NIST SP 800-53 Rev. 4 (Moderate Impact Baseline)

Why does it matter?

Moderate was the working baseline of federal systems under Rev. 4: FIPS 199 rates a system by the highest impact across its information types, so a single information type rated moderate on one objective brings the whole system to this baseline, and FIPS 200 then requires the matching tailored baseline from SP 800-53. The step from low is the largest of the three, 137 additional items that introduce separation of duties, least privilege, change control, alternate sites, incident response testing and protection of information in transit and at rest. Cloud services authorized at the moderate level and contractor systems assessed against it still carry these Rev. 4 identifiers in their records.

Key benefits include:

• The step up that matters most

Moderate adds 44 base controls and 93 enhancements to the low set in NIST's OSCAL profile, among them AC-5, AC-6, CM-3, CP-7 and SC-8, so the difference from low is substantive rather than incremental.

• Protection in transit and at rest

SC-8 Transmission Confidentiality and Integrity, SC-28 Protection of Information at Rest and SI-7 Software, Firmware, and Information Integrity are Not Selected at low and selected at moderate (Table D-2).

• Continuity beyond a written plan

CP-6 Alternate Storage Site, CP-7 Alternate Processing Site, CP-8 Telecommunications Services and the CP-4 (1) testing enhancement appear for the first time in the moderate column.

• Downgrading with a rule

Section 3.2 lists the controls that support a single security objective and may be downgraded when the system is moderate on a different objective, subject to three conditions.

• A direct successor

SP 800-53B keeps the same moderate trigger in Section 2.2, and NIST's OSCAL Release 5.2.0 profile of the Rev. 5 moderate baseline lists 177 controls and 110 enhancements.

How does it work?

The organization reaches the moderate baseline through FIPS 199 categorization: each information type is rated for confidentiality, integrity and availability, the system takes the highest value per objective, and the FIPS 200 high water mark across the three objectives gives the impact level (Section 3.1). A system with security category {(confidentiality, moderate), (integrity, low), (availability, low)} is a moderate-impact system, and so is one rated moderate on all three; only a high rating on any objective moves it to the high baseline. Section 3.1 also records the assumptions behind the baselines, such as networked, multi-user, general-purpose systems in physical facilities, and lists what no baseline addresses: insider threats, classified information, advanced persistent threats and connections across security domains.

The moderate column of Table D-2 is read control by control. Where low shows AC-2, moderate shows AC-2 (1) (2) (3) (4), the base control plus four enhancements; where low shows Not Selected for AC-4, moderate shows AC-4. Many controls gain enhancements rather than appearing anew: AU-9 adds (4), CM-7 adds (1) (2) (4), CM-8 adds (1) (3) (5), SI-3 adds (1) (2) and PE-6 adds (1). The Table D-1 priority code travels with each control, and a control such as AC-10 Concurrent Session Control, Not Selected at moderate and selected only at high, marks where the next baseline begins.

Tailoring under Section 3.2 then shapes the set. Common controls provided by the agency are designated and inherited; scoping considerations remove controls whose assumptions fail; the security objective-related considerations allow single-objective controls to be downgraded; compensating controls are drawn from Appendix F with a rationale and an accepted risk; parameter values in assignment and selection statements are fixed; and the baseline is supplemented where the risk assessment finds gaps, for example where insider threat or cross-domain traffic applies. Section 3.4 requires the outcome and its rationale in the security plan, and Section 3.3 lets a community of interest capture the same decisions once as an overlay.

Key Elements

• Trigger (Section 3.1)

At least one FIPS 199 objective rated moderate and none rated high, by the FIPS 200 high water mark.

• Size (OSCAL profile, version 2015-01-22)

261 items: 159 base controls and 102 control enhancements, 137 more than the low baseline.

• Base controls new at moderate (Table D-2)

Forty-four, including AC-4, AC-5, AC-6, AC-11, AC-12, AU-7, CM-3, CM-5, CM-9, CP-6, CP-7, CP-8, IA-3, IR-3, MP-3, MP-4, MP-5, PL-8, SA-8, SA-10, SA-11, SC-2, SC-4, SC-8, SC-28, SI-7, SI-8, SI-10 and SI-16.

• Enhancements new at moderate (Table D-2)

Ninety-three, for example AC-2 (1) to (4), AC-6 (1) (2) (5) (9) (10), AC-17 (1) to (4), CP-2 (1) (3) (8), CP-4 (1), CP-9 (1), RA-5 (1) (2) (5), SC-7 (3) (4) (5), SI-3 (1) (2) and SI-4 (2) (4) (5).

• Security objective-related considerations (Section 3.2)

Controls that support only confidentiality, only integrity or only availability are listed as downgrade candidates, with CP-2(1) as the worked example and three conditions on any downgrade.

• Priority codes (Table D-1)

Implementation runs P1, then P2, then P3; a P0 control is in the catalog but in none of the baselines; selection decisions never rest on the code.

• Security plan (Section 3.4)

Holds the tailored moderate baseline, the rationale for each decision and any system use restrictions, as the basis of the authorization decision.

What does it cover?

The Rev. 4 moderate baseline applied to federal information systems, other than national security systems, that FIPS 199 placed at moderate on at least one objective and high on none; the Authority page allows nongovernmental organizations to use the publication voluntarily, and CNSS Instruction 1253 covers national security systems. It contained security controls only, since the Appendix J privacy controls were selected under the SAOP/CPO rather than by impact level. From September 23, 2021 it is not a valid starting point for a new selection, because FIPS 200 requires the most current version of SP 800-53 as amended, but it remains the reference for moderate systems whose authorization and assessment records still cite it.

What are its objectives?

Within the Rev. 4 selection process the moderate baseline exists to:

Provide the initial control set for a moderate-impact system, chosen by the FIPS 200 impact level rather than objective by objective (Sections 2.3 and 3.1).

Raise protection above the low baseline in step with the greater potential adverse impact, through 44 added controls and 93 added enhancements.

Allow single-objective controls to be downgraded where the system is moderate on another objective, under the three conditions in Section 3.2.

Serve as the starting point for tailoring, overlays (Section 3.3) and supplementation driven by the risk assessment.

Leave a documented, defensible control set in the security plan for the authorizing official (Section 3.4).

Framework in Context

The moderate baseline was selected at RMF Step 2 of SP 800-37 Rev. 1, after FIPS 199 categorization at Step 1, and assessed with the procedures of SP 800-53A Rev. 4. Its successor is the moderate baseline in SP 800-53B, which Section 2.2 of that publication triggers on the same rule (at least one objective moderate, none high) and which NIST's OSCAL Release 5.2.0 profile lists at 287 items, 177 controls and 110 enhancements; the SP 800-53B privacy baseline applies in addition, irrespective of impact level. Tailoring at the organization and system level is now covered by Tasks P-4 and S-2 of SP 800-37 Rev. 2.

Common Framework Mappings

The Rev. 4 moderate baseline is commonly mapped to the frameworks and authorization programs that adopted it as their middle tier while it was current, so that moderate-level evidence can be reused across them.

Mapped frameworks include:

CIS Controls v8.1

COBIT 2019

FedRAMP Rev. 5

HIPAA

ISO 27001:2022

NIST CSF 2.0

PCI DSS 4.0.1

SOC 2