NIST 800-53 Rev 5: Every Control Family Explained

When SolarWinds went from routine IT management tool to the vector for the most consequential supply chain compromise in federal history, the post-incident analysis circled back to a single control family: SR (Supply Chain Risk Management). That family did not exist in NIST 800-53 Rev 4. It was added in Rev 5, published in September 2020 — months before SolarWinds made headlines. The agencies that had begun implementing SR controls caught the anomalies faster. Those still operating on Rev 4 had no structural basis for the detection.

NIST 800-53 Rev 5 is not an academic catalog. It is the operational backbone that FedRAMP, FISMA, CMMC, and more than a dozen other frameworks derive from. Understanding it is not optional for anyone building, assessing, or operating federal information systems.

Why Now: Rev 5 Is the Universal Baseline

Every major federal compliance framework now references Rev 5 as its control source:

FedRAMP baselines (Low, Moderate, High) are drawn directly from 800-53 Rev 5 as of 2023
FISMA reporting aligns to Rev 5 control families
CMMC Level 2 maps its 110 practices back to Rev 5 controls via NIST 800-171
NIST CSF 2.0 uses 800-53 controls as informative references for every subcategory

If you master 800-53 Rev 5, you master the source material that every other federal framework subsets, extends, or references. That is not an exaggeration — it is the structural reality of the compliance ecosystem.

What Changed from Rev 4 to Rev 5

Rev 5 was not an incremental update. It was a structural rearchitecture:

Privacy controls integrated. The former Appendix J privacy catalog was folded into the main publication, Program Management (PM) moved from an appendix into the main catalog, and a new privacy family was added: Personally Identifiable Information Processing and Transparency (PT).
Supply Chain Risk Management (SR) added. An entirely new family addressing third-party and supply chain risks — now the most strategically important family in the catalog given SolarWinds, Kaseya, and Log4Shell (CVE-2021-44228).
Outcome-based language. Controls were rewritten to focus on security and privacy outcomes rather than prescribing specific technologies.
Decoupled from federal-only use. Rev 5 can be applied to any organization, not just federal information systems.
Control baselines separated. Baselines (Low, Moderate, High) moved to SP 800-53B, making the control catalog itself baseline-neutral.

The 20 Control Families

AC — Access Control

What it covers: Limiting system access to authorized users, processes, and devices. Managing what authenticated entities are permitted to do.

Key controls:

AC-2 (Account Management): Establish, administer, and monitor accounts. Includes inactive account removal, role-based access, and shared/group account restrictions.
AC-3 (Access Enforcement): Enforce approved authorizations for logical access.
AC-6 (Least Privilege): Grant only the minimum access needed for job functions.
AC-17 (Remote Access): Monitor, control, and encrypt all remote access sessions.

Why it matters: Access control failures are the root cause of most breaches. This is the largest family and the most frequently assessed across FedRAMP and CMMC.

AT — Awareness and Training

What it covers: Ensuring personnel understand security responsibilities and have skills to fulfill them.

Key controls:

AT-2 (Literacy Training and Awareness): General security awareness for all users, including phishing, social engineering, and insider threat recognition.
AT-3 (Role-Based Training): Specialized training for administrators, developers, and incident responders.
AT-6 (Training Feedback): Mechanisms for improving training based on effectiveness metrics.

Why it matters: People remain the most exploited attack vector. Training controls appear in virtually every compliance framework.

AU — Audit and Accountability

What it covers: Creating, protecting, and analyzing audit records to detect and investigate security events.

Key controls:

AU-2 (Event Logging): Define which events require logging (authentication, access, privilege changes).
AU-3 (Content of Audit Records): What each entry must contain (who, what, when, where, outcome).
AU-6 (Audit Record Review, Analysis, and Reporting): Regular review and correlation to detect anomalies.
AU-9 (Protection of Audit Information): Prevent unauthorized modification or deletion of logs.

Why it matters: Without audit trails, incident response is blind and accountability is impossible. This is the prerequisite for SIEM, threat detection, and forensic investigation.

CA — Assessment, Authorization, and Monitoring

What it covers: Assessing security controls, authorizing system operation, and continuously monitoring posture.

Key controls:

CA-2 (Control Assessments): Periodically assess controls to determine effectiveness.
CA-5 (Plan of Action and Milestones): Document and track remediation of identified weaknesses.
CA-6 (Authorization): Senior official formally accepts risk of operating the system (the ATO decision).
CA-7 (Continuous Monitoring): Ongoing vulnerability scanning, log analysis, and configuration checking.

Why it matters: This family governs the entire RMF lifecycle. The ATO process that every federal system goes through lives here.

CM — Configuration Management

What it covers: Establishing and maintaining system integrity through controlling changes to hardware, software, firmware, and documentation.

Key controls:

CM-2 (Baseline Configuration): Maintain documented, current baseline for each system.
CM-3 (Configuration Change Control): Formally manage changes with impact analysis, testing, and rollback.
CM-6 (Configuration Settings): Enforce hardening guides, STIGs, CIS Benchmarks.
CM-8 (System Component Inventory): Maintain accurate, current inventory of all system components.

Why it matters: Configuration drift is a leading cause of security incidents. Without a known baseline, detecting unauthorized changes is impossible.

CP — Contingency Planning

What it covers: Ensuring systems continue operating or can be restored after disruptions — power outages, ransomware, natural disasters.

Key controls:

CP-2 (Contingency Plan): Develop, maintain, and test a comprehensive contingency plan.
CP-6 (Alternate Storage Site): Maintain off-site storage for backups and critical data.
CP-7 (Alternate Processing Site): Geographically separate processing capability.
CP-9 (System Backup): Regular backups with verified restoration capability.

Why it matters: Ransomware has made contingency planning a board-level concern. CP controls are not optional for any system handling federal data.

IA — Identification and Authentication

What it covers: Verifying identity of users, processes, services, and devices before granting access.

Key controls:

IA-2 (Identification and Authentication — Organizational Users): Authenticate users with unique identifiers.
IA-2(1) and IA-2(2) (Multi-Factor Authentication): MFA for privileged and non-privileged accounts.
IA-5 (Authenticator Management): Manage passwords, tokens, certificates, biometrics — complexity, rotation, revocation.
IA-8 (Non-Organizational Users): Authenticate external users accessing organizational systems.

Why it matters: Authentication is the front door. Weak authentication remains the single most exploited vulnerability class in federal systems.

IR — Incident Response

What it covers: Preparing for, detecting, analyzing, containing, eradicating, and recovering from security incidents.

Key controls:

IR-4 (Incident Handling): Detect, analyze, contain, eradicate, and recover.
IR-5 (Incident Monitoring): Track incidents from detection through resolution.
IR-6 (Incident Reporting): Report to appropriate authorities within required timeframes.
IR-8 (Incident Response Plan): Maintain a tested, actionable IR plan.

Why it matters: Every organization will experience incidents. Detection in minutes versus months, coordinated versus chaotic response — IR controls make the difference.

MA — Maintenance

What it covers: Performing timely and secure maintenance on information systems.

Key controls:

MA-2 (Controlled Maintenance): Schedule, perform, and document maintenance.
MA-4 (Nonlocal Maintenance): Secure remote maintenance with strong authentication and encryption.
MA-5 (Maintenance Personnel): Supervise and authenticate maintenance personnel.

Why it matters: Maintenance requires elevated privileges. Uncontrolled maintenance is a common vector for introducing vulnerabilities or unauthorized access.

MP — Media Protection

What it covers: Protecting information on digital and non-digital media throughout its lifecycle.

Key controls:

MP-2 (Media Access): Restrict access to media containing sensitive information.
MP-5 (Media Transport): Protect media during transport with encryption and physical controls.
MP-6 (Media Sanitization): Sanitize or destroy media before disposal or reuse.

Why it matters: Improperly disposed media — hard drives, USB drives, backup tapes — remain a significant breach source.

PE — Physical and Environmental Protection

What it covers: Protecting physical facilities, equipment, and infrastructure from unauthorized access, damage, and environmental hazards.

Key controls:

PE-2 (Physical Access Authorizations): Maintain authorized individual lists.
PE-3 (Physical Access Control): Control entry with guards, locks, badges, or biometrics.
PE-6 (Monitoring Physical Access): Monitor and review physical access logs.
PE-13 through PE-15: Fire protection, temperature/humidity, water damage protection.

Why it matters: Physical security is the foundation. All logical controls are moot if an attacker can physically access infrastructure.

PL — Planning

What it covers: Developing and maintaining security and privacy plans describing system architecture, boundary, and control implementation.

Key controls:

PL-2 (System Security and Privacy Plans): The SSP — comprehensive plan describing architecture, boundary, controls, and interconnections.
PL-4 (Rules of Behavior): Acceptable-use rules for system users.
PL-10 (Baseline Selection): Select appropriate control baseline from SP 800-53B.

Why it matters: The SSP is the central artifact assessors and authorizing officials evaluate. A weak SSP undermines the entire authorization process.

PM — Program Management

What it covers: Organization-wide security and privacy program governance, risk strategy, and resource allocation.

Key controls:

PM-1 (Information Security Program Plan): Organization-wide security program.
PM-9 (Risk Management Strategy): Organizational approach to managing risk.
PM-11 (Mission and Business Process Definition): Mission-critical processes and their security requirements.

Why it matters: PM controls address governance above individual systems. Without program-level management, security is ad hoc across the enterprise.

PS — Personnel Security

What it covers: Managing risk from personnel with access to organizational systems and data.

Key controls:

PS-2 (Position Risk Designation): Assign risk levels to positions, screen accordingly.
PS-3 (Personnel Screening): Background checks, clearance verification before access.
PS-4 (Personnel Termination): Disable access promptly on termination.
PS-5 (Personnel Transfer): Adjust access on role change.

Why it matters: Insider threats — malicious and negligent — drive a substantial percentage of breaches.

PT — Personally Identifiable Information Processing and Transparency

What it covers: Managing PII processing and providing transparency about data practices. New to Rev 5.

Key controls:

PT-2 (Authority to Process PII): Document legal basis for PII processing.
PT-3 (PII Processing Purposes): Limit processing to authorized purposes.
PT-4 (Consent): Obtain and manage individual consent where applicable.
PT-5 (Privacy Notice): Clear notice about collection and processing practices.

Why it matters: Privacy regulations (GDPR, CCPA, HIPAA, Privacy Act) require demonstrable PII controls. PT provides the structure.

RA — Risk Assessment

What it covers: Identifying, analyzing, and prioritizing risks to organizational operations, assets, and individuals.

Key controls:

RA-3 (Risk Assessment): Regular assessments identifying threats, vulnerabilities, likelihood, and impact.
RA-5 (Vulnerability Monitoring and Scanning): Scan, remediate, and share vulnerability information.
RA-7 (Risk Response): Determine responses — accept, mitigate, transfer, or avoid.

Why it matters: Risk assessment drives everything else. Without understanding your risk landscape, control selection is guesswork.

SA — System and Services Acquisition

What it covers: Managing security throughout the system development lifecycle and acquisition of systems and services.

Key controls:

SA-3 (System Development Life Cycle): SDLC that incorporates security at every phase.
SA-4 (Acquisition Process): Security requirements in contracts and acquisition documents.
SA-8 (Security Engineering Principles): Apply security engineering throughout design.
SA-11 (Developer Testing): Require developers to test for and correct security flaws.

Why it matters: Security must be designed in, not bolted on. SA controls ensure third-party products meet requirements before deployment.

SC — System and Communications Protection

What it covers: Protecting data integrity and confidentiality in transit and at rest, securing communication boundaries.

Key controls:

SC-7 (Boundary Protection): Monitor and control at system boundaries (firewalls, proxies, DMZs).
SC-8 (Transmission Confidentiality and Integrity): Encrypt in transit with FIPS-validated cryptography.
SC-13 (Cryptographic Protection): FIPS-validated cryptographic modules.
SC-28 (Protection of Information at Rest): Encrypt stored data.

Why it matters: Encryption and boundary protection are non-negotiable for sensitive data. SC controls are the most technically demanding and most frequently failed.

SI — System and Information Integrity

What it covers: Identifying, reporting, and correcting system flaws, monitoring for threats, protecting against malicious code.

Key controls:

SI-2 (Flaw Remediation): Timely patching of software and firmware flaws.
SI-3 (Malicious Code Protection): Anti-malware capabilities, kept current.
SI-4 (System Monitoring): Monitor for attacks, indicators of compromise, unauthorized connections.
SI-5 (Security Alerts): Receive and respond to alerts from CISA, vendor advisories.

Why it matters: Patching and monitoring are the operational backbone of security. CVE-2024-3094 (xz), CVE-2023-34362 (MOVEit), CVE-2024-21762 (FortiOS) — SI controls are where you catch these before exploitation.

SR — Supply Chain Risk Management

What it covers: Managing risks from the supply chain for systems, components, and services. New to Rev 5.

Key controls:

SR-2 (Supply Chain Risk Management Plan): Plan for managing supply chain risks.
SR-3 (Supply Chain Controls): Trusted delivery, tamper resistance, supplier diversity.
SR-5 (Acquisition Strategies): Acquisition approaches that reduce supply chain risk.
SR-11 (Component Authenticity): Anti-counterfeit policies and verification.

Why it matters: SolarWinds, Kaseya, and Log4Shell (CVE-2021-44228) demonstrated that supply chain attacks bypass every other control. SR is the newest family and arguably the most strategically important.

The Contrarian Take: Start with SR, Not AC

Most implementation guides tell you to start with Access Control because it is the largest family. That was sound advice in 2018. In 2026, the highest-impact starting point is Supply Chain Risk Management.

Here is why: AC failures give you a breach. SR failures give you a breach you cannot detect, because the compromised component is inside your trust boundary by design. Every major federal incident since 2020 — SolarWinds (SR), Log4j (SR), MOVEit (SA/SR), xz backdoor (SR) — exploited the supply chain, not the front door. If your SR controls are immature, your AC controls are defending a perimeter that has already been bypassed from within.

Start with SR-2 (plan), SR-3 (controls), and SR-11 (authenticity). Then move to AC. The risk math supports it.

How 800-53 Maps to Other Frameworks

Framework	Relationship to 800-53
NIST 800-171 / CMMC	Derived from 800-53 Moderate; 110 requirements map back to specific controls
FedRAMP	Uses 800-53 baselines directly with FedRAMP-specific parameters
FISMA	Federal agencies implement 800-53 as required by FISMA
ISO 27001	NIST maintains a crosswalk between 800-53 and ISO 27001 Annex A
SOC 2	Trust Service Criteria map to 800-53, though not one-to-one
HIPAA	HHS OCR maps HIPAA Security Rule safeguards to 800-53 controls
PCI DSS	Significant overlap in access control, encryption, and logging
CSF 2.0	References 800-53 controls as informative references for each subcategory

This interconnection is why 800-53 competency translates to efficiency across multiple compliance obligations. Implementing 800-53 Moderate once gives you substantial coverage across FedRAMP, CMMC, FISMA, and more.

Choosing a Baseline

SP 800-53B defines three control baselines based on system impact level (per FIPS 199):

Low: ~150 controls. Systems where loss of CIA would have limited adverse effect.
Moderate: ~325 controls. The most common baseline for federal systems. Serious adverse effect.
High: ~410 controls. Severe or catastrophic adverse effect (national security, life safety).

Impact level is determined by data types processed and consequences of security failure — not by system size or cost.

Key Takeaways

NIST 800-53 Rev 5 contains 1,000+ controls across 20 families — it is the source from which FedRAMP, CMMC, and FISMA derive

Rev 5 added Supply Chain (SR) and Privacy (PT) families; both are now critical

Start SR implementation before AC — supply chain attacks bypass perimeter controls by design

Control baselines (Low/Moderate/High) moved to SP 800-53B; the catalog is now baseline-neutral

Mastering 800-53 Moderate gives you 85%+ coverage of CMMC, 100% of FedRAMP Moderate, and substantial ISO 27001 overlap

Outcome-based language means Rev 5 controls can be implemented without prescribing specific technology

Frequently Asked Questions

Do I need to implement all 1,000+ controls?

No. You select a baseline (Low, Moderate, or High) based on your FIPS 199 categorization, which narrows the set to roughly 150-410 controls. You then tailor the baseline by adding or removing controls based on your specific risk environment. Only FedRAMP High implementations approach the full catalog.

How does 800-53 relate to CMMC Level 2?

CMMC Level 2 assesses the 110 requirements from NIST 800-171, which are themselves derived from the 800-53 Moderate baseline. If you implement 800-53 Moderate fully, you exceed CMMC Level 2 requirements. The reverse is not true — CMMC Level 2 covers a subset of 800-53 Moderate.

What is the difference between 800-53 and the NIST Cybersecurity Framework?

NIST CSF is a risk management framework that organizes security activities into functions (Identify, Protect, Detect, Respond, Recover). NIST 800-53 is a control catalog — the specific technical and procedural mechanisms you implement. CSF tells you what outcomes to achieve; 800-53 tells you how to achieve them. CSF references 800-53 controls as informative references.

How often does 800-53 get updated?

Major revisions happen roughly every 5-7 years (Rev 4 in 2013, Rev 5 in 2020). Minor updates and errata are published between revisions. NIST maintains a living document at csrc.nist.gov with all current updates. FedRAMP and FISMA typically adopt new revisions within 18-24 months of publication.

How Advisedly Helps

Advisedly has the full NIST 800-53 Rev 5 catalog ingested and crosswalked to 500+ other compliance frameworks. When you implement a control once, Advisedly automatically maps it across every framework you are assessed against — CMMC, FedRAMP, ISO 27001, HIPAA, and beyond. Continuous monitoring, automated evidence collection, and continuous control assessments replace the manual spreadsheet cycle that breaks down at scale. Contact begin@advisedly.ai

Why Now: Rev 5 Is the Universal Baseline

Every major federal compliance framework now references Rev 5 as its control source:

FedRAMP baselines (Low, Moderate, High) are drawn directly from 800-53 Rev 5 as of 2023
FISMA reporting aligns to Rev 5 control families
CMMC Level 2 maps its 110 practices back to Rev 5 controls via NIST 800-171
NIST CSF 2.0 uses 800-53 controls as informative references for every subcategory

What Changed from Rev 4 to Rev 5

Rev 5 was not an incremental update. It was a structural rearchitecture:

Privacy controls integrated. The former Appendix J privacy catalog was folded into the main publication, Program Management (PM) moved from an appendix into the main catalog, and a new privacy family was added: Personally Identifiable Information Processing and Transparency (PT).
Supply Chain Risk Management (SR) added. An entirely new family addressing third-party and supply chain risks — now the most strategically important family in the catalog given SolarWinds, Kaseya, and Log4Shell (CVE-2021-44228).
Outcome-based language. Controls were rewritten to focus on security and privacy outcomes rather than prescribing specific technologies.
Decoupled from federal-only use. Rev 5 can be applied to any organization, not just federal information systems.
Control baselines separated. Baselines (Low, Moderate, High) moved to SP 800-53B, making the control catalog itself baseline-neutral.

The 20 Control Families

AC — Access Control

What it covers: Limiting system access to authorized users, processes, and devices. Managing what authenticated entities are permitted to do.

Key controls:

AC-2 (Account Management): Establish, administer, and monitor accounts. Includes inactive account removal, role-based access, and shared/group account restrictions.
AC-3 (Access Enforcement): Enforce approved authorizations for logical access.
AC-6 (Least Privilege): Grant only the minimum access needed for job functions.
AC-17 (Remote Access): Monitor, control, and encrypt all remote access sessions.

Why it matters: Access control failures are the root cause of most breaches. This is the largest family and the most frequently assessed across FedRAMP and CMMC.

AT — Awareness and Training

What it covers: Ensuring personnel understand security responsibilities and have skills to fulfill them.

Key controls:

AT-2 (Literacy Training and Awareness): General security awareness for all users, including phishing, social engineering, and insider threat recognition.
AT-3 (Role-Based Training): Specialized training for administrators, developers, and incident responders.
AT-6 (Training Feedback): Mechanisms for improving training based on effectiveness metrics.

Why it matters: People remain the most exploited attack vector. Training controls appear in virtually every compliance framework.

AU — Audit and Accountability

What it covers: Creating, protecting, and analyzing audit records to detect and investigate security events.

Key controls:

AU-2 (Event Logging): Define which events require logging (authentication, access, privilege changes).
AU-3 (Content of Audit Records): What each entry must contain (who, what, when, where, outcome).
AU-6 (Audit Record Review, Analysis, and Reporting): Regular review and correlation to detect anomalies.
AU-9 (Protection of Audit Information): Prevent unauthorized modification or deletion of logs.

Why it matters: Without audit trails, incident response is blind and accountability is impossible. This is the prerequisite for SIEM, threat detection, and forensic investigation.

CA — Assessment, Authorization, and Monitoring

What it covers: Assessing security controls, authorizing system operation, and continuously monitoring posture.

Key controls:

CA-2 (Control Assessments): Periodically assess controls to determine effectiveness.
CA-5 (Plan of Action and Milestones): Document and track remediation of identified weaknesses.
CA-6 (Authorization): Senior official formally accepts risk of operating the system (the ATO decision).
CA-7 (Continuous Monitoring): Ongoing vulnerability scanning, log analysis, and configuration checking.

Why it matters: This family governs the entire RMF lifecycle. The ATO process that every federal system goes through lives here.

CM — Configuration Management

What it covers: Establishing and maintaining system integrity through controlling changes to hardware, software, firmware, and documentation.

Key controls:

CM-2 (Baseline Configuration): Maintain documented, current baseline for each system.
CM-3 (Configuration Change Control): Formally manage changes with impact analysis, testing, and rollback.
CM-6 (Configuration Settings): Enforce hardening guides, STIGs, CIS Benchmarks.
CM-8 (System Component Inventory): Maintain accurate, current inventory of all system components.

Why it matters: Configuration drift is a leading cause of security incidents. Without a known baseline, detecting unauthorized changes is impossible.

CP — Contingency Planning

What it covers: Ensuring systems continue operating or can be restored after disruptions — power outages, ransomware, natural disasters.

Key controls:

CP-2 (Contingency Plan): Develop, maintain, and test a comprehensive contingency plan.
CP-6 (Alternate Storage Site): Maintain off-site storage for backups and critical data.
CP-7 (Alternate Processing Site): Geographically separate processing capability.
CP-9 (System Backup): Regular backups with verified restoration capability.

Why it matters: Ransomware has made contingency planning a board-level concern. CP controls are not optional for any system handling federal data.

IA — Identification and Authentication

What it covers: Verifying identity of users, processes, services, and devices before granting access.

Key controls:

IA-2 (Identification and Authentication — Organizational Users): Authenticate users with unique identifiers.
IA-2(1) and IA-2(2) (Multi-Factor Authentication): MFA for privileged and non-privileged accounts.
IA-5 (Authenticator Management): Manage passwords, tokens, certificates, biometrics — complexity, rotation, revocation.
IA-8 (Non-Organizational Users): Authenticate external users accessing organizational systems.

Why it matters: Authentication is the front door. Weak authentication remains the single most exploited vulnerability class in federal systems.

IR — Incident Response

What it covers: Preparing for, detecting, analyzing, containing, eradicating, and recovering from security incidents.

Key controls:

IR-4 (Incident Handling): Detect, analyze, contain, eradicate, and recover.
IR-5 (Incident Monitoring): Track incidents from detection through resolution.
IR-6 (Incident Reporting): Report to appropriate authorities within required timeframes.
IR-8 (Incident Response Plan): Maintain a tested, actionable IR plan.

Why it matters: Every organization will experience incidents. Detection in minutes versus months, coordinated versus chaotic response — IR controls make the difference.

MA — Maintenance

What it covers: Performing timely and secure maintenance on information systems.

Key controls:

MA-2 (Controlled Maintenance): Schedule, perform, and document maintenance.
MA-4 (Nonlocal Maintenance): Secure remote maintenance with strong authentication and encryption.
MA-5 (Maintenance Personnel): Supervise and authenticate maintenance personnel.

Why it matters: Maintenance requires elevated privileges. Uncontrolled maintenance is a common vector for introducing vulnerabilities or unauthorized access.

MP — Media Protection

What it covers: Protecting information on digital and non-digital media throughout its lifecycle.

Key controls:

MP-2 (Media Access): Restrict access to media containing sensitive information.
MP-5 (Media Transport): Protect media during transport with encryption and physical controls.
MP-6 (Media Sanitization): Sanitize or destroy media before disposal or reuse.

Why it matters: Improperly disposed media — hard drives, USB drives, backup tapes — remain a significant breach source.

PE — Physical and Environmental Protection

What it covers: Protecting physical facilities, equipment, and infrastructure from unauthorized access, damage, and environmental hazards.

Key controls:

PE-2 (Physical Access Authorizations): Maintain authorized individual lists.
PE-3 (Physical Access Control): Control entry with guards, locks, badges, or biometrics.
PE-6 (Monitoring Physical Access): Monitor and review physical access logs.
PE-13 through PE-15: Fire protection, temperature/humidity, water damage protection.

Why it matters: Physical security is the foundation. All logical controls are moot if an attacker can physically access infrastructure.

PL — Planning

What it covers: Developing and maintaining security and privacy plans describing system architecture, boundary, and control implementation.

Key controls:

PL-2 (System Security and Privacy Plans): The SSP — comprehensive plan describing architecture, boundary, controls, and interconnections.
PL-4 (Rules of Behavior): Acceptable-use rules for system users.
PL-10 (Baseline Selection): Select appropriate control baseline from SP 800-53B.

Why it matters: The SSP is the central artifact assessors and authorizing officials evaluate. A weak SSP undermines the entire authorization process.

PM — Program Management

What it covers: Organization-wide security and privacy program governance, risk strategy, and resource allocation.

Key controls:

PM-1 (Information Security Program Plan): Organization-wide security program.
PM-9 (Risk Management Strategy): Organizational approach to managing risk.
PM-11 (Mission and Business Process Definition): Mission-critical processes and their security requirements.

Why it matters: PM controls address governance above individual systems. Without program-level management, security is ad hoc across the enterprise.

PS — Personnel Security

What it covers: Managing risk from personnel with access to organizational systems and data.

Key controls:

PS-2 (Position Risk Designation): Assign risk levels to positions, screen accordingly.
PS-3 (Personnel Screening): Background checks, clearance verification before access.
PS-4 (Personnel Termination): Disable access promptly on termination.
PS-5 (Personnel Transfer): Adjust access on role change.

Why it matters: Insider threats — malicious and negligent — drive a substantial percentage of breaches.

PT — Personally Identifiable Information Processing and Transparency

What it covers: Managing PII processing and providing transparency about data practices. New to Rev 5.

Key controls:

PT-2 (Authority to Process PII): Document legal basis for PII processing.
PT-3 (PII Processing Purposes): Limit processing to authorized purposes.
PT-4 (Consent): Obtain and manage individual consent where applicable.
PT-5 (Privacy Notice): Clear notice about collection and processing practices.

Why it matters: Privacy regulations (GDPR, CCPA, HIPAA, Privacy Act) require demonstrable PII controls. PT provides the structure.

RA — Risk Assessment

What it covers: Identifying, analyzing, and prioritizing risks to organizational operations, assets, and individuals.

Key controls:

RA-3 (Risk Assessment): Regular assessments identifying threats, vulnerabilities, likelihood, and impact.
RA-5 (Vulnerability Monitoring and Scanning): Scan, remediate, and share vulnerability information.
RA-7 (Risk Response): Determine responses — accept, mitigate, transfer, or avoid.

Why it matters: Risk assessment drives everything else. Without understanding your risk landscape, control selection is guesswork.

SA — System and Services Acquisition

What it covers: Managing security throughout the system development lifecycle and acquisition of systems and services.

Key controls:

SA-3 (System Development Life Cycle): SDLC that incorporates security at every phase.
SA-4 (Acquisition Process): Security requirements in contracts and acquisition documents.
SA-8 (Security Engineering Principles): Apply security engineering throughout design.
SA-11 (Developer Testing): Require developers to test for and correct security flaws.

Why it matters: Security must be designed in, not bolted on. SA controls ensure third-party products meet requirements before deployment.

SC — System and Communications Protection

What it covers: Protecting data integrity and confidentiality in transit and at rest, securing communication boundaries.

Key controls:

SC-7 (Boundary Protection): Monitor and control at system boundaries (firewalls, proxies, DMZs).
SC-8 (Transmission Confidentiality and Integrity): Encrypt in transit with FIPS-validated cryptography.
SC-13 (Cryptographic Protection): FIPS-validated cryptographic modules.
SC-28 (Protection of Information at Rest): Encrypt stored data.

Why it matters: Encryption and boundary protection are non-negotiable for sensitive data. SC controls are the most technically demanding and most frequently failed.

SI — System and Information Integrity

What it covers: Identifying, reporting, and correcting system flaws, monitoring for threats, protecting against malicious code.

Key controls:

SI-2 (Flaw Remediation): Timely patching of software and firmware flaws.
SI-3 (Malicious Code Protection): Anti-malware capabilities, kept current.
SI-4 (System Monitoring): Monitor for attacks, indicators of compromise, unauthorized connections.
SI-5 (Security Alerts): Receive and respond to alerts from CISA, vendor advisories.

SR — Supply Chain Risk Management

What it covers: Managing risks from the supply chain for systems, components, and services. New to Rev 5.

Key controls:

SR-2 (Supply Chain Risk Management Plan): Plan for managing supply chain risks.
SR-3 (Supply Chain Controls): Trusted delivery, tamper resistance, supplier diversity.
SR-5 (Acquisition Strategies): Acquisition approaches that reduce supply chain risk.
SR-11 (Component Authenticity): Anti-counterfeit policies and verification.

The Contrarian Take: Start with SR, Not AC

Start with SR-2 (plan), SR-3 (controls), and SR-11 (authenticity). Then move to AC. The risk math supports it.

How 800-53 Maps to Other Frameworks

Framework	Relationship to 800-53
NIST 800-171 / CMMC	Derived from 800-53 Moderate; 110 requirements map back to specific controls
FedRAMP	Uses 800-53 baselines directly with FedRAMP-specific parameters
FISMA	Federal agencies implement 800-53 as required by FISMA
ISO 27001	NIST maintains a crosswalk between 800-53 and ISO 27001 Annex A
SOC 2	Trust Service Criteria map to 800-53, though not one-to-one
HIPAA	HHS OCR maps HIPAA Security Rule safeguards to 800-53 controls
PCI DSS	Significant overlap in access control, encryption, and logging
CSF 2.0	References 800-53 controls as informative references for each subcategory

Choosing a Baseline

SP 800-53B defines three control baselines based on system impact level (per FIPS 199):

Low: ~150 controls. Systems where loss of CIA would have limited adverse effect.
Moderate: ~325 controls. The most common baseline for federal systems. Serious adverse effect.
High: ~410 controls. Severe or catastrophic adverse effect (national security, life safety).

Impact level is determined by data types processed and consequences of security failure — not by system size or cost.

Key Takeaways

NIST 800-53 Rev 5 contains 1,000+ controls across 20 families — it is the source from which FedRAMP, CMMC, and FISMA derive

Rev 5 added Supply Chain (SR) and Privacy (PT) families; both are now critical

Start SR implementation before AC — supply chain attacks bypass perimeter controls by design

Control baselines (Low/Moderate/High) moved to SP 800-53B; the catalog is now baseline-neutral

Mastering 800-53 Moderate gives you 85%+ coverage of CMMC, 100% of FedRAMP Moderate, and substantial ISO 27001 overlap

Outcome-based language means Rev 5 controls can be implemented without prescribing specific technology

Frequently Asked Questions

Do I need to implement all 1,000+ controls?

How does 800-53 relate to CMMC Level 2?

What is the difference between 800-53 and the NIST Cybersecurity Framework?

How often does 800-53 get updated?

How Advisedly Helps