NIST SP 800-53 Rev 5

United States

vRev 5

22 domains

192 controls

Security and privacy controls for information systems and organizations

Verified

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (22)

AC - Access Control

15 controls

Policies and procedures for access control

Controls in the AC - Access Control domain of NIST SP 800-53 Rev 5 — 15 controls
Code	Title	Description
NIST800-AC-1	Access control policy and procedures	Access control policy and procedures. Control from NIST SP 800-53 Rev 5 framework, domain: AC - Access Control.
NIST800-AC-11	Device lock	Device lock. Control from NIST SP 800-53 Rev 5 framework, domain: AC - Access Control.
NIST800-AC-12	Session control	Session control. Control from NIST SP 800-53 Rev 5 framework, domain: AC - Access Control.
NIST800-AC-14	Permitted actions without identification or authentication	Permitted actions without identification or authentication. Control from NIST SP 800-53 Rev 5 framework, domain: AC - Ac...
NIST800-AC-17	Remote access	Remote access. Control from NIST SP 800-53 Rev 5 framework, domain: AC - Access Control.
NIST800-AC-18	Wireless access	Wireless access. Control from NIST SP 800-53 Rev 5 framework, domain: AC - Access Control.
NIST800-AC-19	Access control for mobile devices	Access control for mobile devices. Control from NIST SP 800-53 Rev 5 framework, domain: AC - Access Control.
NIST800-AC-2	Account management	Account management. Control from NIST SP 800-53 Rev 5 framework, domain: AC - Access Control.
NIST800-AC-20	Use of external systems	Use of external systems. Control from NIST SP 800-53 Rev 5 framework, domain: AC - Access Control.
NIST800-AC-22	Publicly accessible content	Publicly accessible content. Control from NIST SP 800-53 Rev 5 framework, domain: AC - Access Control.
NIST800-AC-3	Access enforcement	Access enforcement. Control from NIST SP 800-53 Rev 5 framework, domain: AC - Access Control.
NIST800-AC-4	Information flow enforcement	Information flow enforcement. Control from NIST SP 800-53 Rev 5 framework, domain: AC - Access Control.
NIST800-AC-5	Separation of duties	Separation of duties. Control from NIST SP 800-53 Rev 5 framework, domain: AC - Access Control.
NIST800-AC-6	Least privilege	Least privilege. Control from NIST SP 800-53 Rev 5 framework, domain: AC - Access Control.
NIST800-AC-7	Unsuccessful logon attempts	Unsuccessful logon attempts. Control from NIST SP 800-53 Rev 5 framework, domain: AC - Access Control.

AT - Awareness and Training

5 controls

Security awareness and training programs

Controls in the AT - Awareness and Training domain of NIST SP 800-53 Rev 5 — 5 controls
Code	Title	Description
NIST800-AT-1	Policy and procedures for awareness and training	Policy and procedures for awareness and training. Control from NIST SP 800-53 Rev 5 framework, domain: AT - Awareness an...
NIST800-AT-2	Literacy training and awareness	Literacy training and awareness. Control from NIST SP 800-53 Rev 5 framework, domain: AT - Awareness and Training.
NIST800-AT-3	Role-based training	Role-based training. Control from NIST SP 800-53 Rev 5 framework, domain: AT - Awareness and Training.
NIST800-AT-4	Training records	Training records. Control from NIST SP 800-53 Rev 5 framework, domain: AT - Awareness and Training.
NIST800-AT-6	Training feedback	Training feedback. Control from NIST SP 800-53 Rev 5 framework, domain: AT - Awareness and Training.

AU - Audit and Accountability

11 controls

Audit and accountability controls

Controls in the AU - Audit and Accountability domain of NIST SP 800-53 Rev 5 — 11 controls
Code	Title	Description
NIST800-AU-1	Policy and procedures for audit and accountability	Policy and procedures for audit and accountability. Control from NIST SP 800-53 Rev 5 framework, domain: AU - Audit and...
NIST800-AU-11	Audit record retention	Audit record retention. Control from NIST SP 800-53 Rev 5 framework, domain: AU - Audit and Accountability.
NIST800-AU-12	Audit record generation	Audit record generation. Control from NIST SP 800-53 Rev 5 framework, domain: AU - Audit and Accountability.
NIST800-AU-2	Event logging	Event logging. Control from NIST SP 800-53 Rev 5 framework, domain: AU - Audit and Accountability.
NIST800-AU-3	Content of audit records	Content of audit records. Control from NIST SP 800-53 Rev 5 framework, domain: AU - Audit and Accountability.
NIST800-AU-4	Audit log storage capacity	Audit log storage capacity. Control from NIST SP 800-53 Rev 5 framework, domain: AU - Audit and Accountability.
NIST800-AU-5	Response to audit logging process failures	Response to audit logging process failures. Control from NIST SP 800-53 Rev 5 framework, domain: AU - Audit and Accounta...
NIST800-AU-6	Audit record review, analysis, and reporting	Audit record review, analysis, and reporting. Control from NIST SP 800-53 Rev 5 framework, domain: AU - Audit and Accoun...
NIST800-AU-7	Audit record reduction and report generation	Audit record reduction and report generation. Control from NIST SP 800-53 Rev 5 framework, domain: AU - Audit and Accoun...
NIST800-AU-8	Time stamps	Time stamps. Control from NIST SP 800-53 Rev 5 framework, domain: AU - Audit and Accountability.
NIST800-AU-9	Protection of audit information	Protection of audit information. Control from NIST SP 800-53 Rev 5 framework, domain: AU - Audit and Accountability.

CA - Assessment, Authorization, and Monitoring

8 controls

Security assessment, authorization, and monitoring

Controls in the CA - Assessment, Authorization, and Monitoring domain of NIST SP 800-53 Rev 5 — 8 controls
Code	Title	Description
NIST800-CA-1	Policy and procedures for assessment, authorization, and monitoring	Policy and procedures for assessment, authorization, and monitoring. Control from NIST SP 800-53 Rev 5 framework, domain...
NIST800-CA-2	Control assessments	Control assessments. Control from NIST SP 800-53 Rev 5 framework, domain: CA - Assessment, Authorization, and Monitoring...
NIST800-CA-3	Information exchange	Information exchange. Control from NIST SP 800-53 Rev 5 framework, domain: CA - Assessment, Authorization, and Monitorin...
NIST800-CA-5	Plan of action and milestones	Plan of action and milestones. Control from NIST SP 800-53 Rev 5 framework, domain: CA - Assessment, Authorization, and...
NIST800-CA-6	Authorization	Authorization. Control from NIST SP 800-53 Rev 5 framework, domain: CA - Assessment, Authorization, and Monitoring.
NIST800-CA-7	Continuous monitoring	Continuous monitoring. Control from NIST SP 800-53 Rev 5 framework, domain: CA - Assessment, Authorization, and Monitori...
NIST800-CA-8	Penetration testing	Penetration testing. Control from NIST SP 800-53 Rev 5 framework, domain: CA - Assessment, Authorization, and Monitoring...
NIST800-CA-9	Internal system connections	Internal system connections. Control from NIST SP 800-53 Rev 5 framework, domain: CA - Assessment, Authorization, and Mo...

CM - Configuration Management

11 controls

Configuration management controls

Controls in the CM - Configuration Management domain of NIST SP 800-53 Rev 5 — 11 controls
Code	Title	Description
NIST800-CM-1	Policy and procedures for configuration management	Policy and procedures for configuration management. Control from NIST SP 800-53 Rev 5 framework, domain: CM - Configurat...
NIST800-CM-10	Software usage restrictions	Software usage restrictions. Control from NIST SP 800-53 Rev 5 framework, domain: CM - Configuration Management.
NIST800-CM-11	User-installed software	User-installed software. Control from NIST SP 800-53 Rev 5 framework, domain: CM - Configuration Management.
NIST800-CM-2	Baseline configuration	Baseline configuration. Control from NIST SP 800-53 Rev 5 framework, domain: CM - Configuration Management.
NIST800-CM-3	Configuration change control	Configuration change control. Control from NIST SP 800-53 Rev 5 framework, domain: CM - Configuration Management.
NIST800-CM-4	Impact analyses	Impact analyses. Control from NIST SP 800-53 Rev 5 framework, domain: CM - Configuration Management.
NIST800-CM-5	Access restrictions for change	Access restrictions for change. Control from NIST SP 800-53 Rev 5 framework, domain: CM - Configuration Management.
NIST800-CM-6	Configuration settings	Configuration settings. Control from NIST SP 800-53 Rev 5 framework, domain: CM - Configuration Management.
NIST800-CM-7	Least functionality	Least functionality. Control from NIST SP 800-53 Rev 5 framework, domain: CM - Configuration Management.
NIST800-CM-8	System component inventory	System component inventory. Control from NIST SP 800-53 Rev 5 framework, domain: CM - Configuration Management.
NIST800-CM-9	Configuration management plan	Configuration management plan. Control from NIST SP 800-53 Rev 5 framework, domain: CM - Configuration Management.

CP - Contingency Planning

9 controls

Contingency planning controls

Controls in the CP - Contingency Planning domain of NIST SP 800-53 Rev 5 — 9 controls
Code	Title	Description
NIST800-CP-1	Policy and procedures for contingency planning	Policy and procedures for contingency planning. Control from NIST SP 800-53 Rev 5 framework, domain: CP - Contingency Pl...
NIST800-CP-10	System recovery and reconstitution	System recovery and reconstitution. Control from NIST SP 800-53 Rev 5 framework, domain: CP - Contingency Planning.
NIST800-CP-2	Contingency plan	Contingency plan. Control from NIST SP 800-53 Rev 5 framework, domain: CP - Contingency Planning.
NIST800-CP-3	Contingency training	Contingency training. Control from NIST SP 800-53 Rev 5 framework, domain: CP - Contingency Planning.
NIST800-CP-4	Contingency plan testing	Contingency plan testing. Control from NIST SP 800-53 Rev 5 framework, domain: CP - Contingency Planning.
NIST800-CP-6	Alternate storage site	Alternate storage site. Control from NIST SP 800-53 Rev 5 framework, domain: CP - Contingency Planning.
NIST800-CP-7	Alternate processing site	Alternate processing site. Control from NIST SP 800-53 Rev 5 framework, domain: CP - Contingency Planning.
NIST800-CP-8	Telecommunications services	Telecommunications services. Control from NIST SP 800-53 Rev 5 framework, domain: CP - Contingency Planning.
NIST800-CP-9	System backup	System backup. Control from NIST SP 800-53 Rev 5 framework, domain: CP - Contingency Planning.

IA - Identification and Authentication

10 controls

Identification and authentication controls

Controls in the IA - Identification and Authentication domain of NIST SP 800-53 Rev 5 — 10 controls
Code	Title	Description
NIST800-IA-1	Policy and procedures for identification and authentication	Policy and procedures for identification and authentication. Control from NIST SP 800-53 Rev 5 framework, domain: IA - I...
NIST800-IA-11	Re-authentication	Re-authentication. Control from NIST SP 800-53 Rev 5 framework, domain: IA - Identification and Authentication.
NIST800-IA-12	Identity proofing	Identity proofing. Control from NIST SP 800-53 Rev 5 framework, domain: IA - Identification and Authentication.
NIST800-IA-2	Identification and authentication of organizational users	Identification and authentication of organizational users. Control from NIST SP 800-53 Rev 5 framework, domain: IA - Ide...
NIST800-IA-3	Device identification and authentication	Device identification and authentication. Control from NIST SP 800-53 Rev 5 framework, domain: IA - Identification and A...
NIST800-IA-4	Identifier management	Identifier management. Control from NIST SP 800-53 Rev 5 framework, domain: IA - Identification and Authentication.
NIST800-IA-5	Authenticator management	Authenticator management. Control from NIST SP 800-53 Rev 5 framework, domain: IA - Identification and Authentication.
NIST800-IA-6	Authentication feedback	Authentication feedback. Control from NIST SP 800-53 Rev 5 framework, domain: IA - Identification and Authentication.
NIST800-IA-7	Cryptographic module authentication	Cryptographic module authentication. Control from NIST SP 800-53 Rev 5 framework, domain: IA - Identification and Authen...
NIST800-IA-8	Identification and authentication of non-organizational users	Identification and authentication of non-organizational users. Control from NIST SP 800-53 Rev 5 framework, domain: IA -...

IR - Incident Response

8 controls

Incident response controls

Controls in the IR - Incident Response domain of NIST SP 800-53 Rev 5 — 8 controls
Code	Title	Description
NIST800-IR-1	Policy and procedures for incident response	Policy and procedures for incident response. Control from NIST SP 800-53 Rev 5 framework, domain: IR - Incident Response...
NIST800-IR-2	Incident response training	Incident response training. Control from NIST SP 800-53 Rev 5 framework, domain: IR - Incident Response.
NIST800-IR-3	Incident response testing	Incident response testing. Control from NIST SP 800-53 Rev 5 framework, domain: IR - Incident Response.
NIST800-IR-4	Incident handling	Incident handling. Control from NIST SP 800-53 Rev 5 framework, domain: IR - Incident Response.
NIST800-IR-5	Incident monitoring	Incident monitoring. Control from NIST SP 800-53 Rev 5 framework, domain: IR - Incident Response.
NIST800-IR-6	Incident reporting	Incident reporting. Control from NIST SP 800-53 Rev 5 framework, domain: IR - Incident Response.
NIST800-IR-7	Incident response assistance	Incident response assistance. Control from NIST SP 800-53 Rev 5 framework, domain: IR - Incident Response.
NIST800-IR-8	Incident response plan	Incident response plan. Control from NIST SP 800-53 Rev 5 framework, domain: IR - Incident Response.

MA - Maintenance

5 controls

System maintenance controls

Controls in the MA - Maintenance domain of NIST SP 800-53 Rev 5 — 5 controls
Code	Title	Description
NIST800-MA-1	Policy and procedures for maintenance	Policy and procedures for maintenance. Control from NIST SP 800-53 Rev 5 framework, domain: MA - Maintenance.
NIST800-MA-2	Controlled maintenance	Controlled maintenance. Control from NIST SP 800-53 Rev 5 framework, domain: MA - Maintenance.
NIST800-MA-3	Maintenance tools	Maintenance tools. Control from NIST SP 800-53 Rev 5 framework, domain: MA - Maintenance.
NIST800-MA-4	Nonlocal maintenance	Nonlocal maintenance. Control from NIST SP 800-53 Rev 5 framework, domain: MA - Maintenance.
NIST800-MA-5	Maintenance personnel	Maintenance personnel. Control from NIST SP 800-53 Rev 5 framework, domain: MA - Maintenance.

MP - Media Protection

7 controls

Media protection controls

Controls in the MP - Media Protection domain of NIST SP 800-53 Rev 5 — 7 controls
Code	Title	Description
NIST800-MP-1	Policy and procedures for media protection	Policy and procedures for media protection. Control from NIST SP 800-53 Rev 5 framework, domain: MP - Media Protection.
NIST800-MP-2	Media access	Media access. Control from NIST SP 800-53 Rev 5 framework, domain: MP - Media Protection.
NIST800-MP-3	Media marking	Media marking. Control from NIST SP 800-53 Rev 5 framework, domain: MP - Media Protection.
NIST800-MP-4	Media storage	Media storage. Control from NIST SP 800-53 Rev 5 framework, domain: MP - Media Protection.
NIST800-MP-5	Media transport	Media transport. Control from NIST SP 800-53 Rev 5 framework, domain: MP - Media Protection.
NIST800-MP-6	Media sanitization	Media sanitization. Control from NIST SP 800-53 Rev 5 framework, domain: MP - Media Protection.
NIST800-MP-7	Media use	Media use. Control from NIST SP 800-53 Rev 5 framework, domain: MP - Media Protection.

Management

6 controls

Controls in the Management domain of NIST SP 800-53 Rev 5 — 6 controls
Code	Title	Description
SP800-53-CA	Assessment, Authorization, and Monitoring Family	The organization plans and conducts control assessments, system authorizations, ongoing monitoring, and connection autho...
SP800-53-PL	Planning Family	Security and privacy plans are developed and maintained, including rules of behavior, baseline tailoring, and central ma...
SP800-53-PM	Program Management Family	The organization maintains a program management function for security and privacy, including strategic plans, risk manag...
SP800-53-RA	Risk Assessment Family	The organization conducts risk assessments, threat awareness activities, privacy risk assessments, vulnerability monitor...
SP800-53-SA	System and Services Acquisition Family	Security and privacy requirements are addressed in acquisition processes, including supplier evaluation, system developm...
SP800-53-SR	Supply Chain Risk Management Family	The organization implements supply chain risk management including policy, plans, supplier reviews, provenance, tamperin...

Operational

8 controls

Controls in the Operational domain of NIST SP 800-53 Rev 5 — 8 controls
Code	Title	Description
SP800-53-AT	Awareness and Training Family	The organization provides security and privacy literacy training, role-based training, and training feedback aligned wit...
SP800-53-CM	Configuration Management Family	Configuration baselines are established, changes controlled, security impact analyses performed, and configurations moni...
SP800-53-CP	Contingency Planning Family	The organization develops contingency plans, trains personnel, tests plans, provides alternate storage and processing si...
SP800-53-IR	Incident Response Family	The organization establishes an incident response capability including planning, training, testing, handling, monitoring...
SP800-53-MA	Maintenance Family	Controlled maintenance is performed on systems, including timely maintenance, maintenance tools, nonlocal maintenance, a...
SP800-53-MP	Media Protection Family	Media containing system information is protected through access controls, marking, storage, transport, sanitization, and...
SP800-53-PE	Physical and Environmental Protection Family	Physical access to systems and facilities is controlled, environmental hazards mitigated, and visitors managed, with mon...
SP800-53-PS	Personnel Security Family	Personnel are screened, terminated and transferred under controlled procedures, with access agreements and sanctions for...

PE - Physical and Environmental Protection

15 controls

Physical and environmental protection controls

Controls in the PE - Physical and Environmental Protection domain of NIST SP 800-53 Rev 5 — 15 controls
Code	Title	Description
NIST800-PE-1	Policy and procedures for physical and environmental protection	Policy and procedures for physical and environmental protection. Control from NIST SP 800-53 Rev 5 framework, domain: PE...
NIST800-PE-10	Emergency shutoff	Emergency shutoff. Control from NIST SP 800-53 Rev 5 framework, domain: PE - Physical and Environmental Protection.
NIST800-PE-11	Emergency power	Emergency power. Control from NIST SP 800-53 Rev 5 framework, domain: PE - Physical and Environmental Protection.
NIST800-PE-12	Emergency lighting	Emergency lighting. Control from NIST SP 800-53 Rev 5 framework, domain: PE - Physical and Environmental Protection.
NIST800-PE-13	Fire protection	Fire protection. Control from NIST SP 800-53 Rev 5 framework, domain: PE - Physical and Environmental Protection.
NIST800-PE-14	Environmental controls	Environmental controls. Control from NIST SP 800-53 Rev 5 framework, domain: PE - Physical and Environmental Protection.
NIST800-PE-15	Water damage protection	Water damage protection. Control from NIST SP 800-53 Rev 5 framework, domain: PE - Physical and Environmental Protection...
NIST800-PE-17	Alternate work site	Alternate work site. Control from NIST SP 800-53 Rev 5 framework, domain: PE - Physical and Environmental Protection.
NIST800-PE-2	Physical access authorizations	Physical access authorizations. Control from NIST SP 800-53 Rev 5 framework, domain: PE - Physical and Environmental Pro...
NIST800-PE-3	Physical access control	Physical access control. Control from NIST SP 800-53 Rev 5 framework, domain: PE - Physical and Environmental Protection...
NIST800-PE-4	Access control for transmission	Access control for transmission. Control from NIST SP 800-53 Rev 5 framework, domain: PE - Physical and Environmental Pr...
NIST800-PE-5	Access control for output devices	Access control for output devices. Control from NIST SP 800-53 Rev 5 framework, domain: PE - Physical and Environmental...
NIST800-PE-6	Monitoring physical access	Monitoring physical access. Control from NIST SP 800-53 Rev 5 framework, domain: PE - Physical and Environmental Protect...
NIST800-PE-8	Visitor access records	Visitor access records. Control from NIST SP 800-53 Rev 5 framework, domain: PE - Physical and Environmental Protection.
NIST800-PE-9	Power equipment and cabling	Power equipment and cabling. Control from NIST SP 800-53 Rev 5 framework, domain: PE - Physical and Environmental Protec...

PL - Planning

6 controls

Security planning controls

Controls in the PL - Planning domain of NIST SP 800-53 Rev 5 — 6 controls
Code	Title	Description
NIST800-PL-1	Policy and procedures for planning	Policy and procedures for planning. Control from NIST SP 800-53 Rev 5 framework, domain: PL - Planning.
NIST800-PL-10	Baseline selection	Baseline selection. Control from NIST SP 800-53 Rev 5 framework, domain: PL - Planning.
NIST800-PL-11	Baseline tailoring	Baseline tailoring. Control from NIST SP 800-53 Rev 5 framework, domain: PL - Planning.
NIST800-PL-2	System security and privacy plans	System security and privacy plans. Control from NIST SP 800-53 Rev 5 framework, domain: PL - Planning.
NIST800-PL-4	Rules of behavior	Rules of behavior. Control from NIST SP 800-53 Rev 5 framework, domain: PL - Planning.
NIST800-PL-8	Security and privacy architectures	Security and privacy architectures. Control from NIST SP 800-53 Rev 5 framework, domain: PL - Planning.

PS - Personnel Security

9 controls

Personnel security controls

Controls in the PS - Personnel Security domain of NIST SP 800-53 Rev 5 — 9 controls
Code	Title	Description
NIST800-PS-1	Policy and procedures for personnel security	Policy and procedures for personnel security. Control from NIST SP 800-53 Rev 5 framework, domain: PS - Personnel Securi...
NIST800-PS-2	Position risk designation	Position risk designation. Control from NIST SP 800-53 Rev 5 framework, domain: PS - Personnel Security.
NIST800-PS-3	Personnel screening	Personnel screening. Control from NIST SP 800-53 Rev 5 framework, domain: PS - Personnel Security.
NIST800-PS-4	Personnel termination	Personnel termination. Control from NIST SP 800-53 Rev 5 framework, domain: PS - Personnel Security.
NIST800-PS-5	Personnel transfer	Personnel transfer. Control from NIST SP 800-53 Rev 5 framework, domain: PS - Personnel Security.
NIST800-PS-6	Access agreements	Access agreements. Control from NIST SP 800-53 Rev 5 framework, domain: PS - Personnel Security.
NIST800-PS-7	External personnel security	External personnel security. Control from NIST SP 800-53 Rev 5 framework, domain: PS - Personnel Security.
NIST800-PS-8	Personnel sanctions	Personnel sanctions. Control from NIST SP 800-53 Rev 5 framework, domain: PS - Personnel Security.
NIST800-PS-9	Position descriptions	Position descriptions. Control from NIST SP 800-53 Rev 5 framework, domain: PS - Personnel Security.

Privacy

1 controls

Controls in the Privacy domain of NIST SP 800-53 Rev 5 — 1 controls
Code	Title	Description
SP800-53-PT	PII Processing and Transparency Family	Personally identifiable information processing has documented authority, purpose specification, consent, individual acce...

RA - Risk Assessment

7 controls

Risk assessment controls

Controls in the RA - Risk Assessment domain of NIST SP 800-53 Rev 5 — 7 controls
Code	Title	Description
NIST800-RA-1	Policy and procedures for risk assessment	Policy and procedures for risk assessment. Control from NIST SP 800-53 Rev 5 framework, domain: RA - Risk Assessment.
NIST800-RA-10	Threat hunting	Threat hunting. Control from NIST SP 800-53 Rev 5 framework, domain: RA - Risk Assessment.
NIST800-RA-2	Security categorization	Security categorization. Control from NIST SP 800-53 Rev 5 framework, domain: RA - Risk Assessment.
NIST800-RA-3	Risk assessment	Risk assessment. Control from NIST SP 800-53 Rev 5 framework, domain: RA - Risk Assessment.
NIST800-RA-5	Vulnerability monitoring and scanning	Vulnerability monitoring and scanning. Control from NIST SP 800-53 Rev 5 framework, domain: RA - Risk Assessment.
NIST800-RA-7	Risk response	Risk response. Control from NIST SP 800-53 Rev 5 framework, domain: RA - Risk Assessment.
NIST800-RA-9	Criticality analysis	Criticality analysis. Control from NIST SP 800-53 Rev 5 framework, domain: RA - Risk Assessment.

SA - System and Services Acquisition

11 controls

System and services acquisition controls

Controls in the SA - System and Services Acquisition domain of NIST SP 800-53 Rev 5 — 11 controls
Code	Title	Description
NIST800-SA-1	Policy and procedures for system and services acquisition	Policy and procedures for system and services acquisition. Control from NIST SP 800-53 Rev 5 framework, domain: SA - Sys...
NIST800-SA-10	Developer configuration management	Developer configuration management. Control from NIST SP 800-53 Rev 5 framework, domain: SA - System and Services Acquis...
NIST800-SA-11	Developer testing and evaluation	Developer testing and evaluation. Control from NIST SP 800-53 Rev 5 framework, domain: SA - System and Services Acquisit...
NIST800-SA-15	Development process, standards, and tools	Development process, standards, and tools. Control from NIST SP 800-53 Rev 5 framework, domain: SA - System and Services...
NIST800-SA-2	Allocation of resources	Allocation of resources. Control from NIST SP 800-53 Rev 5 framework, domain: SA - System and Services Acquisition.
NIST800-SA-22	Developer security and privacy architecture	Developer security and privacy architecture. Control from NIST SP 800-53 Rev 5 framework, domain: SA - System and Servic...
NIST800-SA-3	System development life cycle	System development life cycle. Control from NIST SP 800-53 Rev 5 framework, domain: SA - System and Services Acquisition...
NIST800-SA-4	Acquisition process	Acquisition process. Control from NIST SP 800-53 Rev 5 framework, domain: SA - System and Services Acquisition.
NIST800-SA-5	System documentation	System documentation. Control from NIST SP 800-53 Rev 5 framework, domain: SA - System and Services Acquisition.
NIST800-SA-8	Security and privacy engineering principles	Security and privacy engineering principles. Control from NIST SP 800-53 Rev 5 framework, domain: SA - System and Servic...
NIST800-SA-9	External system services	External system services. Control from NIST SP 800-53 Rev 5 framework, domain: SA - System and Services Acquisition.

SC - System and Communications Protection

17 controls

System and communications protection controls

SI - System and Information Integrity

9 controls

System and information integrity controls

Controls in the SI - System and Information Integrity domain of NIST SP 800-53 Rev 5 — 9 controls
Code	Title	Description
NIST800-SI-1	Policy and procedures for system and information integrity	Policy and procedures for system and information integrity. Control from NIST SP 800-53 Rev 5 framework, domain: SI - Sy...
NIST800-SI-10	Information input validation	Information input validation. Control from NIST SP 800-53 Rev 5 framework, domain: SI - System and Information Integrity...
NIST800-SI-12	Information management and retention	Information management and retention. Control from NIST SP 800-53 Rev 5 framework, domain: SI - System and Information I...
NIST800-SI-16	Memory protection	Memory protection. Control from NIST SP 800-53 Rev 5 framework, domain: SI - System and Information Integrity.
NIST800-SI-2	Flaw remediation	Flaw remediation. Control from NIST SP 800-53 Rev 5 framework, domain: SI - System and Information Integrity.
NIST800-SI-3	Malicious code protection	Malicious code protection. Control from NIST SP 800-53 Rev 5 framework, domain: SI - System and Information Integrity.
NIST800-SI-4	System monitoring	System monitoring. Control from NIST SP 800-53 Rev 5 framework, domain: SI - System and Information Integrity.
NIST800-SI-5	Security alerts, advisories, and directives	Security alerts, advisories, and directives. Control from NIST SP 800-53 Rev 5 framework, domain: SI - System and Inform...
NIST800-SI-7	Software, firmware, and information integrity	Software, firmware, and information integrity. Control from NIST SP 800-53 Rev 5 framework, domain: SI - System and Info...

SR - Supply Chain Risk Management

9 controls

Supply chain risk management controls

Controls in the SR - Supply Chain Risk Management domain of NIST SP 800-53 Rev 5 — 9 controls
Code	Title	Description
NIST800-SR-1	Policy and procedures for supply chain risk management	Policy and procedures for supply chain risk management. Control from NIST SP 800-53 Rev 5 framework, domain: SR - Supply...
NIST800-SR-10	Inspection of systems or components	Inspection of systems or components. Control from NIST SP 800-53 Rev 5 framework, domain: SR - Supply Chain Risk Managem...
NIST800-SR-11	Component authenticity	Component authenticity. Control from NIST SP 800-53 Rev 5 framework, domain: SR - Supply Chain Risk Management.
NIST800-SR-12	Component disposal	Component disposal. Control from NIST SP 800-53 Rev 5 framework, domain: SR - Supply Chain Risk Management.
NIST800-SR-2	Supply chain risk management plan	Supply chain risk management plan. Control from NIST SP 800-53 Rev 5 framework, domain: SR - Supply Chain Risk Managemen...
NIST800-SR-3	Supply chain controls and processes	Supply chain controls and processes. Control from NIST SP 800-53 Rev 5 framework, domain: SR - Supply Chain Risk Managem...
NIST800-SR-5	Acquisition strategies, tools, and methods	Acquisition strategies, tools, and methods. Control from NIST SP 800-53 Rev 5 framework, domain: SR - Supply Chain Risk...
NIST800-SR-6	Supplier assessments and reviews	Supplier assessments and reviews. Control from NIST SP 800-53 Rev 5 framework, domain: SR - Supply Chain Risk Management...
NIST800-SR-8	Notification agreements	Notification agreements. Control from NIST SP 800-53 Rev 5 framework, domain: SR - Supply Chain Risk Management.

Technical

5 controls

Controls in the Technical domain of NIST SP 800-53 Rev 5 — 5 controls
Code	Title	Description
SP800-53-AC	Access Control Family	The organization manages account types, access enforcement, separation of duties, least privilege, unsuccessful logon at...
SP800-53-AU	Audit and Accountability Family	Systems generate audit records for defined events, with content sufficient to support investigation, with protection of...
SP800-53-IA	Identification and Authentication Family	Users and devices are uniquely identified and authenticated using mechanisms appropriate to assurance levels, with manag...
SP800-53-SC	System and Communications Protection Family	The organization protects communications and applies cryptographic protections, boundary protections, denial of service...
SP800-53-SI	System and Information Integrity Family	The organization identifies, reports, and corrects information system flaws, provides malicious code protection, monitor...

Your Compliance Coverage

If you comply with NIST SP 800-53 Rev 5, you already cover:

NIST SP 800-171

21%

40 controls mapped

Compare →

NIST SP 800-171A Rev 3 - Assessing CUI Security Requirements

18%

34 controls mapped

Compare →

NIST SP 800-82 Revision 3: Guide to Industrial Control Systems (ICS) Security

17%

32 controls mapped

Compare →

+ 241 more: CMMC 2.0 (17%), Canada ITSG-33 - IT Security Risk Management (16%)

See all 244 mapped frameworks ↓

Maps to 244 other frameworks

192 total controls

NIST SP 800-171

40 source controls mapped|37 target controls covered

21%

NIST SP 800-171A Rev 3 - Assessing CUI Security Requirements

34 source controls mapped|18 target controls covered

18%

NIST SP 800-82 Revision 3: Guide to Industrial Control Systems (ICS) Security

32 source controls mapped|6 target controls covered

17%

CMMC 2.0

32 source controls mapped|32 target controls covered

17%

Canada ITSG-33 - IT Security Risk Management

31 source controls mapped|23 target controls covered

16%

APRA CPS 234

31 source controls mapped|25 target controls covered

16%

API 1164

31 source controls mapped|22 target controls covered

16%

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1

30 source controls mapped|33 target controls covered

16%

NIST SP 800-207

29 source controls mapped|32 target controls covered

15%

BSI IT-Grundschutz

28 source controls mapped|19 target controls covered

15%

ISO 27017

27 source controls mapped|13 target controls covered

14%

ISO 27018

27 source controls mapped|13 target controls covered

14%

NIST SP 800-190

27 source controls mapped|13 target controls covered

14%

Azure Security Benchmark

27 source controls mapped|13 target controls covered

14%

AWS Well-Architected Security Pillar

27 source controls mapped|13 target controls covered

14%

NIST Privacy Framework

26 source controls mapped|4 target controls covered

14%

NIST SP 800-171A - Assessing Security Requirements for Controlled Unclassified Information (CUI)

26 source controls mapped|19 target controls covered

14%

Annex 11 to EU GMP - Computerised Systems

25 source controls mapped|9 target controls covered

13%

NIST SP 800-172

24 source controls mapped|36 target controls covered

13%

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association)

23 source controls mapped|10 target controls covered

12%

NIST Cybersecurity Framework 2.0

23 source controls mapped|18 target controls covered

12%

APRA CPS 230 Operational Risk Management

23 source controls mapped|26 target controls covered

12%

TSA Pipeline Cybersecurity Directives

23 source controls mapped|2 target controls covered

12%

PAS 1192-5:2015 - Security-Minded Approach to BIM and Digital Built Environments

23 source controls mapped|4 target controls covered

12%

NIST SP 800-53A Rev. 5

22 source controls mapped|30 target controls covered

11%

Oman National Cybersecurity Framework

22 source controls mapped|5 target controls covered

11%

SSAE 18 - Attestation Standards (SOC Reporting)

22 source controls mapped|13 target controls covered

11%

ISO/IEC 27011:2024

22 source controls mapped|13 target controls covered

11%

IAEA Nuclear Security Series - Computer Security at Nuclear Facilities (NSS-17-T Rev 1)

21 source controls mapped|6 target controls covered

11%

FFIEC Cybersecurity Assessment Tool (CAT)

21 source controls mapped|8 target controls covered

11%

ISO/IEC 27010:2015

20 source controls mapped|8 target controls covered

10%

SLSA

20 source controls mapped|2 target controls covered

10%

SIG (Shared Assessments)

20 source controls mapped|3 target controls covered

10%

PTES

20 source controls mapped|4 target controls covered

10%

OWASP SAMM

20 source controls mapped|3 target controls covered

10%

OpenSSF Scorecard

20 source controls mapped|5 target controls covered

10%

O-RAN WG11 Security Specification

20 source controls mapped|4 target controls covered

10%

NIST SP 800-92

20 source controls mapped|5 target controls covered

10%

NIST SP 800-88

20 source controls mapped|4 target controls covered

10%

ISO 27799

20 source controls mapped|9 target controls covered

10%

ISO 13485

20 source controls mapped|10 target controls covered

10%

ISO/SAE 21434

20 source controls mapped|12 target controls covered

10%

ISO 27043

20 source controls mapped|13 target controls covered

10%

NIST SP 1800-32

19 source controls mapped|13 target controls covered

10%

IEC 62443

19 source controls mapped|13 target controls covered

10%

ISO 27019

19 source controls mapped|13 target controls covered

10%

CISA Zero Trust Maturity Model

18 source controls mapped|24 target controls covered

FBI CJIS Security Policy

18 source controls mapped|7 target controls covered

ISO/IEC 27400:2022

18 source controls mapped|8 target controls covered

ASD Strategies to Mitigate Cyber Security Incidents

17 source controls mapped|14 target controls covered

3GPP 5G Security Architecture (TS 33.501)

17 source controls mapped|38 target controls covered

CISA Industrial Control Systems (ICS) Security Guidance

17 source controls mapped|16 target controls covered

FTC GLBA Safeguards Rule (16 CFR Part 314)

17 source controls mapped|3 target controls covered

NIST SP 800-160

16 source controls mapped|29 target controls covered

Secure by Design: A Guide for Manufacturers (CISA)

16 source controls mapped|3 target controls covered

ISO 28001:2007 Supply Chain Security Management

16 source controls mapped|5 target controls covered

CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0

16 source controls mapped|10 target controls covered

UK Gambling Commission - Cyber Resilience Requirements

15 source controls mapped|1 target controls covered

NIST AI Risk Management Framework (AI RMF 1.0)

15 source controls mapped|10 target controls covered

TISAX - Trusted Information Security Assessment Exchange

15 source controls mapped|3 target controls covered

PSD2 SCA

14 source controls mapped|4 target controls covered

OSFI B-13

14 source controls mapped|5 target controls covered

Open Banking Security

14 source controls mapped|4 target controls covered

FFIEC IT Examination Handbook

14 source controls mapped|9 target controls covered

PCI P2PE

14 source controls mapped|9 target controls covered

PCI PIN Security

14 source controls mapped|9 target controls covered

PCI SSF

14 source controls mapped|9 target controls covered

ANSSI Cybersecurity Framework

14 source controls mapped|14 target controls covered

SOC 2

14 source controls mapped|8 target controls covered

ISO 20000-1

13 source controls mapped|5 target controls covered

NIST SP 800-218

12 source controls mapped|40 target controls covered

AS9100D:2016 - Quality Management Systems for Aviation, Space, and Defence

12 source controls mapped|6 target controls covered

NRF Cybersecurity and Data Privacy Framework (National Retail Federation)

12 source controls mapped|3 target controls covered

Virginia CDPA

12 source controls mapped|2 target controls covered

Vietnam PDPD

12 source controls mapped|2 target controls covered

Uruguay DPL

12 source controls mapped|3 target controls covered

Texas Data Privacy Act

12 source controls mapped|2 target controls covered

Taiwan PDPA

12 source controls mapped|2 target controls covered

Qatar DPL

12 source controls mapped|3 target controls covered

Privacy Act 2020

12 source controls mapped|3 target controls covered

POPIA

12 source controls mapped|2 target controls covered

Personal Data Act (personopplysningsloven)

12 source controls mapped|3 target controls covered

PDPA Thailand

12 source controls mapped|3 target controls covered

PDPA Singapore

12 source controls mapped|3 target controls covered

Oregon Consumer Privacy Act

12 source controls mapped|3 target controls covered

New Jersey Data Privacy Act

12 source controls mapped|3 target controls covered

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL)

12 source controls mapped|4 target controls covered

APPI

12 source controls mapped|5 target controls covered

NIST SP 800-124 Revision 2 - Guidelines for Managing the Security of Mobile Devices

12 source controls mapped|5 target controls covered

Bahrain PDPL

12 source controls mapped|5 target controls covered

Sigstore - Software Artifact Signing and Verification

12 source controls mapped|2 target controls covered

New Zealand Information Security Manual (NZISM)

12 source controls mapped|3 target controls covered

ISO 15189:2022 - Medical Laboratories Requirements for Quality and Competence

12 source controls mapped|8 target controls covered

IEC 62351 - Power Systems Communication Security

12 source controls mapped|3 target controls covered

Authorised Economic Operator (AEO) Programmes - Global Standards

12 source controls mapped|7 target controls covered

GDPR

11 source controls mapped|6 target controls covered

CNCF Security Technical Advisory Group (TAG)

11 source controls mapped|18 target controls covered

NIST SP 800-161

11 source controls mapped|15 target controls covered

CMMC 2.0 Level 1

11 source controls mapped|17 target controls covered

Australia Consumer Data Right - Banking (CDR)

11 source controls mapped|6 target controls covered

DoD Zero Trust Reference Architecture

11 source controls mapped|15 target controls covered

Aged Care Quality Standards (Australia)

11 source controls mapped|7 target controls covered

MARS-E - Minimum Acceptable Risk Standards for Exchanges

11 source controls mapped|2 target controls covered

DAMA-DMBOK2 - Data Management Body of Knowledge (2nd Edition)

11 source controls mapped|3 target controls covered

ITIL 4

10 source controls mapped|4 target controls covered

Australian Energy Sector Cyber Security Framework (AESCSF)

10 source controls mapped|9 target controls covered

NIST SP 800-187

10 source controls mapped|15 target controls covered

APRA SPS 220 Risk Management (Superannuation)

10 source controls mapped|9 target controls covered

ISO/IEC 23894:2023

9 source controls mapped|9 target controls covered

AS9100D - Aerospace Quality Management System

9 source controls mapped|7 target controls covered

ISO/IEC 27003:2017

9 source controls mapped|7 target controls covered

ASEAN Data Management Framework

9 source controls mapped|23 target controls covered

NIST SP 800-128

9 source controls mapped|21 target controls covered

ASIC Cyber Resilience Good Practices

9 source controls mapped|8 target controls covered

South Korea PIPA

9 source controls mapped|3 target controls covered

Peru DPL

9 source controls mapped|2 target controls covered

Nigeria Open Banking Regulatory Framework (CBN, 2023)

9 source controls mapped|3 target controls covered

EASA Part-IS - Information Security in Aviation

9 source controls mapped|8 target controls covered

ISO/IEC 29147:2018

9 source controls mapped|6 target controls covered

ISO 27005

9 source controls mapped|7 target controls covered

ISO/IEC 27557:2022 - Organisational Privacy Risk Management

9 source controls mapped|8 target controls covered

AML/CTF Act 2006 (Australia)

9 source controls mapped|3 target controls covered

ICAO Annex 17 - Aviation Security (AVSEC)

9 source controls mapped|2 target controls covered

CFTC System Safeguards (17 CFR 37, 38, 39, 49)

8 source controls mapped|8 target controls covered

CCSDS 350.0-G-3 - Space Communications Security (Consultative Committee for Space Data Systems)

8 source controls mapped|14 target controls covered

NIST SP 800-183

8 source controls mapped|10 target controls covered

ACSC Essential Eight

8 source controls mapped|24 target controls covered

ISO 22320:2018

8 source controls mapped|4 target controls covered

ASIS SPC.1-2009 - Organizational Resilience Standard

8 source controls mapped|3 target controls covered

NFPA 1600 - Standard on Continuity, Emergency, and Crisis Management

8 source controls mapped|4 target controls covered

SANS Incident Handler's Handbook and PICERL Methodology

8 source controls mapped|6 target controls covered

AICPA Privacy Management Framework (PMF)

8 source controls mapped|3 target controls covered

ISO/IEC 23837 - Security Requirements for Quantum Key Distribution

8 source controls mapped|6 target controls covered

UK FCA/PRA Operational Resilience Framework

8 source controls mapped|3 target controls covered

IEC 62304:2015 Medical Device Software Lifecycle Processes

7 source controls mapped|5 target controls covered

ISO 26262:2018 - Functional Safety for Road Vehicles

7 source controls mapped|3 target controls covered

ISO 19011

7 source controls mapped|5 target controls covered

DORA

7 source controls mapped|6 target controls covered

ISO/IEC 27006:2024

7 source controls mapped|3 target controls covered

French Sapin II Law (Law No. 2016-1691)

7 source controls mapped|3 target controls covered

Australia IRAP - Information Security Registered Assessors Program

7 source controls mapped|14 target controls covered

Automotive SPICE (ASPICE) v4.0 - Process Assessment Model

6 source controls mapped|2 target controls covered

UK GDPR (UK General Data Protection Regulation)

6 source controls mapped|1 target controls covered

Barbados Data Protection Act 2019

6 source controls mapped|1 target controls covered

NIST SP 800-150

6 source controls mapped|17 target controls covered

ITU-T X.805 - Security Architecture for End-to-End Communications

6 source controls mapped|2 target controls covered

ISO 22739:2024 - Blockchain and Distributed Ledger Technologies Vocabulary

6 source controls mapped|4 target controls covered

African Union Malabo Convention

6 source controls mapped|6 target controls covered

ISO/IEC 17025:2017 - General Requirements for Testing and Calibration Laboratories

6 source controls mapped|2 target controls covered

Space ISAC (Information Sharing and Analysis Center) - Threat Framework

6 source controls mapped|2 target controls covered

ISO 31000

6 source controls mapped|6 target controls covered

UK AI Regulation Framework

6 source controls mapped|1 target controls covered

SEC Climate Disclosure Rule

6 source controls mapped|1 target controls covered

PIC/S Guide to Good Manufacturing Practice for Medicinal Products

6 source controls mapped|3 target controls covered

Own Risk and Solvency Assessment (ORSA) - NAIC Model Act

6 source controls mapped|2 target controls covered

OECD Guidelines for Multinational Enterprises on Responsible Business Conduct (2023 Update)

6 source controls mapped|1 target controls covered

OECD AI Principles

6 source controls mapped|2 target controls covered

ISO 41001:2018 - Facility Management Systems

6 source controls mapped|3 target controls covered

ISO 39001:2012 - Road Traffic Safety Management

6 source controls mapped|3 target controls covered

ISO 22313:2020 - Guidance on Business Continuity Management Systems

6 source controls mapped|3 target controls covered

ISO 31000:2018

5 source controls mapped|3 target controls covered

ISO 27701:2019

5 source controls mapped|1 target controls covered

Australia My Health Records Act 2012

5 source controls mapped|5 target controls covered

DISA Security Technical Implementation Guides (STIGs)

5 source controls mapped|5 target controls covered

ISO/IEC 30111:2019

5 source controls mapped|4 target controls covered

FIDO2 / WebAuthn

5 source controls mapped|1 target controls covered

ISO/IEC 29115:2023 - Entity Authentication Assurance Framework

5 source controls mapped|4 target controls covered

ETSI EN 303 645

5 source controls mapped|5 target controls covered

ISO 22317

5 source controls mapped|3 target controls covered

ISO 22316

5 source controls mapped|3 target controls covered

ISO/IEC 27031:2011

5 source controls mapped|4 target controls covered

ISO 22318

5 source controls mapped|3 target controls covered

Act on the Implementation of the General Data Protection Regulation (OG 42/2018)

5 source controls mapped|4 target controls covered

SA8000:2014 - Social Accountability Standard

5 source controls mapped|2 target controls covered

IAIS Insurance Core Principles (ICPs)

5 source controls mapped|4 target controls covered

ISO/IEC 29134:2023

5 source controls mapped|4 target controls covered

ISO/IEC 42001:2023

4 source controls mapped|3 target controls covered

SASB Standards

4 source controls mapped|2 target controls covered

ICH Q10 - Pharmaceutical Quality System

4 source controls mapped|3 target controls covered

Papua New Guinea National Cybersecurity Policy & Cybercrime Act (2016)

4 source controls mapped|2 target controls covered

Florida Digital Bill of Rights (FDBR)

4 source controls mapped|3 target controls covered

NSA Guidance for Transition to Quantum-Resistant Cryptography

4 source controls mapped|4 target controls covered

Austria Data Protection Act (Datenschutzgesetz, DSG, amended 2018)

4 source controls mapped|1 target controls covered

APRA CPS 220 Risk Management

4 source controls mapped|5 target controls covered

IEC 60601-1 - Medical Electrical Equipment Safety

4 source controls mapped|4 target controls covered

21 CFR Part 211 - Current Good Manufacturing Practice

4 source controls mapped|4 target controls covered

FedRAMP High

4 source controls mapped|3 target controls covered

NIST SP 800-53 Revision 5.1 HIGH

4 source controls mapped|3 target controls covered

FedRAMP Moderate

4 source controls mapped|3 target controls covered

NIST SP 800-53 Rev 5 MODERATE

4 source controls mapped|2 target controls covered

NIST SP 800-53 Rev 5 LOW

4 source controls mapped|2 target controls covered

ISO 27002:2022

3 source controls mapped|2 target controls covered

Trinidad and Tobago Data Protection Act 2011