NIST SP 800-53B Rev. 5 (High Impact Baseline)

Why does it matter?

A single high rating pulls in the whole baseline: a system whose loss of availability would be severe takes the high baseline even when its confidentiality is low, because the FIPS 200 high water mark feeds Section 2.2 of SP 800-53B. The publication is where every Rev. 5 selection starts, since Rev. 5 removed the baselines from the catalog and Section 1.4 ties them to OMB Circular A-130, FIPS 199 and FIPS 200. The high baseline carries the developer, supply chain tamper-resistance and penetration testing controls that the lower baselines leave to tailoring, and the Release 5.2.0 planning note confirms that the August 27, 2025 release made no changes to the baselines.

Key benefits include:

• Developer obligations in the baseline

SA-16 Developer-Provided Training, SA-17 Developer Security and Privacy Architecture and Design and SA-21 Developer Screening are selected at high only (Table 3-17).

• Supply chain tamper protection

SR-9 Tamper Resistance and Detection and SR-9(1) are high-only entries in Table 3-20, the Supply Chain Risk Management family new in Rev. 5.

• Independent penetration testing

CA-8 Penetration Testing and CA-8(1) Independent Penetration Testing Agent or Team appear only in the high column of Table 3-4.

• A privacy baseline alongside

Section 2.2 adds a privacy control baseline that applies irrespective of impact level, so a high system processing PII carries both.

• Tailoring with written conditions

Section 2.4 lists the single-objective controls that may be downgraded and the three conditions any downgrade must meet, so a system that is high on one objective is not over-controlled on the others.

How does it work?

Selection begins with categorization. Section 2.2 takes the FIPS 199 rating of confidentiality, integrity and availability, applies the FIPS 200 high water mark and defines a high-impact system as one in which at least one security objective is high; a moderate-impact system has at least one moderate objective and none high, and a low-impact system is low on all three. The organization then reads the high column of Tables 3-1 to 3-20, where an x marks each control and enhancement in the baseline, a W marks a control withdrawn from the catalog, and a separate column marks the privacy baseline.

The tables show the baseline growing from the lower levels. CP-2 Contingency Plan is selected at all three levels, CP-2(1) at moderate and high, and CP-2(5) Continue Mission and Business Functions at high only; AC-2(5) Inactivity Logout enters at moderate, while AC-10 enters at high. The OSCAL profile counts 46 items in Access Control, 35 in Contingency Planning, 32 in Configuration Management, 30 in System and Communications Protection, 28 in System and Information Integrity, 26 in Identification and Authentication, 25 each in Audit and Accountability and Physical and Environmental Protection, 21 in System and Services Acquisition, 18 in Incident Response and 14 in Supply Chain Risk Management.

Tailoring under Section 2.4 follows: identify common controls, apply scoping considerations (implementation and placement, operational and environmental, technology, mission and business, security objective, legal and policy), select compensating controls from SP 800-53 with a rationale and accepted risk, assign organization-defined parameter values, supplement the baseline and add specification detail. A system that is high only for confidentiality may downgrade availability-only items such as CP-2(5), CP-4(2) and CP-9(5) to their moderate entries when the downgrade reflects the FIPS 199 category, is supported by a risk assessment and does not weaken protection of security-relevant information. Section 2.5 suggests defining capabilities before selecting controls, and Appendix C explains overlays and the Security Control Overlay Repository (SCOR).

Key Elements

• Trigger (Section 2.2)

At least one FIPS 199 security objective rated high; the FIPS 200 high water mark gives a high impact level and the high column of Chapter 3.

• Size (OSCAL Release 5.2.0 profile)

370 items: 188 base controls and 182 control enhancements, from 18 families; 83 more than the moderate baseline (11 base controls and 72 enhancements).

• Eleven high-only base controls (Tables 3-1 to 3-20)

AC-10, AU-10, CA-8, PE-18, SA-16, SA-17, SA-21, SC-3, SC-24, SI-6 and SR-9.

• High-only enhancements

Seventy-two, for example AU-9(2), CA-8(1), CM-5(1), CP-2(5), CP-4(2), CP-9(5), IA-2(5), IR-4(4), RA-5(4), SC-7(21), SI-4(22) and SR-9(1).

• Privacy control baseline (Section 2.2)

Applied irrespective of impact level under OMB Circular A-130; 96 items in the OSCAL profile; privacy enhancements require the base control.

• Tailoring guidance (Section 2.4)

Common controls, scoping, compensating controls, parameter values, supplementation and specification detail, with downgrade candidates listed by security objective.

• Overlays and capabilities (Appendix C, Section 2.5)

Overlays carry a community's tailoring, shared through SCOR; capabilities group mutually reinforcing controls before selection.

What does it cover?

SP 800-53B applies to federal information systems, which Section 1.1 defines to include systems operated by a contractor or another organization on behalf of an agency, and the high baseline applies to those categorized high on at least one objective. National security systems are outside FISMA and follow CNSS Policy 22, CNSS Instruction 1253 and, for the Department of Defense, DoD Instruction 8510.01, though the controls may be selected for them. Section 1.1 adds that any organization that processes, stores or transmits information, including state, local and tribal governments and the private sector, can implement the baselines, and that use of the privacy control baseline is not mandated by law or OMB Circular A-130.

What are its objectives?

Section 1.1 and the abstract set out what SP 800-53B, and the high baseline within it, are for:

Establish security control baselines for the low, moderate and high impact levels, and a privacy control baseline, for federal information systems and organizations.

Provide tailoring guidance (Section 2.4) and a set of working assumptions (Section 2.3) that inform control selection.

Give guidance on overlays (Appendix C) so communities of interest, technologies and environments can customize a baseline once.

Help organizations satisfy the security and privacy requirements of FISMA, the Privacy Act of 1974, OMB policies such as Circular A-130 and the FIPS.

Serve as the starting point that, with tailoring, produces a system's documented control set in its security and privacy plans.

Framework in Context

The high baseline draws every control from the SP 800-53 Rev. 5 catalog, and SP 800-53A Rev. 5 supplies the assessment procedures, both at Release 5.2.0 since August 27, 2025. Control selection sits in the Select step of SP 800-37 Rev. 2, whose Task P-4 covers organizationally tailored baselines and Task S-2 system-level tailoring (Section 2.4, footnote). The previous high baseline, in the withdrawn SP 800-53 Rev. 4, held 343 items; the Rev. 5 version adds SA-21 and SR-9 to the high-only controls, while SA-12 was withdrawn into the Supply Chain Risk Management family (Table 3-17) and SA-15 now enters at moderate. The NIST record also carries the control baselines spreadsheet and the OSCAL files.

Common Framework Mappings

The SP 800-53B high baseline is commonly mapped to the control frameworks that reuse Rev. 5 control identifiers, so a high-impact control set and its evidence can serve several programs.

Mapped frameworks include:

CIS Controls v8.1

COBIT 2019

FedRAMP Rev. 5

HITRUST CSF v11.5

ISO 27001:2022

NIST CSF 2.0

NIST 800-171 Rev. 3

PCI DSS 4.0.1

SOC 2