses the high water mark and Section 3.1 of Rev. 4 maps that level to the high column of Appendix D. The baseline is where Rev. 4 placed its developer-facing and supply chain controls (SA-12, SA-15, SA-16, SA-17), its strongest contingency and audit enhancements and its only penetration testing control (CA-8). Systems authorized at high under Rev. 4 carry the largest packages to migrate, and their assessment records still cite these identifiers.

Key benefits include:

• Developer and supply chain controls arrive

SA-12 Supply Chain Protection, SA-15, SA-16 and SA-17 are Not Selected at low and moderate and selected at high (Table D-2), the first point at which Rev. 4 made these obligations part of a baseline.

• Penetration testing becomes baseline

CA-8 Penetration Testing is selected only in the high column, so a high system is tested beyond control-by-control review.

• Contingency planning at full strength

The high baseline adds thirteen Contingency Planning enhancements to the moderate set, including CP-2 (2) (4) (5), CP-4 (2), CP-6 (2), CP-7 (4), CP-8 (3) (4) and CP-9 (2) (3) (5).

• Audit records protected and attributable

AU-10 Non-repudiation, AU-5 (1) (2) and AU-9 (2) (3) are selected only at high, alongside AU-12 (1) (3) and AU-6 (5) (6).

• A direct Rev. 5 successor

SP 800-53B keeps the trigger (any objective high), and NIST's OSCAL Release 5.2.0 profile of the Rev. 5 high baseline holds 188 controls and 182 enhancements.

How does it work?

Categorization decides the baseline. Under FIPS 199 the organization rates confidentiality, integrity and availability for every information type the system processes, stores or transmits, takes the highest value per objective as the system's security category, and takes the highest of the three as the FIPS 200 impact level; the Implementation Tip in Section 3.1 lays out these four steps. If any objective is high, the system is high-impact and the organization selects the high column of Table D-2 (RMF Step 2). National security systems follow CNSS Instruction 1253 instead.

Reading the high column shows how the baseline grows. Controls present at every level gain enhancements, so IR-2 Incident Response Training is the base control at low and moderate and IR-2 (1) (2) at high, CP-9 Information System Backup moves from (1) at moderate to (1) (2) (3) at high, and CM-8 Information System Component Inventory from (1) (3) (5) to (1) (2) (3) (4) (5). Eleven base controls appear for the first time, and CM-7 swaps enhancement (4) for (5). The Table D-1 priority code on each row orders implementation, P1 before P2 before P3, while P0 marks catalog controls such as SA-13 Trustworthiness and SA-18 Tamper Resistance and Detection that no baseline selects.

Tailoring follows Section 3.2: designate common controls, apply scoping considerations, select compensating controls from Appendix F, assign parameter values, supplement the baseline and add specification detail. The security objective-related considerations apply to high systems too: where a system is high only for confidentiality, controls that support availability alone, such as CP-2 (2), CP-4 (2) and CP-9 (2) (3) (5), may be downgraded to the moderate entry under three conditions. Section 3.4 requires the tailored baseline and the rationale in the security plan, and Section 3.3 lets a community of interest publish an overlay so the same decisions are made once.

Key Elements

• Trigger (Section 3.1)

At least one FIPS 199 objective rated high; the FIPS 200 high water mark gives a high impact level and the high column of Appendix D.

• Size (OSCAL profile, version 2015-01-22)

343 items: 170 base controls and 173 control enhancements, 83 more than the moderate baseline (11 base controls and 72 enhancements).

• Eleven high-only base controls (Table D-2)

AC-10, AU-10, CA-8, PE-18, SA-12, SA-15, SA-16, SA-17, SC-3, SC-24 and SI-6, each Not Selected at low and moderate.

• High-only enhancements (Table D-2)

Seventy-two, for example AC-2 (5) (11) (12) (13), AC-6 (3), CM-5 (1) (2) (3), CM-6 (1) (2), CP-2 (2) (4) (5), IR-4 (4), MA-4 (3), MP-6 (1) (2) (3), SC-7 (8) (18) (21) and SI-7 (2) (5) (14).

• CM-7 Least Functionality

Enhancements (1) (2) (4) at moderate and (1) (2) (5) at high, the one place where the high column replaces a moderate enhancement rather than adding to it.

• Priority codes (Table D-1)

The code on each Table D-2 row sequences the work, P1 ahead of P2 ahead of P3, while P0 identifies catalog controls outside every baseline.

• Security plan (Section 3.4)

Records the tailored high baseline, each tailoring rationale and any use restrictions, for the authorizing official.

What does it cover?

The Rev. 4 high baseline applied to federal information systems, other than national security systems, that FIPS 199 placed at high on at least one objective; the Authority page permits voluntary use by nongovernmental organizations, and CNSS Instruction 1253 governs national security systems. It is a security baseline only: the Appendix J privacy controls were selected under the SAOP/CPO without regard to impact level. Since the withdrawal on September 23, 2021 the baseline cannot start a new selection, as FIPS 200 requires the most current version of SP 800-53 as amended, but it remains the reference for high systems whose authorization packages, assessment reports and contracts still name it.

What are its objectives?

Within the Rev. 4 selection process the high baseline exists to:

Provide the initial control set for a high-impact system, where a loss of any one objective could have severe consequences (Sections 2.3 and 3.1).

Bring developer, supply chain, penetration testing and fail-safe controls (SA-12 to SA-17, CA-8, SC-24) into the baseline for the first time.

Strengthen controls present at lower levels through 72 further enhancements, in audit, contingency planning, configuration and media protection in particular.

Serve as the starting point for tailoring, downgrading of single-objective controls and supplementation under Section 3.2.

Give the authorizing official a security plan that records the final control set and the reasoning behind it (Section 3.4).

Framework in Context

The high baseline was chosen at RMF Step 2 of SP 800-37 Rev. 1 and assessed with SP 800-53A Rev. 4. Its successor is the high baseline in SP 800-53B, triggered by Section 2.2 of that publication on the same rule and listed by NIST's OSCAL Release 5.2.0 profile at 370 items (188 controls and 182 enhancements); the Rev. 5 version adds SA-21 Developer Screening and SR-9 Tamper Resistance and Detection as high-only controls, moves SA-12 into the new Supply Chain Risk Management family and selects SA-15 from moderate upward, with the SP 800-53B privacy baseline applying in addition. Authorization today runs under SP 800-37 Rev. 2.

Common Framework Mappings

The Rev. 4 high baseline is commonly mapped to the frameworks and authorization programs that used it as their top tier while it was current, so that high-level evidence can be reused across assessments.

Mapped frameworks include:

CIS Controls v8.1

CSA CCM v4

FedRAMP Rev. 5

FISMA

ISO 27001:2022

NIST CSF 2.0

PCI DSS 4.0.1

SOC 2