NIST SP 800-53 Rev. 5

Why does it matter?

SP 800-53 is the control catalog behind every federal authorization and behind the programs that borrow its vocabulary. Section 1.1 states that the controls are mandatory for federal information systems, including systems operated by contractors on behalf of an agency, and that the catalog also serves as a common lexicon for security, privacy and risk management. Revision 5 made the controls outcome-based by removing the responsible entity from each control statement, merged security and privacy into one catalog and added a supply chain family, so one set of controls now covers the three concerns an authorizing official has to accept.

Key benefits include:

• One catalog for security and privacy

The Revision 5 changes list integrates information security and privacy controls into a consolidated catalog, with the PT family covering PII processing and transparency.

• Controls that any organization can state as outcomes

Removing the responsible entity from the control statement lets the same control be implemented by a system, an organization or a developer.

• Supply chain covered

The SR family, Supply Chain Risk Management, is new in Revision 5 and is one of three families that address mandates emergent since FIPS 200 (Table 1 footnote).

• Selection separated from the catalog

Baselines and tailoring guidance moved to SP 800-53B, so the catalog can be used with the RMF, the Cybersecurity Framework, the Privacy Framework or a systems engineering process.

• A maintained catalog

Release 5.2.0 of August 27, 2025 shows the catalog is revised through a public process (Section 1.5), with the changes listed on the CSRC record and matching SP 800-53A procedures.

How does it work?

Chapter Two gives the fundamentals. Section 2.1 separates requirements from controls; Section 2.2 explains the structure: 20 families with two-character identifiers, each control with a control section, a discussion, related controls, control enhancements and references, and organization-defined parameters set by assignment and selection operations (the example in the text is AU-4, Audit Storage Capacity). Section 2.3 gives the three implementation approaches, common, system-specific and hybrid; Section 2.4 explains how security and privacy controls relate; Section 2.5 covers trustworthiness and assurance.

Chapter Three is the catalog, one section per family: Access Control (3.1), Awareness and Training (3.2), Audit and Accountability (3.3), Assessment, Authorization and Monitoring (3.4), Configuration Management (3.5), Contingency Planning (3.6), Identification and Authentication (3.7), Incident Response (3.8), Maintenance (3.9), Media Protection (3.10), Physical and Environmental Protection (3.11), Planning (3.12), Program Management (3.13), Personnel Security (3.14), PII Processing and Transparency (3.15), Risk Assessment (3.16), System and Services Acquisition (3.17), System and Communications Protection (3.18), System and Information Integrity (3.19) and Supply Chain Risk Management (3.20). Appendix C summarizes the controls.

Families are alphabetical and controls numerical; the order implies no priority, and a withdrawn control's designation is not reused (Section 2.2). Of the 20 families, 17 align with the FIPS 200 minimum security requirements, while PM, PT and SR address program management, privacy and supply chain mandates that came after FIPS 200. Control enhancements add functionality or strength to a base control and always require the base control. Supplemental material on the CSRC record includes the Rev. 4 to Rev. 5 analysis, the Appendix J privacy mapping, mappings to the Cybersecurity Framework and Privacy Framework, a crosswalk to ISO/IEC 27001:2022 with the caution not to assume equivalency, and the OSCAL version of the controls.

Key Elements

• Twenty control families (Table 1)

AC, AT, AU, CA, CM, CP, IA, IR, MA, MP, PE, PL, PM, PS, PT, RA, SA, SC, SI and SR, with Program Management, PII Processing and Transparency and Supply Chain Risk Management covering mandates since FIPS 200.

• Control structure (Section 2.2)

Control statement, discussion, related controls, control enhancements and references, with organization-defined parameters for assignment and selection.

• Implementation approaches (Section 2.3)

Common (inheritable), system-specific and hybrid, which define the scope, inheritability and responsibility for each control.

• Security and privacy controls (Section 2.4)

One catalog serves both programs; controls may be security, privacy or both, selected in collaboration between the programs.

• Trustworthiness and assurance (Section 2.5)

Controls address functionality (the strength of mechanisms) and assurance (the confidence that controls are effective).

• Release 5.2.0 (August 27, 2025)

New SA-15(13), SA-24 and SI-02(07); revised SI-07(12); discussion updates to SA-04, SA-05, SA-08, SA-08(14), SI-02 and SI-02(05); related-control updates to all -01 controls, AU-02, AU-03, CA-07, IR-04, IR-06, IR-08, SA-15, SI-02 and SI-07.

• Control summaries (Appendix C)

Tables that list every control and enhancement by family for reference.

• Companions

SP 800-53B holds the low, moderate, high and privacy baselines; SP 800-53A Rev. 5 holds the assessment procedures; both received Release 5.2.0 updates.

What does it cover?

SP 800-53 Rev. 5 establishes controls for systems and organizations and can be implemented within any organization or system that processes, stores or transmits information (Section 1.1). Its use is mandatory for federal information systems, which include systems used or operated by an agency, by a contractor of an agency or by another organization on behalf of an agency, under OMB Circular A-130 and FISMA. National security systems are not subject to FISMA but may select the controls as otherwise required or with the approval of officials with policy authority. The controls are independent of the process used to select them, so the catalog serves the RMF, the Cybersecurity Framework, the Privacy Framework and systems engineering alike.

What are its objectives?

Section 1.1 and the Revision 5 changes list set out what the publication is for:

Provide a comprehensive and flexible catalog of security and privacy controls to meet current and future protection needs as threats, vulnerabilities, requirements and technologies change.

Help organizations satisfy the security and privacy requirements of FISMA, the Privacy Act of 1974, OMB policies and the designated FIPS.

Give organizations a common lexicon for discussing security, privacy and risk management.

Make the controls outcome-based and usable by enterprises, engineering organizations and industry partners building components, products and services.

Integrate security and privacy into one catalog and add supply chain risk management as a family.

Separate control selection from the controls so different communities of interest can use them, with baselines in SP 800-53B.

Framework in Context

SP 800-53 Rev. 5 sits between the process publications and the baselines. SP 800-37 Rev. 2 selects from the catalog in its Select step and the seventh objective of that update was to support the consolidated Revision 5 catalog; SP 800-53B marks which controls and enhancements fall into the low, moderate, high and privacy baselines; SP 800-53A Rev. 5 gives the assessment procedures. FIPS 200 requires agencies to use the most current version of SP 800-53, as amended, for their baselines. The CSRC record lists mappings to the Cybersecurity Framework, the Privacy Framework and ISO/IEC 27001:2022, each a general indication of coverage rather than an equivalence.

Common Framework Mappings

NIST SP 800-53 Rev. 5 is commonly mapped to the frameworks and standards for which NIST or others publish crosswalks, so one set of implemented controls can be reported against several requirements.

Mapped frameworks include:

CIS Controls v8.1

ISO 27001:2022

ISO 27002:2022

MITRE ATT&CK

NIST CSF 2.0

NIST 800-171 Rev. 3

NIST 800-37 Rev.2

SOC 2