NIST SP 800-53B Rev. 5 (Moderate Impact Baseline)

Why does it matter?

The moderate baseline sits between the 149-item low baseline and the 370-item high baseline, and Section 2.2 fixes which systems start from it: FIPS 199 rates each security objective, FIPS 200 applies the high water mark, and a system with at least one moderate objective and no high objective selects the Mod column of Tables 3-1 to 3-20. The same 287-item starting point applies whether the system is moderate on confidentiality alone or on all three objectives, which is why Section 2.4 matters as much as the tables: it is the tailoring guidance that turns the column into a documented, defensible control set that an authorizing official can approve in the system security and privacy plans.

Key benefits include:

• A trigger in the publication's own words

Section 2.2 defines a moderate-impact system as one in which at least one security objective is moderate and no security objective is high, using the high water mark concept from FIPS 199 and FIPS 200.

• A fixed starting set

The 177 controls and 110 enhancements are marked with an x in the Mod column of Tables 3-1 to 3-20, and NIST's OSCAL profile of the moderate baseline carries the same list in machine-readable form.

• Room to downgrade with conditions

Section 2.4 lists controls that support only confidentiality, only integrity or only availability, so a moderate system that is low on availability can consider downgrading items such as CP-2(1) when three stated conditions are met.

• Inheritance reduces the work

Section 2.4 lets common controls inherited from another provider count for the system, so account, physical and contingency controls run once by the organization need not be re-implemented.

• Unchanged since 2020

NIST's planning note of August 27, 2025 says Release 5.2.0 of SP 800-53B includes no changes to the baselines, so a tailoring record built on the December 10, 2020 errata edition remains current.

How does it work?

Selection starts with security categorization. Section 2.2 explains that FIPS 199 rates each system low, moderate or high for confidentiality, integrity and availability, and that FIPS 200 applies the high water mark to set one impact level; a system is moderate-impact when its highest rating is moderate. The organization then reads the Mod column of the Chapter Three tables, one per family from Table 3-1 Access Control to Table 3-20 Supply Chain Risk Management: an x marks a control or enhancement in the baseline, and a W marks a control withdrawn from the catalog, such as MP-2(2), MP-4(1) and MP-5(4), each incorporated into SC-28(1). Not every control in SP 800-53 is assigned to a baseline.

The Mod column shows where a moderate system carries more than a low one. In Access Control it adds AC-2(1) to AC-2(4) for automated account management, AC-6 Least Privilege with six enhancements including AC-6(9) logging of privileged functions, and AC-17(1) to AC-17(4) for remote access. Audit and Accountability gains AU-6(1), AU-6(3) and AU-7 Audit Record Reduction and Report Generation. Contingency Planning adds CP-6 Alternate Storage Site, CP-7 Alternate Processing Site, CP-8 Telecommunications Services and CP-2(1), (3) and (8). System and Communications Protection adds the boundary enhancements SC-7(3), (4), (5), (7) and (8) plus SC-8(1) and SC-28(1) cryptographic protection; System and Information Integrity adds SI-4(2), (4) and (5) and SI-7(1) and (7); Supply Chain Risk Management adds SR-6 Supplier Assessments and Reviews.

Tailoring follows under Section 2.4: common controls, scoping considerations, compensating controls, organization-defined parameter values, supplementation and specification detail. The security objective scoping consideration is written for this baseline: when a system is moderate because confidentiality or integrity is moderate but availability is low, availability-only items such as CP-2(1), CP-6, CP-7, CP-8, MA-6 and PE-11 may be downgraded to their low-baseline entries, provided the downgrade reflects the FIPS 199 category for that objective, is supported by an organizational assessment of risk and does not reduce protection of security-relevant information. Every control is accounted for, and the rationale is recorded in the system security and privacy plans and approved by the responsible officials. Appendix C adds overlays, such as the SP 800-82 Rev. 3 OT overlay for moderate systems, shared through the Security Control Overlay Repository.

Key Elements

• Trigger (Section 2.2)

At least one FIPS 199 security objective rated moderate and none rated high; the FIPS 200 high water mark sets the impact level and selects the Mod column of Chapter Three.

• Size (OSCAL Release 5.2.0 profile)

287 items: 177 base controls and 110 control enhancements from 18 families; 138 more than the low baseline and 83 fewer than the high baseline.

• Base controls that enter at moderate (Tables 3-1 to 3-20)

46, including AC-4, AC-5, AC-6, AC-11, AC-12, AC-21, AU-7, CM-3, CM-9, CM-12, CP-6, CP-7, CP-8, IA-3, IA-12, IR-3, MA-3, MA-6, MP-3, MP-4, MP-5, PE-4, PE-5, PE-9, PE-10, PE-11, PE-17, PL-8, RA-9, SA-10, SA-11, SA-15, SC-2, SC-4, SC-8, SC-10, SC-17, SC-18, SC-23, SC-28, SI-7, SI-8, SI-10, SI-11, SI-16 and SR-6.

• Enhancements that enter at moderate

92, for example AC-2(1) to (5) and (13), AC-6(1), (2), (5), (7), (9) and (10), AC-17(1) to (4), AU-6(1) and (3), CA-7(1), CM-2(2), (3) and (7), CM-7(1), (2) and (5), CP-9(1) and (8), IA-5(2) and (6), IR-6(1) and (3), SC-7(3), (4), (5), (7) and (8), SC-8(1), SC-28(1) and SI-4(2), (4) and (5).

• Downgrade candidates (Section 2.4)

Confidentiality-only items such as AC-21, MP-3, MP-4, MP-5, PE-4, PE-5 and SC-4; integrity-only items such as SI-7, SI-7(1) and SI-10; availability-only items such as CP-2(1), CP-6, CP-7, CP-8, MA-6, PE-9, PE-10 and PE-11.

• Tailoring record (Section 2.4)

Common control designations, scoping decisions, compensating controls with rationale, parameter values, supplements and specification detail, all documented in the system security and privacy plans and approved by responsible officials.

• Overlays and capabilities (Appendix C, Section 2.5)

Overlays carry a community's tailoring of the baseline, registered in the Security Control Overlay Repository; capabilities group mutually reinforcing controls before selection.

What does it cover?

SP 800-53B applies to federal information systems, which footnote 3 of Section 1.1 defines as systems used or operated by an agency, by a contractor of an agency, or by another organization on behalf of an agency, and the moderate baseline applies to those categorized moderate under FIPS 199 and FIPS 200. National security systems are outside FISMA and follow CNSS Policy 22 and CNSS Instruction 1253 (footnote 4). Section 1.1 also says the baselines can be implemented by any organization that processes, stores or transmits information, including state, local and tribal governments and the private sector, and that the privacy control baseline, which runs alongside this one for systems that process PII, is not mandated by law or OMB Circular A-130.

What are its objectives?

Section 1.1, the abstract and Chapter Two set out what the moderate baseline is for:

Give every system categorized moderate under FIPS 199 and FIPS 200 one defined starting set of security controls and enhancements (Section 2.2, Tables 3-1 to 3-20).

Satisfy the OMB Circular A-130 and FISMA requirement for a minimum set of controls selected from SP 800-53 Rev. 5 (Section 1.1).

Provide the working assumptions behind the baseline, such as general-purpose, networked, multi-user systems, so organizations know when it does not fit (Section 2.3).

Support tailoring that is defensible, risk-based and documented in the system security and privacy plans, including downgrades for single-objective controls (Section 2.4).

Enable overlays and capability-based selection so communities of interest can adapt the moderate baseline once and reuse it (Section 2.5, Appendix C).

Framework in Context

Every item in the moderate baseline comes from the SP 800-53 Rev. 5 catalog, and SP 800-53A Rev. 5 supplies the assessment procedures; the CSRC record lists both as publication parts of SP 800-53B. Tailoring sits in SP 800-37 Rev. 2 Tasks P-4 and S-2 (footnote 26), and SP 800-18 guides the system security plan that holds the tailoring record (footnote 28). The high baseline adds 83 items on top of this one. For operational technology, Appendix F of SP 800-82 Rev. 3 publishes an overlay of this baseline whose Table 22 moderate column adds CP-12 Safe Mode, SI-17 Fail-Safe Procedures, MA-7 Field Maintenance, AU-4(1), AC-17(10), CP-10(6), SR-5(1) and SC-7(18), an enhancement SP 800-53B assigns to high only.

Common Framework Mappings

The SP 800-53B moderate baseline is commonly mapped to the authorization programs and control frameworks that reuse Rev. 5 control identifiers, so one moderate control set and its evidence can serve several obligations.

Mapped frameworks include:

CIS Controls v8.1

COBIT 2019

FedRAMP Rev. 5

HIPAA (NIST SP 800-66 Rev. 2)

HITRUST CSF v11.5

ISO 27001:2022

NIST CSF 2.0

PCI DSS 4.0.1

SOC 2