AC Access control
Access control (AC) family of NIST SP 800-53 Rev. 5: account management, access enforcement, information flow, least privilege, session controls, remote, wireless and mobile access, and use of external systems.
NIST SP 800-53
NIST SP 800-53 Rev. 5 security and privacy controls, family by family: what each control requires, its SP 800-53B baselines, SP 800-53A assessment procedures, the evidence that passes and open-source tooling.
AT Awareness and training
Awareness and training (AT) family of NIST SP 800-53 Rev. 5: security and privacy literacy training, role-based training, training records and feedback on training results.
AU Audit and accountability
Audit and accountability (AU) family of NIST SP 800-53 Rev. 5: which events to log, audit record content, storage, failure response, review and analysis, time stamps, protection, retention and non-repudiation.
CA Assessment, authorization, and monitoring
Assessment, authorization, and monitoring (CA) family of NIST SP 800-53 Rev. 5: control assessments, information exchange agreements, plans of action and milestones, authorization to operate, continuous monitoring and penetration testing.
CM Configuration management
Configuration management (CM) family of NIST SP 800-53 Rev. 5: baseline configurations, change control, impact analysis, secure settings, least functionality, component inventory, software restrictions and signed components.
CP Contingency planning
Contingency planning (CP) family of NIST SP 800-53 Rev. 5: contingency plans, training and testing, alternate storage and processing sites, telecommunications, system backup, and recovery and reconstitution.
IA Identification and authentication
Identification and authentication (IA) family of NIST SP 800-53 Rev. 5: authenticating organizational users, devices, services and outside users, identifier and authenticator management, identity proofing and identity providers.
IR Incident response
The SP 800-53 Rev. 5 Incident Response family: IR policy, training, testing, handling, monitoring, reporting, assistance, the incident response plan and spillage response, with baselines, assessment procedures and evidence for each control.
MA Maintenance
The SP 800-53 Rev. 5 Maintenance family: maintenance policy, controlled and nonlocal maintenance, maintenance tools and personnel, timely and field maintenance, with baselines, assessment procedures and evidence for each control.
MP Media protection
The SP 800-53 Rev. 5 Media Protection family: access, marking, storage, transport, sanitization, use and downgrading of digital and non-digital media, with baselines, assessment procedures and evidence for each control.
PE Physical and environmental protection
The SP 800-53 Rev. 5 Physical and Environmental Protection family: physical access authorization, control and monitoring, visitor records, power, fire, environmental and water protection, and facility siting, with baselines and assessment procedures.
PL Planning
The SP 800-53 Rev. 5 Planning family: planning policy, system security and privacy plans, rules of behavior, concept of operations, architectures, central management, and baseline selection and tailoring.
PM Program management
The SP 800-53 Rev. 5 Program Management family: organization-wide security, privacy, risk and supply chain program controls that are deployed across the organization rather than per system, with privacy baseline status and assessment procedures.
PS Personnel security
The SP 800-53 Rev. 5 Personnel Security family: position risk designation, screening, termination, transfer, access agreements, external personnel, sanctions and position descriptions, with baselines and assessment procedures.
PT Personally identifiable information processing and transparency
The SP 800-53 Rev. 5 PII Processing and Transparency family: authority and purposes for processing PII, consent, privacy notices, system of records notices, specific PII categories and computer matching, all in the privacy baseline.
RA Risk assessment
Risk assessment family: security categorization, risk assessments, vulnerability monitoring and scanning, risk response, privacy impact assessments, criticality analysis and threat hunting.
SA System and services acquisition
System and services acquisition family: SDLC, acquisition contract requirements, documentation, engineering principles, external services, developer configuration management, testing and secure development, and unsupported components.
SC System and communications protection
System and communications protection family: boundary protection, transmission and at-rest encryption, key and certificate management, DNS security, session authenticity, isolation and separation controls, and time synchronization.
SI System and information integrity
System and information integrity family: flaw remediation, malicious code protection, system monitoring, security alerts, integrity verification, input validation, error handling, information retention and PII quality and de-identification.
SR Supply chain risk management
Supply chain risk management family, new in Rev. 5: the SCRM plan, supply chain controls, provenance, acquisition strategies, supplier assessments, notification agreements, tamper protection, component authenticity and disposal.
NIST 800-53 Risk Management Framework
Running SP 800-53 through the NIST Risk Management Framework: security categorization, the Prepare step, roles, authorization to operate, ongoing authorization, and common control inheritance.
NIST 800-53 documentation and evidence
The documents an SP 800-53 program runs on: the system security and privacy plan, plan of action and milestones, assessment report, policies and procedures, and agreements for information exchanges.
NIST 800-53 continuous monitoring
Keeping an SP 800-53 authorization current: the ISCM strategy, FedRAMP's ongoing certification reports, vulnerability detection and remediation timeframes, and significant change notification.
NIST 800-53 technical requirements
Cross-cutting technical expectations that span several SP 800-53 controls: multi-factor authentication, audit logging, FIPS-validated encryption, patching, secure software development and containers.
NIST 800-53 for government contractors and cloud providers
Programs that turn SP 800-53 into contract requirements: IRS Publication 1075, CMS ARS, GovRAMP for state and local buyers, FedRAMP Recognized assessors, and building on AWS and Azure.
NIST 800-53 tools and automation
Automating SP 800-53 work: OSCAL documents, open-source scanners and compliance-as-code content, and self-hosted tools that produce control evidence.
NIST 800-53 for OT, AI and privacy
Applying SP 800-53 beyond standard IT systems through overlays and dedicated control sets: operational technology, AI systems, PII processing and supply chain risk.
NIST 800-53 guides
Questions organizations ask when an agency, contract or FedRAMP requires NIST SP 800-53: baselines, tailoring and overlays, assessment, FedRAMP, an implementation roadmap, and how 800-53 compares with ISO 27001 and SP 800-171.
