NIST Special Publication 800-53 is a catalog of security and privacy controls published by the US National Institute of Standards and Technology (NIST). Federal agencies use it to protect their information systems, and it underpins programs that buyers meet in the private sector, most visibly FedRAMP for cloud services. The controls cover technical, operational and management safeguards, from access control and logging to supply chain risk and privacy. This entry is general information, not legal advice; confirm what applies to you with your contracting officer, counsel or assessor.
At a glance
- It is a control catalog, not a checklist: organizations select and tailor controls based on a system’s risk.
- Revision 5 groups controls into 20 families and treats privacy alongside security.
- Companion SP 800-53B defines low, moderate and high baselines plus a privacy baseline; SP 800-53A covers assessment.
- Federal agencies use it under FISMA, and FedRAMP’s requirements for cloud services are based on its controls.
- NIST does not certify organizations against it.
What problem it solves
Organizations that need detailed, defensible security controls face a blank page or a pile of overlapping vendor checklists. SP 800-53 gives a single, comprehensive, publicly available catalog with consistent naming, so an agency, a cloud provider and an auditor can talk about the same control in the same terms.
For buyers, its main value is as a common reference. When a provider says its service meets federal requirements, SP 800-53 is usually the catalog behind that claim, and knowing how it works lets you ask which controls, which baseline and who checked.
How it works
Control families. Revision 5 organizes controls into 20 families: access control; awareness and training; audit and accountability; assessment, authorization and monitoring; configuration management; contingency planning; identification and authentication; incident response; maintenance; media protection; physical and environmental protection; planning; program management; personnel security; PII processing and transparency; risk assessment; system and services acquisition; system and communications protection; system and information integrity; and supply chain risk management.
Controls and enhancements. Each control states what is required. Control enhancements extend a control, and become required when the applicable baseline, an overlay, a tailoring decision, a contract or a program selects them; the moderate and high baselines select many of them.
Selecting a baseline. An organization categorizes a system by impact level, usually following FIPS 199, then starts from the matching baseline in SP 800-53B.
Tailoring and overlays. Baselines are a starting point. Organizations tailor them to the system, and overlays customize baselines for a specific community, technology or environment.
Assessing. SP 800-53A provides assessment procedures. Within the NIST Risk Management Framework (NIST RMF), assessment results feed an authorization decision and ongoing monitoring.
Versions. Revision 5 was published in September 2020, with updates in December 2020. NIST also issues minor releases; Release 5.2.0 came out in August 2025, and NIST notes it did not change the baselines.
Control baselines
SP 800-53 has no certification levels of its own. Its structure is the set of baselines in SP 800-53B, chosen by a system’s impact level.
| Baseline | When it applies | How it is validated | Typical evidence |
|---|---|---|---|
| Low | Systems where a loss of confidentiality, integrity or availability would have a limited adverse effect | Depends on the program: agency assessment and authorization, or a program such as FedRAMP | System security plan, assessment report |
| Moderate | Systems where a loss would have a serious adverse effect | As above; often an independent assessor | System security plan, assessment report, plan of action |
| High | Systems where a loss would have a severe or catastrophic adverse effect | As above, with the most extensive control set | System security plan, assessment report, continuous monitoring |
| Privacy baseline | Systems that process personally identifiable information, regardless of impact level | Agency privacy program review | Privacy plan and related documentation |
Programs that build on SP 800-53 can add their own labels and rules. FedRAMP, for example, now labels its certification baselines as classes, so check the program’s own terms rather than assuming a one-to-one match.
When it matters for buyers
- When buying cloud services for government work. FedRAMP requirements are based on SP 800-53 controls; check the provider’s status for the exact service.
- When running a system for a federal agency. Agency systems fall under FISMA, which relies on NIST controls.
- When you need a detailed control set. Some organizations adopt SP 800-53 voluntarily, often scaled down, for a rigorous program.
- When mapping frameworks. Controls frequently map to the NIST CSF, ISO/IEC 27001 and the CIS Critical Security Controls.
Our governance, risk and compliance overview covers advisors and platforms that map and track SP 800-53 controls.
Questions to ask vendors
- Which revision and baseline of SP 800-53 do your controls map to, and for which service?
- Was that mapping independently assessed, and through which program?
- Can you provide a customer responsibility matrix showing which controls you meet and which are ours?
- How do you handle continuous monitoring and report control changes to us?
- How quickly do you adopt new NIST releases or revisions?
How it differs from NIST SP 800-171
NIST Special Publication 800-171 sets requirements for protecting controlled unclassified information in nonfederal systems, such as those run by contractors, and is derived from a subset of federal controls. SP 800-53 is the full catalog used for federal systems and the programs that serve them. A defense contractor protecting controlled unclassified information on its own network usually works to SP 800-171; a cloud service sold to agencies usually works to SP 800-53 through FedRAMP. The NIST Cybersecurity Framework (NIST CSF) sits above both as a higher-level set of outcomes.
Problems this helps with
- A government customer asks which NIST 800-53 controls our service meets
- Need a detailed control catalog to build or audit a security program
- Comparing cloud providers that each claim alignment with federal controls
