NIST SP 800-53 Rev. 4 (Low Impact Baseline)

Why does it matter?

A low categorization is the usual result for public-facing and administrative systems, and the Rev. 4 low baseline was the floor that FIPS 200 set for them: Section 3 of FIPS 200 requires one of the three appropriately tailored baselines in SP 800-53, and the low baseline is the one for a system whose three objectives are all low. Appendix D describes the baselines as hierarchical, so a low system that is later recategorized keeps everything here and adds to it. Old authorization packages, cloud service descriptions and vendor questionnaires still name the Rev. 4 low baseline, which is why its contents are worth reading even though the publication is withdrawn.

Key benefits include:

• A defined floor

115 controls and 9 enhancements in NIST's OSCAL profile, so a low system owner knows the minimum set before tailoring begins (Appendix D, Table D-2).

• Every family represented

The low column selects at least one control from each of the seventeen Appendix F families, from AC-1 to SI-12, so no area of protection is skipped at the lowest level.

• Priority codes for a small team

Table D-1 gives each selected control a P1, P2 or P3 code, so a team with limited staff can implement the policy, access and audit controls that others depend on first.

• Scoping written for small systems

Section 3.2 names public access, limited functionality, single-user operation and non-persistence as grounds to tailor, the cases low systems meet most often.

• A clear path to the current edition

The Rev. 5 low baseline in SP 800-53B keeps the same selection rule, so a Rev. 4 low package can be mapped control by control.

How does it work?

Categorization comes first. Following FIPS 199, the organization lists the information types the system processes, stores or transmits, rates confidentiality, integrity and availability for each, takes the highest value per objective as the system's security category, and takes the highest of the three as the FIPS 200 impact level (the Implementation Tip in Section 3.1 sets out these four steps). Only when every objective is low does the system qualify for the low baseline; a single moderate rating on any objective moves it to the moderate baseline.

Reading the low column of Table D-2 is straightforward: a control number in the column means the base control is selected, a number followed by enhancement numbers in parentheses means those enhancements are selected too, and Not Selected means the control is left to tailoring. At low the column is almost entirely base controls; the nine enhancements are confined to authentication and acquisition, for example IA-2(1) network access to privileged accounts and SA-4(10) use of approved PIV products. Each row also carries the Table D-1 priority code that orders implementation, and withdrawn controls such as AC-13 are marked with dashes.

Tailoring follows Section 3.2 in six steps: identify common controls the agency already provides, apply scoping considerations, select compensating controls from Appendix F where a baseline control cannot be met, assign values to organization-defined parameters, supplement the baseline where a risk assessment demands it, and add specification detail for implementation. The organization does not remove controls for convenience; every tailoring decision needs a mission or business rationale and an explicit risk determination, and Section 3.4 requires the final control set, the rationale and any use restrictions to be recorded in the security plan that supports the authorization decision.

Key Elements

• Trigger (Section 3.1)

All three FIPS 199 objectives rated low; the FIPS 200 high water mark then yields a low impact level and the low baseline from Appendix D.

• Size (OSCAL profile, version 2015-01-22)

124 items: 115 base controls and 9 control enhancements, listed in NIST's machine-readable profile of the Rev. 4 low baseline.

• Low column of Table D-2 (Appendix D)

Shows the control number where selected and Not Selected where not; for example AC-2 Account Management is the base control at low and AC-2 (1) (2) (3) (4) at moderate.

• The nine enhancements

IA-2(1), IA-2(12), IA-5(1), IA-5(11), IA-8(1), IA-8(2), IA-8(3), IA-8(4) and SA-4(10), all concerned with authentication and the acquisition of PIV-capable products.

• Priority codes (Table D-1)

Each selected control carries P1, P2 or P3 to set the order of implementation, and P0 means no baseline selects it.

• Scoping considerations (Section 3.2)

Allocation and placement, operational and environmental factors (mobility, single-user systems, connectivity, limited functionality, non-persistence, public access), security objective, technology, mission and policy.

• Security plan (Section 3.4)

The record of the tailored low baseline, its rationale and any controls tailored out, approved as part of the plan.

What does it cover?

The Rev. 4 low baseline applied to federal information systems, other than national security systems, that FIPS 199 categorized as low on every objective; the publication's Authority page allows nongovernmental organizations to use it voluntarily and CNSS Instruction 1253 covers national security systems. It supplied security controls only: the Appendix J privacy controls were selected separately under the SAOP/CPO rather than by impact level. Since the withdrawal on September 23, 2021 the baseline is not current for any new selection, because FIPS 200 requires the most current version of SP 800-53 as amended; it stays relevant to low systems whose authorization still cites it and to records that reference its control numbers.

What are its objectives?

Within the Rev. 4 selection process the low baseline exists to:

Provide the initial set of security controls for a low-impact information system, chosen by the FIPS 200 impact level (Section 2.3).

Keep protection commensurate with the potential adverse impact of a loss of confidentiality, integrity or availability (Section 3.1).

Serve as the starting point from which controls are removed, added or specialized through tailoring (Sections 3.1 and 3.2).

Order implementation through the Table D-1 priority codes so that controls other controls depend on come first.

Produce a documented, defensible control set in the security plan for the authorizing official (Section 3.4).

Framework in Context

The low baseline was Step 2 of the Risk Management Framework in SP 800-37 Rev. 1, after Step 1 categorization and before implementation, assessment with SP 800-53A Rev. 4, authorization and monitoring. Rev. 5 and SP 800-53B replaced it on the same trigger: Section 2.2 of SP 800-53B still defines a low-impact system as one in which all three objectives are low, and NIST's OSCAL Release 5.2.0 profile of the Rev. 5 low baseline lists 149 items (131 controls and 18 enhancements), with a separate privacy baseline that applies regardless of impact level. Control selection now follows SP 800-37 Rev. 2, the current RMF.

Common Framework Mappings

The Rev. 4 low baseline is commonly mapped to the frameworks and programs that used it as their entry tier while it was current, so that a low-impact control set can be reused across assessments.

Mapped frameworks include:

CIS Controls v8.1

FedRAMP Rev. 5

HIPAA

ISO 27002:2022

ISO 27701

NIST CSF 2.0

PCI DSS 4.0.1

SOC 2