Compliance / NIST SP 800-53
The control catalog behind federal security programs.
NIST SP 800-53 is the catalog of security and privacy controls for federal information systems. It is the foundation for FISMA compliance and FedRAMP authorizations, and programs such as TX-RAMP draw on it. Many private organizations also use it as their master control set, because almost every other framework maps to it.
We help agencies, contractors and cloud providers select the right baseline, adjust it to their systems, implement the controls and produce documentation that assessors accept.
At a glance
- Current version
- Revision 5, with controls in 20 families
- Baselines
- Low, moderate and high, defined in NIST SP 800-53B
- Used by
- FISMA, FedRAMP and many state programs, including TX-RAMP
- Assessment procedures
- NIST SP 800-53A
NIST SP 800-53
Baselines and tailoring
Few systems need every control. NIST SP 800-53B defines low, moderate and high baselines based on the impact of a breach. Organizations then tailor the baseline to the system: removing what does not apply, adding what the risk calls for and recording why.
Revision 5 also made the controls outcome-based and usable by any organization, and it added families for supply chain risk management and for the processing and transparency of personally identifiable information.
How we help
Categorization and baselines
Start from the right impact level.
- System categorization
- Baseline selection from NIST SP 800-53B
- Tailoring decisions and rationale
- Inheritance from cloud and shared service providers
Control implementation
Turn control statements into working safeguards.
- Access control, audit logging and configuration management
- Identification and authentication
- Incident response and contingency planning
- Supply chain risk management
Documentation
Paperwork assessors can follow.
- System Security Plans
- Policies and procedures for each control family
- Plans of Action and Milestones
- Control implementation statements
Assessment readiness
Be ready before the assessor arrives.
- Readiness assessment using NIST SP 800-53A procedures
- Evidence collection and organization
- Continuous monitoring programs
Services that support this work
- Cyber Strategy, Risk & ComplianceRisk assessments, virtual CISO leadership and compliance readiness that hold up under scrutiny.
- Cloud, Application & Infrastructure SecuritySecure architecture and hands-on engineering for cloud platforms, applications, networks and endpoints.
- Identity & Data SecurityProtect identities, privileged access and the sensitive data they can reach.
FAQ
Frequently asked questions
Is NIST SP 800-53 the same as NIST SP 800-171?
No. SP 800-53 is the full catalog for federal systems. SP 800-171 is a smaller set of requirements, derived from 800-53, for protecting Controlled Unclassified Information on nonfederal systems such as a contractor's network.
Can a private company use NIST SP 800-53?
Yes. It is free, detailed and maps to most other frameworks, which makes it a solid master control set even when no regulation requires it.
Find out where you stand on NIST SP 800-53.
A readiness review shows what an assessor would find today and what it will take to close the gaps.