Back to Frameworks

NIST SP 800-53 Rev 5

Self-Assess
United States (federal information systems; voluntary for other organizations)
vRev 5, release 5.2.0 (27 August 2025)
20 domains
1014 controls

The complete NIST SP 800-53 Rev 5 catalog at release 5.2.0: 1014 security and privacy controls and control enhancements in 20 families, each with its public-domain control statement (parameters organization-defined), its SP 800-53B baseline allocation and the SP 800-53A Rev 5 evidence an assessor examines.

Verified

NIST SP 800-53 Rev 5 is a compliance framework from United States (federal information systems; voluntary for other organizations) with 20 domains and 1014 controls that map to 271 other frameworks. The largest domains are SC - System and Communications Protection (139 controls), AC - Access Control (131 controls), SA - System and Services Acquisition (108 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (20)

AC - Access Control

131 controls

Policies and procedures for access control

Controls in the AC - Access Control domain of NIST SP 800-53 Rev 5: 131 controls
CodeTitle
NIST800-AC-1AC-1 Policy and Procedures
NIST800-AC-10AC-10 Concurrent Session Control
NIST800-AC-11AC-11 Device Lock
NIST800-AC-11(1)AC-11(1) Device Lock | Pattern-hiding Displays
NIST800-AC-12AC-12 Session Termination
NIST800-AC-12(1)AC-12(1) Session Termination | User-initiated Logouts
NIST800-AC-12(2)AC-12(2) Session Termination | Termination Message
NIST800-AC-12(3)AC-12(3) Session Termination | Timeout Warning Message
NIST800-AC-14AC-14 Permitted Actions Without Identification or Authentication
NIST800-AC-16AC-16 Security and Privacy Attributes
NIST800-AC-16(1)AC-16(1) Security and Privacy Attributes | Dynamic Attribute Association
NIST800-AC-16(10)AC-16(10) Security and Privacy Attributes | Attribute Configuration by Authorized Individuals
NIST800-AC-16(2)AC-16(2) Security and Privacy Attributes | Attribute Value Changes by Authorized Individuals
NIST800-AC-16(3)AC-16(3) Security and Privacy Attributes | Maintenance of Attribute Associations by System
NIST800-AC-16(4)AC-16(4) Security and Privacy Attributes | Association of Attributes by Authorized Individuals
NIST800-AC-16(5)AC-16(5) Security and Privacy Attributes | Attribute Displays on Objects to Be Output
NIST800-AC-16(6)AC-16(6) Security and Privacy Attributes | Maintenance of Attribute Association
NIST800-AC-16(7)AC-16(7) Security and Privacy Attributes | Consistent Attribute Interpretation
NIST800-AC-16(8)AC-16(8) Security and Privacy Attributes | Association Techniques and Technologies
NIST800-AC-16(9)AC-16(9) Security and Privacy Attributes | Attribute Reassignment: Regrading Mechanisms
NIST800-AC-17AC-17 Remote Access
NIST800-AC-17(1)AC-17(1) Remote Access | Monitoring and Control
NIST800-AC-17(10)AC-17(10) Remote Access | Authenticate Remote Commands
NIST800-AC-17(2)AC-17(2) Remote Access | Protection of Confidentiality and Integrity Using Encryption
NIST800-AC-17(3)AC-17(3) Remote Access | Managed Access Control Points
NIST800-AC-17(4)AC-17(4) Remote Access | Privileged Commands and Access
NIST800-AC-17(6)AC-17(6) Remote Access | Protection of Mechanism Information
NIST800-AC-17(9)AC-17(9) Remote Access | Disconnect or Disable Access
NIST800-AC-18AC-18 Wireless Access
NIST800-AC-18(1)AC-18(1) Wireless Access | Authentication and Encryption
NIST800-AC-18(3)AC-18(3) Wireless Access | Disable Wireless Networking
NIST800-AC-18(4)AC-18(4) Wireless Access | Restrict Configurations by Users
NIST800-AC-18(5)AC-18(5) Wireless Access | Antennas and Transmission Power Levels
NIST800-AC-19AC-19 Access Control for Mobile Devices
NIST800-AC-19(4)AC-19(4) Access Control for Mobile Devices | Restrictions for Classified Information
NIST800-AC-19(5)AC-19(5) Access Control for Mobile Devices | Full Device or Container-based Encryption
NIST800-AC-2AC-2 Account Management
NIST800-AC-2(1)AC-2(1) Account Management | Automated System Account Management
NIST800-AC-2(11)AC-2(11) Account Management | Usage Conditions
NIST800-AC-2(12)AC-2(12) Account Management | Account Monitoring for Atypical Usage
NIST800-AC-2(13)AC-2(13) Account Management | Disable Accounts for High-risk Individuals
NIST800-AC-2(2)AC-2(2) Account Management | Automated Temporary and Emergency Account Management
NIST800-AC-2(3)AC-2(3) Account Management | Disable Accounts
NIST800-AC-2(4)AC-2(4) Account Management | Automated Audit Actions
NIST800-AC-2(5)AC-2(5) Account Management | Inactivity Logout
NIST800-AC-2(6)AC-2(6) Account Management | Dynamic Privilege Management
NIST800-AC-2(7)AC-2(7) Account Management | Privileged User Accounts
NIST800-AC-2(8)AC-2(8) Account Management | Dynamic Account Management
NIST800-AC-2(9)AC-2(9) Account Management | Restrictions on Use of Shared and Group Accounts
NIST800-AC-20AC-20 Use of External Systems
NIST800-AC-20(1)AC-20(1) Use of External Systems | Limits on Authorized Use
NIST800-AC-20(2)AC-20(2) Use of External Systems | Portable Storage Devices: Restricted Use
NIST800-AC-20(3)AC-20(3) Use of External Systems | Non-organizationally Owned Systems: Restricted Use
NIST800-AC-20(4)AC-20(4) Use of External Systems | Network Accessible Storage Devices: Prohibited Use
NIST800-AC-20(5)AC-20(5) Use of External Systems | Portable Storage Devices: Prohibited Use
NIST800-AC-21AC-21 Information Sharing
NIST800-AC-21(1)AC-21(1) Information Sharing | Automated Decision Support
NIST800-AC-21(2)AC-21(2) Information Sharing | Information Search and Retrieval
NIST800-AC-22AC-22 Publicly Accessible Content
NIST800-AC-23AC-23 Data Mining Protection
NIST800-AC-24AC-24 Access Control Decisions
NIST800-AC-24(1)AC-24(1) Access Control Decisions | Transmit Access Authorization Information
NIST800-AC-24(2)AC-24(2) Access Control Decisions | No User or Process Identity
NIST800-AC-25AC-25 Reference Monitor
NIST800-AC-3AC-3 Access Enforcement
NIST800-AC-3(10)AC-3(10) Access Enforcement | Audited Override of Access Control Mechanisms
NIST800-AC-3(11)AC-3(11) Access Enforcement | Restrict Access to Specific Information Types
NIST800-AC-3(12)AC-3(12) Access Enforcement | Assert and Enforce Application Access
NIST800-AC-3(13)AC-3(13) Access Enforcement | Attribute-based Access Control
NIST800-AC-3(14)AC-3(14) Access Enforcement | Individual Access
NIST800-AC-3(15)AC-3(15) Access Enforcement | Discretionary and Mandatory Access Control
NIST800-AC-3(2)AC-3(2) Access Enforcement | Dual Authorization
NIST800-AC-3(3)AC-3(3) Access Enforcement | Mandatory Access Control
NIST800-AC-3(4)AC-3(4) Access Enforcement | Discretionary Access Control
NIST800-AC-3(5)AC-3(5) Access Enforcement | Security-relevant Information
NIST800-AC-3(7)AC-3(7) Access Enforcement | Role-based Access Control
NIST800-AC-3(8)AC-3(8) Access Enforcement | Revocation of Access Authorizations
NIST800-AC-3(9)AC-3(9) Access Enforcement | Controlled Release
NIST800-AC-4AC-4 Information Flow Enforcement
NIST800-AC-4(1)AC-4(1) Information Flow Enforcement | Object Security and Privacy Attributes
NIST800-AC-4(10)AC-4(10) Information Flow Enforcement | Enable and Disable Security or Privacy Policy Filters
NIST800-AC-4(11)AC-4(11) Information Flow Enforcement | Configuration of Security or Privacy Policy Filters
NIST800-AC-4(12)AC-4(12) Information Flow Enforcement | Data Type Identifiers
NIST800-AC-4(13)AC-4(13) Information Flow Enforcement | Decomposition into Policy-relevant Subcomponents
NIST800-AC-4(14)AC-4(14) Information Flow Enforcement | Security or Privacy Policy Filter Constraints
NIST800-AC-4(15)AC-4(15) Information Flow Enforcement | Detection of Unsanctioned Information
NIST800-AC-4(17)AC-4(17) Information Flow Enforcement | Domain Authentication
NIST800-AC-4(19)AC-4(19) Information Flow Enforcement | Validation of Metadata
NIST800-AC-4(2)AC-4(2) Information Flow Enforcement | Processing Domains
NIST800-AC-4(20)AC-4(20) Information Flow Enforcement | Approved Solutions
NIST800-AC-4(21)AC-4(21) Information Flow Enforcement | Physical or Logical Separation of Information Flows
NIST800-AC-4(22)AC-4(22) Information Flow Enforcement | Access Only
NIST800-AC-4(23)AC-4(23) Information Flow Enforcement | Modify Non-releasable Information
NIST800-AC-4(24)AC-4(24) Information Flow Enforcement | Internal Normalized Format
NIST800-AC-4(25)AC-4(25) Information Flow Enforcement | Data Sanitization
NIST800-AC-4(26)AC-4(26) Information Flow Enforcement | Audit Filtering Actions
NIST800-AC-4(27)AC-4(27) Information Flow Enforcement | Redundant/Independent Filtering Mechanisms
NIST800-AC-4(28)AC-4(28) Information Flow Enforcement | Linear Filter Pipelines
NIST800-AC-4(29)AC-4(29) Information Flow Enforcement | Filter Orchestration Engines
NIST800-AC-4(3)AC-4(3) Information Flow Enforcement | Dynamic Information Flow Control
NIST800-AC-4(30)AC-4(30) Information Flow Enforcement | Filter Mechanisms Using Multiple Processes
NIST800-AC-4(31)AC-4(31) Information Flow Enforcement | Failed Content Transfer Prevention
NIST800-AC-4(32)AC-4(32) Information Flow Enforcement | Process Requirements for Information Transfer
NIST800-AC-4(4)AC-4(4) Information Flow Enforcement | Flow Control of Encrypted Information
NIST800-AC-4(5)AC-4(5) Information Flow Enforcement | Embedded Data Types
NIST800-AC-4(6)AC-4(6) Information Flow Enforcement | Metadata
NIST800-AC-4(7)AC-4(7) Information Flow Enforcement | One-way Flow Mechanisms
NIST800-AC-4(8)AC-4(8) Information Flow Enforcement | Security and Privacy Policy Filters
NIST800-AC-4(9)AC-4(9) Information Flow Enforcement | Human Reviews
NIST800-AC-5AC-5 Separation of Duties
NIST800-AC-6AC-6 Least Privilege
NIST800-AC-6(1)AC-6(1) Least Privilege | Authorize Access to Security Functions
NIST800-AC-6(10)AC-6(10) Least Privilege | Prohibit Non-privileged Users from Executing Privileged Functions
NIST800-AC-6(2)AC-6(2) Least Privilege | Non-privileged Access for Nonsecurity Functions
NIST800-AC-6(3)AC-6(3) Least Privilege | Network Access to Privileged Commands
NIST800-AC-6(4)AC-6(4) Least Privilege | Separate Processing Domains
NIST800-AC-6(5)AC-6(5) Least Privilege | Privileged Accounts
NIST800-AC-6(6)AC-6(6) Least Privilege | Privileged Access by Non-organizational Users
NIST800-AC-6(7)AC-6(7) Least Privilege | Review of User Privileges
NIST800-AC-6(8)AC-6(8) Least Privilege | Privilege Levels for Code Execution
NIST800-AC-6(9)AC-6(9) Least Privilege | Log Use of Privileged Functions
NIST800-AC-7AC-7 Unsuccessful Logon Attempts
NIST800-AC-7(2)AC-7(2) Unsuccessful Logon Attempts | Purge or Wipe Mobile Device
NIST800-AC-7(3)AC-7(3) Unsuccessful Logon Attempts | Biometric Attempt Limiting
NIST800-AC-7(4)AC-7(4) Unsuccessful Logon Attempts | Use of Alternate Authentication Factor
NIST800-AC-8AC-8 System Use Notification
NIST800-AC-9AC-9 Previous Logon Notification
NIST800-AC-9(1)AC-9(1) Previous Logon Notification | Unsuccessful Logons
NIST800-AC-9(2)AC-9(2) Previous Logon Notification | Successful and Unsuccessful Logons
NIST800-AC-9(3)AC-9(3) Previous Logon Notification | Notification of Account Changes
NIST800-AC-9(4)AC-9(4) Previous Logon Notification | Additional Logon Information

AT - Awareness and Training

15 controls

Security awareness and training programs

Controls in the AT - Awareness and Training domain of NIST SP 800-53 Rev 5: 15 controls
CodeTitle
NIST800-AT-1AT-1 Policy and Procedures
NIST800-AT-2AT-2 Literacy Training and Awareness
NIST800-AT-2(1)AT-2(1) Literacy Training and Awareness | Practical Exercises
NIST800-AT-2(2)AT-2(2) Literacy Training and Awareness | Insider Threat
NIST800-AT-2(3)AT-2(3) Literacy Training and Awareness | Social Engineering and Mining
NIST800-AT-2(4)AT-2(4) Literacy Training and Awareness | Suspicious Communications and Anomalous System Behavior
NIST800-AT-2(5)AT-2(5) Literacy Training and Awareness | Advanced Persistent Threat
NIST800-AT-2(6)AT-2(6) Literacy Training and Awareness | Cyber Threat Environment
NIST800-AT-3AT-3 Role-based Training
NIST800-AT-3(1)AT-3(1) Role-based Training | Environmental Controls
NIST800-AT-3(2)AT-3(2) Role-based Training | Physical Security Controls
NIST800-AT-3(3)AT-3(3) Role-based Training | Practical Exercises
NIST800-AT-3(5)AT-3(5) Role-based Training | Processing Personally Identifiable Information
NIST800-AT-4AT-4 Training Records
NIST800-AT-6AT-6 Training Feedback

AU - Audit and Accountability

56 controls

Audit and accountability controls

Controls in the AU - Audit and Accountability domain of NIST SP 800-53 Rev 5: 56 controls
CodeTitle
NIST800-AU-1AU-1 Policy and Procedures
NIST800-AU-10AU-10 Non-repudiation
NIST800-AU-10(1)AU-10(1) Non-repudiation | Association of Identities
NIST800-AU-10(2)AU-10(2) Non-repudiation | Validate Binding of Information Producer Identity
NIST800-AU-10(3)AU-10(3) Non-repudiation | Chain of Custody
NIST800-AU-10(4)AU-10(4) Non-repudiation | Validate Binding of Information Reviewer Identity
NIST800-AU-11AU-11 Audit Record Retention
NIST800-AU-11(1)AU-11(1) Audit Record Retention | Long-term Retrieval Capability
NIST800-AU-12AU-12 Audit Record Generation
NIST800-AU-12(1)AU-12(1) Audit Record Generation | System-wide and Time-correlated Audit Trail
NIST800-AU-12(2)AU-12(2) Audit Record Generation | Standardized Formats
NIST800-AU-12(3)AU-12(3) Audit Record Generation | Changes by Authorized Individuals
NIST800-AU-12(4)AU-12(4) Audit Record Generation | Query Parameter Audits of Personally Identifiable Information
NIST800-AU-13AU-13 Monitoring for Information Disclosure
NIST800-AU-13(1)AU-13(1) Monitoring for Information Disclosure | Use of Automated Tools
NIST800-AU-13(2)AU-13(2) Monitoring for Information Disclosure | Review of Monitored Sites
NIST800-AU-13(3)AU-13(3) Monitoring for Information Disclosure | Unauthorized Replication of Information
NIST800-AU-14AU-14 Session Audit
NIST800-AU-14(1)AU-14(1) Session Audit | System Start-up
NIST800-AU-14(3)AU-14(3) Session Audit | Remote Viewing and Listening
NIST800-AU-16AU-16 Cross-organizational Audit Logging
NIST800-AU-16(1)AU-16(1) Cross-organizational Audit Logging | Identity Preservation
NIST800-AU-16(2)AU-16(2) Cross-organizational Audit Logging | Sharing of Audit Information
NIST800-AU-16(3)AU-16(3) Cross-organizational Audit Logging | Disassociability
NIST800-AU-2AU-2 Event Logging
NIST800-AU-3AU-3 Content of Audit Records
NIST800-AU-3(1)AU-3(1) Content of Audit Records | Additional Audit Information
NIST800-AU-3(3)AU-3(3) Content of Audit Records | Limit Personally Identifiable Information Elements
NIST800-AU-4AU-4 Audit Log Storage Capacity
NIST800-AU-4(1)AU-4(1) Audit Log Storage Capacity | Transfer to Alternate Storage
NIST800-AU-5AU-5 Response to Audit Logging Process Failures
NIST800-AU-5(1)AU-5(1) Response to Audit Logging Process Failures | Storage Capacity Warning
NIST800-AU-5(2)AU-5(2) Response to Audit Logging Process Failures | Real-time Alerts
NIST800-AU-5(3)AU-5(3) Response to Audit Logging Process Failures | Configurable Traffic Volume Thresholds
NIST800-AU-5(4)AU-5(4) Response to Audit Logging Process Failures | Shutdown on Failure
NIST800-AU-5(5)AU-5(5) Response to Audit Logging Process Failures | Alternate Audit Logging Capability
NIST800-AU-6AU-6 Audit Record Review, Analysis, and Reporting
NIST800-AU-6(1)AU-6(1) Audit Record Review, Analysis, and Reporting | Automated Process Integration
NIST800-AU-6(3)AU-6(3) Audit Record Review, Analysis, and Reporting | Correlate Audit Record Repositories
NIST800-AU-6(4)AU-6(4) Audit Record Review, Analysis, and Reporting | Central Review and Analysis
NIST800-AU-6(5)AU-6(5) Audit Record Review, Analysis, and Reporting | Integrated Analysis of Audit Records
NIST800-AU-6(6)AU-6(6) Audit Record Review, Analysis, and Reporting | Correlation with Physical Monitoring
NIST800-AU-6(7)AU-6(7) Audit Record Review, Analysis, and Reporting | Permitted Actions
NIST800-AU-6(8)AU-6(8) Audit Record Review, Analysis, and Reporting | Full Text Analysis of Privileged Commands
NIST800-AU-6(9)AU-6(9) Audit Record Review, Analysis, and Reporting | Correlation with Information from Nontechnical Sources
NIST800-AU-7AU-7 Audit Record Reduction and Report Generation
NIST800-AU-7(1)AU-7(1) Audit Record Reduction and Report Generation | Automatic Processing
NIST800-AU-8AU-8 Time Stamps
NIST800-AU-9AU-9 Protection of Audit Information
NIST800-AU-9(1)AU-9(1) Protection of Audit Information | Hardware Write-once Media
NIST800-AU-9(2)AU-9(2) Protection of Audit Information | Store on Separate Physical Systems or Components
NIST800-AU-9(3)AU-9(3) Protection of Audit Information | Cryptographic Protection
NIST800-AU-9(4)AU-9(4) Protection of Audit Information | Access by Subset of Privileged Users
NIST800-AU-9(5)AU-9(5) Protection of Audit Information | Dual Authorization
NIST800-AU-9(6)AU-9(6) Protection of Audit Information | Read-only Access
NIST800-AU-9(7)AU-9(7) Protection of Audit Information | Store on Component with Different Operating System

CA - Assessment, Authorization, and Monitoring

25 controls

Security assessment, authorization, and monitoring

Controls in the CA - Assessment, Authorization, and Monitoring domain of NIST SP 800-53 Rev 5: 25 controls
CodeTitle
NIST800-CA-1CA-1 Policy and Procedures
NIST800-CA-2CA-2 Control Assessments
NIST800-CA-2(1)CA-2(1) Control Assessments | Independent Assessors
NIST800-CA-2(2)CA-2(2) Control Assessments | Specialized Assessments
NIST800-CA-2(3)CA-2(3) Control Assessments | Leveraging Results from External Organizations
NIST800-CA-3CA-3 Information Exchange
NIST800-CA-3(6)CA-3(6) Information Exchange | Transfer Authorizations
NIST800-CA-3(7)CA-3(7) Information Exchange | Transitive Information Exchanges
NIST800-CA-5CA-5 Plan of Action and Milestones
NIST800-CA-5(1)CA-5(1) Plan of Action and Milestones | Automation Support for Accuracy and Currency
NIST800-CA-6CA-6 Authorization
NIST800-CA-6(1)CA-6(1) Authorization | Joint Authorization: Intra-organization
NIST800-CA-6(2)CA-6(2) Authorization | Joint Authorization: Inter-organization
NIST800-CA-7CA-7 Continuous Monitoring
NIST800-CA-7(1)CA-7(1) Continuous Monitoring | Independent Assessment
NIST800-CA-7(3)CA-7(3) Continuous Monitoring | Trend Analyses
NIST800-CA-7(4)CA-7(4) Continuous Monitoring | Risk Monitoring
NIST800-CA-7(5)CA-7(5) Continuous Monitoring | Consistency Analysis
NIST800-CA-7(6)CA-7(6) Continuous Monitoring | Automation Support for Monitoring
NIST800-CA-8CA-8 Penetration Testing
NIST800-CA-8(1)CA-8(1) Penetration Testing | Independent Penetration Testing Agent or Team
NIST800-CA-8(2)CA-8(2) Penetration Testing | Red Team Exercises
NIST800-CA-8(3)CA-8(3) Penetration Testing | Facility Penetration Testing
NIST800-CA-9CA-9 Internal System Connections
NIST800-CA-9(1)CA-9(1) Internal System Connections | Compliance Checks

CM - Configuration Management

56 controls

Configuration management controls

Controls in the CM - Configuration Management domain of NIST SP 800-53 Rev 5: 56 controls
CodeTitle
NIST800-CM-1CM-1 Policy and Procedures
NIST800-CM-10CM-10 Software Usage Restrictions
NIST800-CM-10(1)CM-10(1) Software Usage Restrictions | Open-source Software
NIST800-CM-11CM-11 User-installed Software
NIST800-CM-11(2)CM-11(2) User-installed Software | Software Installation with Privileged Status
NIST800-CM-11(3)CM-11(3) User-installed Software | Automated Enforcement and Monitoring
NIST800-CM-12CM-12 Information Location
NIST800-CM-12(1)CM-12(1) Information Location | Automated Tools to Support Information Location
NIST800-CM-13CM-13 Data Action Mapping
NIST800-CM-14CM-14 Signed Components
NIST800-CM-2CM-2 Baseline Configuration
NIST800-CM-2(2)CM-2(2) Baseline Configuration | Automation Support for Accuracy and Currency
NIST800-CM-2(3)CM-2(3) Baseline Configuration | Retention of Previous Configurations
NIST800-CM-2(6)CM-2(6) Baseline Configuration | Development and Test Environments
NIST800-CM-2(7)CM-2(7) Baseline Configuration | Configure Systems and Components for High-risk Areas
NIST800-CM-3CM-3 Configuration Change Control
NIST800-CM-3(1)CM-3(1) Configuration Change Control | Automated Documentation, Notification, and Prohibition of Changes
NIST800-CM-3(2)CM-3(2) Configuration Change Control | Testing, Validation, and Documentation of Changes
NIST800-CM-3(3)CM-3(3) Configuration Change Control | Automated Change Implementation
NIST800-CM-3(4)CM-3(4) Configuration Change Control | Security and Privacy Representatives
NIST800-CM-3(5)CM-3(5) Configuration Change Control | Automated Security Response
NIST800-CM-3(6)CM-3(6) Configuration Change Control | Cryptography Management
NIST800-CM-3(7)CM-3(7) Configuration Change Control | Review System Changes
NIST800-CM-3(8)CM-3(8) Configuration Change Control | Prevent or Restrict Configuration Changes
NIST800-CM-4CM-4 Impact Analyses
NIST800-CM-4(1)CM-4(1) Impact Analyses | Separate Test Environments
NIST800-CM-4(2)CM-4(2) Impact Analyses | Verification of Controls
NIST800-CM-5CM-5 Access Restrictions for Change
NIST800-CM-5(1)CM-5(1) Access Restrictions for Change | Automated Access Enforcement and Audit Records
NIST800-CM-5(4)CM-5(4) Access Restrictions for Change | Dual Authorization
NIST800-CM-5(5)CM-5(5) Access Restrictions for Change | Privilege Limitation for Production and Operation
NIST800-CM-5(6)CM-5(6) Access Restrictions for Change | Limit Library Privileges
NIST800-CM-6CM-6 Configuration Settings
NIST800-CM-6(1)CM-6(1) Configuration Settings | Automated Management, Application, and Verification
NIST800-CM-6(2)CM-6(2) Configuration Settings | Respond to Unauthorized Changes
NIST800-CM-7CM-7 Least Functionality
NIST800-CM-7(1)CM-7(1) Least Functionality | Periodic Review
NIST800-CM-7(2)CM-7(2) Least Functionality | Prevent Program Execution
NIST800-CM-7(3)CM-7(3) Least Functionality | Registration Compliance
NIST800-CM-7(4)CM-7(4) Least Functionality | Unauthorized Software: Deny-by-exception
NIST800-CM-7(5)CM-7(5) Least Functionality | Authorized Software: Allow-by-exception
NIST800-CM-7(6)CM-7(6) Least Functionality | Confined Environments with Limited Privileges
NIST800-CM-7(7)CM-7(7) Least Functionality | Code Execution in Protected Environments
NIST800-CM-7(8)CM-7(8) Least Functionality | Binary or Machine Executable Code
NIST800-CM-7(9)CM-7(9) Least Functionality | Prohibiting The Use of Unauthorized Hardware
NIST800-CM-8CM-8 System Component Inventory
NIST800-CM-8(1)CM-8(1) System Component Inventory | Updates During Installation and Removal
NIST800-CM-8(2)CM-8(2) System Component Inventory | Automated Maintenance
NIST800-CM-8(3)CM-8(3) System Component Inventory | Automated Unauthorized Component Detection
NIST800-CM-8(4)CM-8(4) System Component Inventory | Accountability Information
NIST800-CM-8(6)CM-8(6) System Component Inventory | Assessed Configurations and Approved Deviations
NIST800-CM-8(7)CM-8(7) System Component Inventory | Centralized Repository
NIST800-CM-8(8)CM-8(8) System Component Inventory | Automated Location Tracking
NIST800-CM-8(9)CM-8(9) System Component Inventory | Assignment of Components to Systems
NIST800-CM-9CM-9 Configuration Management Plan
NIST800-CM-9(1)CM-9(1) Configuration Management Plan | Assignment of Responsibility

CP - Contingency Planning

49 controls

Contingency planning controls

Controls in the CP - Contingency Planning domain of NIST SP 800-53 Rev 5: 49 controls
CodeTitle
NIST800-CP-1CP-1 Policy and Procedures
NIST800-CP-10CP-10 System Recovery and Reconstitution
NIST800-CP-10(2)CP-10(2) System Recovery and Reconstitution | Transaction Recovery
NIST800-CP-10(4)CP-10(4) System Recovery and Reconstitution | Restore Within Time Period
NIST800-CP-10(6)CP-10(6) System Recovery and Reconstitution | Component Protection
NIST800-CP-11CP-11 Alternate Communications Protocols
NIST800-CP-12CP-12 Safe Mode
NIST800-CP-13CP-13 Alternative Security Mechanisms
NIST800-CP-2CP-2 Contingency Plan
NIST800-CP-2(1)CP-2(1) Contingency Plan | Coordinate with Related Plans
NIST800-CP-2(2)CP-2(2) Contingency Plan | Capacity Planning
NIST800-CP-2(3)CP-2(3) Contingency Plan | Resume Mission and Business Functions
NIST800-CP-2(5)CP-2(5) Contingency Plan | Continue Mission and Business Functions
NIST800-CP-2(6)CP-2(6) Contingency Plan | Alternate Processing and Storage Sites
NIST800-CP-2(7)CP-2(7) Contingency Plan | Coordinate with External Service Providers
NIST800-CP-2(8)CP-2(8) Contingency Plan | Identify Critical Assets
NIST800-CP-3CP-3 Contingency Training
NIST800-CP-3(1)CP-3(1) Contingency Training | Simulated Events
NIST800-CP-3(2)CP-3(2) Contingency Training | Mechanisms Used in Training Environments
NIST800-CP-4CP-4 Contingency Plan Testing
NIST800-CP-4(1)CP-4(1) Contingency Plan Testing | Coordinate with Related Plans
NIST800-CP-4(2)CP-4(2) Contingency Plan Testing | Alternate Processing Site
NIST800-CP-4(3)CP-4(3) Contingency Plan Testing | Automated Testing
NIST800-CP-4(4)CP-4(4) Contingency Plan Testing | Full Recovery and Reconstitution
NIST800-CP-4(5)CP-4(5) Contingency Plan Testing | Self-challenge
NIST800-CP-6CP-6 Alternate Storage Site
NIST800-CP-6(1)CP-6(1) Alternate Storage Site | Separation from Primary Site
NIST800-CP-6(2)CP-6(2) Alternate Storage Site | Recovery Time and Recovery Point Objectives
NIST800-CP-6(3)CP-6(3) Alternate Storage Site | Accessibility
NIST800-CP-7CP-7 Alternate Processing Site
NIST800-CP-7(1)CP-7(1) Alternate Processing Site | Separation from Primary Site
NIST800-CP-7(2)CP-7(2) Alternate Processing Site | Accessibility
NIST800-CP-7(3)CP-7(3) Alternate Processing Site | Priority of Service
NIST800-CP-7(4)CP-7(4) Alternate Processing Site | Preparation for Use
NIST800-CP-7(6)CP-7(6) Alternate Processing Site | Inability to Return to Primary Site
NIST800-CP-8CP-8 Telecommunications Services
NIST800-CP-8(1)CP-8(1) Telecommunications Services | Priority of Service Provisions
NIST800-CP-8(2)CP-8(2) Telecommunications Services | Single Points of Failure
NIST800-CP-8(3)CP-8(3) Telecommunications Services | Separation of Primary and Alternate Providers
NIST800-CP-8(4)CP-8(4) Telecommunications Services | Provider Contingency Plan
NIST800-CP-8(5)CP-8(5) Telecommunications Services | Alternate Telecommunication Service Testing
NIST800-CP-9CP-9 System Backup
NIST800-CP-9(1)CP-9(1) System Backup | Testing for Reliability and Integrity
NIST800-CP-9(2)CP-9(2) System Backup | Test Restoration Using Sampling
NIST800-CP-9(3)CP-9(3) System Backup | Separate Storage for Critical Information
NIST800-CP-9(5)CP-9(5) System Backup | Transfer to Alternate Storage Site
NIST800-CP-9(6)CP-9(6) System Backup | Redundant Secondary System
NIST800-CP-9(7)CP-9(7) System Backup | Dual Authorization for Deletion or Destruction
NIST800-CP-9(8)CP-9(8) System Backup | Cryptographic Protection

IA - Identification and Authentication

59 controls

Identification and authentication controls

Controls in the IA - Identification and Authentication domain of NIST SP 800-53 Rev 5: 59 controls
CodeTitle
NIST800-IA-1IA-1 Policy and Procedures
NIST800-IA-10IA-10 Adaptive Authentication
NIST800-IA-11IA-11 Re-authentication
NIST800-IA-12IA-12 Identity Proofing
NIST800-IA-12(1)IA-12(1) Identity Proofing | Supervisor Authorization
NIST800-IA-12(2)IA-12(2) Identity Proofing | Identity Evidence
NIST800-IA-12(3)IA-12(3) Identity Proofing | Identity Evidence Validation and Verification
NIST800-IA-12(4)IA-12(4) Identity Proofing | In-person Validation and Verification
NIST800-IA-12(5)IA-12(5) Identity Proofing | Address Confirmation
NIST800-IA-12(6)IA-12(6) Identity Proofing | Accept Externally-proofed Identities
NIST800-IA-13IA-13 Identity Providers and Authorization Servers
NIST800-IA-13(1)IA-13(1) Identity Providers and Authorization Servers | Protection of Cryptographic Keys
NIST800-IA-13(2)IA-13(2) Identity Providers and Authorization Servers | Verification of Identity Assertions and Access Tokens
NIST800-IA-13(3)IA-13(3) Identity Providers and Authorization Servers | Token Management
NIST800-IA-2IA-2 Identification and Authentication (Organizational Users)
NIST800-IA-2(1)IA-2(1) Identification and Authentication (Organizational Users) | Multi-factor Authentication to Privileged Accounts
NIST800-IA-2(10)IA-2(10) Identification and Authentication (Organizational Users) | Single Sign-on
NIST800-IA-2(12)IA-2(12) Identification and Authentication (Organizational Users) | Acceptance of PIV Credentials
NIST800-IA-2(13)IA-2(13) Identification and Authentication (Organizational Users) | Out-of-band Authentication
NIST800-IA-2(2)IA-2(2) Identification and Authentication (Organizational Users) | Multi-factor Authentication to Non-privileged Accounts
NIST800-IA-2(5)IA-2(5) Identification and Authentication (Organizational Users) | Individual Authentication with Group Authentication
NIST800-IA-2(6)IA-2(6) Identification and Authentication (Organizational Users) | Access to Accounts: separate Device
NIST800-IA-2(8)IA-2(8) Identification and Authentication (Organizational Users) | Access to Accounts: Replay Resistant
NIST800-IA-3IA-3 Device Identification and Authentication
NIST800-IA-3(1)IA-3(1) Device Identification and Authentication | Cryptographic Bidirectional Authentication
NIST800-IA-3(3)IA-3(3) Device Identification and Authentication | Dynamic Address Allocation
NIST800-IA-3(4)IA-3(4) Device Identification and Authentication | Device Attestation
NIST800-IA-4IA-4 Identifier Management
NIST800-IA-4(1)IA-4(1) Identifier Management | Prohibit Account Identifiers as Public Identifiers
NIST800-IA-4(4)IA-4(4) Identifier Management | Identify User Status
NIST800-IA-4(5)IA-4(5) Identifier Management | Dynamic Management
NIST800-IA-4(6)IA-4(6) Identifier Management | Cross-organization Management
NIST800-IA-4(8)IA-4(8) Identifier Management | Pairwise Pseudonymous Identifiers
NIST800-IA-4(9)IA-4(9) Identifier Management | Attribute Maintenance and Protection
NIST800-IA-5IA-5 Authenticator Management
NIST800-IA-5(1)IA-5(1) Authenticator Management | Password-based Authentication
NIST800-IA-5(10)IA-5(10) Authenticator Management | Dynamic Credential Binding
NIST800-IA-5(12)IA-5(12) Authenticator Management | Biometric Authentication Performance
NIST800-IA-5(13)IA-5(13) Authenticator Management | Expiration of Cached Authenticators
NIST800-IA-5(14)IA-5(14) Authenticator Management | Managing Content of PKI Trust Stores
NIST800-IA-5(15)IA-5(15) Authenticator Management | GSA-approved Products and Services
NIST800-IA-5(16)IA-5(16) Authenticator Management | In-person or Trusted External Party Authenticator Issuance
NIST800-IA-5(17)IA-5(17) Authenticator Management | Presentation Attack Detection for Biometric Authenticators
NIST800-IA-5(18)IA-5(18) Authenticator Management | Password Managers
NIST800-IA-5(2)IA-5(2) Authenticator Management | Public Key-based Authentication
NIST800-IA-5(5)IA-5(5) Authenticator Management | Change Authenticators Prior to Delivery
NIST800-IA-5(6)IA-5(6) Authenticator Management | Protection of Authenticators
NIST800-IA-5(7)IA-5(7) Authenticator Management | No Embedded Unencrypted Static Authenticators
NIST800-IA-5(8)IA-5(8) Authenticator Management | Multiple System Accounts
NIST800-IA-5(9)IA-5(9) Authenticator Management | Federated Credential Management
NIST800-IA-6IA-6 Authentication Feedback
NIST800-IA-7IA-7 Cryptographic Module Authentication
NIST800-IA-8IA-8 Identification and Authentication (Non-organizational Users)
NIST800-IA-8(1)IA-8(1) Identification and Authentication (Non-organizational Users) | Acceptance of PIV Credentials from Other Agencies
NIST800-IA-8(2)IA-8(2) Identification and Authentication (Non-organizational Users) | Acceptance of External Authenticators
NIST800-IA-8(4)IA-8(4) Identification and Authentication (Non-organizational Users) | Use of Defined Profiles
NIST800-IA-8(5)IA-8(5) Identification and Authentication (Non-organizational Users) | Acceptance of PIV-I Credentials
NIST800-IA-8(6)IA-8(6) Identification and Authentication (Non-organizational Users) | Disassociability
NIST800-IA-9IA-9 Service Identification and Authentication

IR - Incident Response

40 controls

Incident response controls

Controls in the IR - Incident Response domain of NIST SP 800-53 Rev 5: 40 controls
CodeTitle
NIST800-IR-1IR-1 Policy and Procedures
NIST800-IR-2IR-2 Incident Response Training
NIST800-IR-2(1)IR-2(1) Incident Response Training | Simulated Events
NIST800-IR-2(2)IR-2(2) Incident Response Training | Automated Training Environments
NIST800-IR-2(3)IR-2(3) Incident Response Training | Breach
NIST800-IR-3IR-3 Incident Response Testing
NIST800-IR-3(1)IR-3(1) Incident Response Testing | Automated Testing
NIST800-IR-3(2)IR-3(2) Incident Response Testing | Coordination with Related Plans
NIST800-IR-3(3)IR-3(3) Incident Response Testing | Continuous Improvement
NIST800-IR-4IR-4 Incident Handling
NIST800-IR-4(1)IR-4(1) Incident Handling | Automated Incident Handling Processes
NIST800-IR-4(10)IR-4(10) Incident Handling | Supply Chain Coordination
NIST800-IR-4(11)IR-4(11) Incident Handling | Integrated Incident Response Team
NIST800-IR-4(12)IR-4(12) Incident Handling | Malicious Code and Forensic Analysis
NIST800-IR-4(13)IR-4(13) Incident Handling | Behavior Analysis
NIST800-IR-4(14)IR-4(14) Incident Handling | Security Operations Center
NIST800-IR-4(15)IR-4(15) Incident Handling | Public Relations and Reputation Repair
NIST800-IR-4(2)IR-4(2) Incident Handling | Dynamic Reconfiguration
NIST800-IR-4(3)IR-4(3) Incident Handling | Continuity of Operations
NIST800-IR-4(4)IR-4(4) Incident Handling | Information Correlation
NIST800-IR-4(5)IR-4(5) Incident Handling | Automatic Disabling of System
NIST800-IR-4(6)IR-4(6) Incident Handling | Insider Threats
NIST800-IR-4(7)IR-4(7) Incident Handling | Insider Threats: Intra-organization Coordination
NIST800-IR-4(8)IR-4(8) Incident Handling | Correlation with External Organizations
NIST800-IR-4(9)IR-4(9) Incident Handling | Dynamic Response Capability
NIST800-IR-5IR-5 Incident Monitoring
NIST800-IR-5(1)IR-5(1) Incident Monitoring | Automated Tracking, Data Collection, and Analysis
NIST800-IR-6IR-6 Incident Reporting
NIST800-IR-6(1)IR-6(1) Incident Reporting | Automated Reporting
NIST800-IR-6(2)IR-6(2) Incident Reporting | Vulnerabilities Related to Incidents
NIST800-IR-6(3)IR-6(3) Incident Reporting | Supply Chain Coordination
NIST800-IR-7IR-7 Incident Response Assistance
NIST800-IR-7(1)IR-7(1) Incident Response Assistance | Automation Support for Availability of Information and Support
NIST800-IR-7(2)IR-7(2) Incident Response Assistance | Coordination with External Providers
NIST800-IR-8IR-8 Incident Response Plan
NIST800-IR-8(1)IR-8(1) Incident Response Plan | Breaches
NIST800-IR-9IR-9 Information Spillage Response
NIST800-IR-9(2)IR-9(2) Information Spillage Response | Training
NIST800-IR-9(3)IR-9(3) Information Spillage Response | Post-spill Operations
NIST800-IR-9(4)IR-9(4) Information Spillage Response | Exposure to Unauthorized Personnel

MA - Maintenance

28 controls

System maintenance controls

Controls in the MA - Maintenance domain of NIST SP 800-53 Rev 5: 28 controls
CodeTitle
NIST800-MA-1MA-1 Policy and Procedures
NIST800-MA-2MA-2 Controlled Maintenance
NIST800-MA-2(2)MA-2(2) Controlled Maintenance | Automated Maintenance Activities
NIST800-MA-3MA-3 Maintenance Tools
NIST800-MA-3(1)MA-3(1) Maintenance Tools | Inspect Tools
NIST800-MA-3(2)MA-3(2) Maintenance Tools | Inspect Media
NIST800-MA-3(3)MA-3(3) Maintenance Tools | Prevent Unauthorized Removal
NIST800-MA-3(4)MA-3(4) Maintenance Tools | Restricted Tool Use
NIST800-MA-3(5)MA-3(5) Maintenance Tools | Execution with Privilege
NIST800-MA-3(6)MA-3(6) Maintenance Tools | Software Updates and Patches
NIST800-MA-4MA-4 Nonlocal Maintenance
NIST800-MA-4(1)MA-4(1) Nonlocal Maintenance | Logging and Review
NIST800-MA-4(3)MA-4(3) Nonlocal Maintenance | Comparable Security and Sanitization
NIST800-MA-4(4)MA-4(4) Nonlocal Maintenance | Authentication and Separation of Maintenance Sessions
NIST800-MA-4(5)MA-4(5) Nonlocal Maintenance | Approvals and Notifications
NIST800-MA-4(6)MA-4(6) Nonlocal Maintenance | Cryptographic Protection
NIST800-MA-4(7)MA-4(7) Nonlocal Maintenance | Disconnect Verification
NIST800-MA-5MA-5 Maintenance Personnel
NIST800-MA-5(1)MA-5(1) Maintenance Personnel | Individuals Without Appropriate Access
NIST800-MA-5(2)MA-5(2) Maintenance Personnel | Security Clearances for Classified Systems
NIST800-MA-5(3)MA-5(3) Maintenance Personnel | Citizenship Requirements for Classified Systems
NIST800-MA-5(4)MA-5(4) Maintenance Personnel | Foreign Nationals
NIST800-MA-5(5)MA-5(5) Maintenance Personnel | Non-system Maintenance
NIST800-MA-6MA-6 Timely Maintenance
NIST800-MA-6(1)MA-6(1) Timely Maintenance | Preventive Maintenance
NIST800-MA-6(2)MA-6(2) Timely Maintenance | Predictive Maintenance
NIST800-MA-6(3)MA-6(3) Timely Maintenance | Automated Support for Predictive Maintenance
NIST800-MA-7MA-7 Field Maintenance

MP - Media Protection

20 controls

Media protection controls

Controls in the MP - Media Protection domain of NIST SP 800-53 Rev 5: 20 controls
CodeTitle
NIST800-MP-1MP-1 Policy and Procedures
NIST800-MP-2MP-2 Media Access
NIST800-MP-3MP-3 Media Marking
NIST800-MP-4MP-4 Media Storage
NIST800-MP-4(2)MP-4(2) Media Storage | Automated Restricted Access
NIST800-MP-5MP-5 Media Transport
NIST800-MP-5(3)MP-5(3) Media Transport | Custodians
NIST800-MP-6MP-6 Media Sanitization
NIST800-MP-6(1)MP-6(1) Media Sanitization | Review, Approve, Track, Document, and Verify
NIST800-MP-6(2)MP-6(2) Media Sanitization | Equipment Testing
NIST800-MP-6(3)MP-6(3) Media Sanitization | Nondestructive Techniques
NIST800-MP-6(7)MP-6(7) Media Sanitization | Dual Authorization
NIST800-MP-6(8)MP-6(8) Media Sanitization | Remote Purging or Wiping of Information
NIST800-MP-7MP-7 Media Use
NIST800-MP-7(2)MP-7(2) Media Use | Prohibit Use of Sanitization-resistant Media
NIST800-MP-8MP-8 Media Downgrading
NIST800-MP-8(1)MP-8(1) Media Downgrading | Documentation of Process
NIST800-MP-8(2)MP-8(2) Media Downgrading | Equipment Testing
NIST800-MP-8(3)MP-8(3) Media Downgrading | Controlled Unclassified Information
NIST800-MP-8(4)MP-8(4) Media Downgrading | Classified Information

PE - Physical and Environmental Protection

51 controls

Physical and environmental protection controls

Controls in the PE - Physical and Environmental Protection domain of NIST SP 800-53 Rev 5: 51 controls
CodeTitle
NIST800-PE-1PE-1 Policy and Procedures
NIST800-PE-10PE-10 Emergency Shutoff
NIST800-PE-11PE-11 Emergency Power
NIST800-PE-11(1)PE-11(1) Emergency Power | Alternate Power Supply: Minimal Operational Capability
NIST800-PE-11(2)PE-11(2) Emergency Power | Alternate Power Supply: Self-contained
NIST800-PE-12PE-12 Emergency Lighting
NIST800-PE-12(1)PE-12(1) Emergency Lighting | Essential Mission and Business Functions
NIST800-PE-13PE-13 Fire Protection
NIST800-PE-13(1)PE-13(1) Fire Protection | Detection Systems: Automatic Activation and Notification
NIST800-PE-13(2)PE-13(2) Fire Protection | Suppression Systems: Automatic Activation and Notification
NIST800-PE-13(4)PE-13(4) Fire Protection | Inspections
NIST800-PE-14PE-14 Environmental Controls
NIST800-PE-14(1)PE-14(1) Environmental Controls | Automatic Controls
NIST800-PE-14(2)PE-14(2) Environmental Controls | Monitoring with Alarms and Notifications
NIST800-PE-15PE-15 Water Damage Protection
NIST800-PE-15(1)PE-15(1) Water Damage Protection | Automation Support
NIST800-PE-16PE-16 Delivery and Removal
NIST800-PE-17PE-17 Alternate Work Site
NIST800-PE-18PE-18 Location of System Components
NIST800-PE-19PE-19 Information Leakage
NIST800-PE-19(1)PE-19(1) Information Leakage | National Emissions Policies and Procedures
NIST800-PE-2PE-2 Physical Access Authorizations
NIST800-PE-2(1)PE-2(1) Physical Access Authorizations | Access by Position or Role
NIST800-PE-2(2)PE-2(2) Physical Access Authorizations | Two Forms of Identification
NIST800-PE-2(3)PE-2(3) Physical Access Authorizations | Restrict Unescorted Access
NIST800-PE-20PE-20 Asset Monitoring and Tracking
NIST800-PE-21PE-21 Electromagnetic Pulse Protection
NIST800-PE-22PE-22 Component Marking
NIST800-PE-23PE-23 Facility Location
NIST800-PE-3PE-3 Physical Access Control
NIST800-PE-3(1)PE-3(1) Physical Access Control | System Access
NIST800-PE-3(2)PE-3(2) Physical Access Control | Facility and Systems
NIST800-PE-3(3)PE-3(3) Physical Access Control | Continuous Guards
NIST800-PE-3(4)PE-3(4) Physical Access Control | Lockable Casings
NIST800-PE-3(5)PE-3(5) Physical Access Control | Tamper Protection
NIST800-PE-3(7)PE-3(7) Physical Access Control | Physical Barriers
NIST800-PE-3(8)PE-3(8) Physical Access Control | Access Control Vestibules
NIST800-PE-4PE-4 Access Control for Transmission
NIST800-PE-5PE-5 Access Control for Output Devices
NIST800-PE-5(2)PE-5(2) Access Control for Output Devices | Link to Individual Identity
NIST800-PE-6PE-6 Monitoring Physical Access
NIST800-PE-6(1)PE-6(1) Monitoring Physical Access | Intrusion Alarms and Surveillance Equipment
NIST800-PE-6(2)PE-6(2) Monitoring Physical Access | Automated Intrusion Recognition and Responses
NIST800-PE-6(3)PE-6(3) Monitoring Physical Access | Video Surveillance
NIST800-PE-6(4)PE-6(4) Monitoring Physical Access | Monitoring Physical Access to Systems
NIST800-PE-8PE-8 Visitor Access Records
NIST800-PE-8(1)PE-8(1) Visitor Access Records | Automated Records Maintenance and Review
NIST800-PE-8(3)PE-8(3) Visitor Access Records | Limit Personally Identifiable Information Elements
NIST800-PE-9PE-9 Power Equipment and Cabling
NIST800-PE-9(1)PE-9(1) Power Equipment and Cabling | Redundant Cabling
NIST800-PE-9(2)PE-9(2) Power Equipment and Cabling | Automatic Voltage Controls

PL - Planning

11 controls

Security planning controls

Controls in the PL - Planning domain of NIST SP 800-53 Rev 5: 11 controls
CodeTitle
NIST800-PL-1PL-1 Policy and Procedures
NIST800-PL-10PL-10 Baseline Selection
NIST800-PL-11PL-11 Baseline Tailoring
NIST800-PL-2PL-2 System Security and Privacy Plans
NIST800-PL-4PL-4 Rules of Behavior
NIST800-PL-4(1)PL-4(1) Rules of Behavior | Social Media and External Site/Application Usage Restrictions
NIST800-PL-7PL-7 Concept of Operations
NIST800-PL-8PL-8 Security and Privacy Architectures
NIST800-PL-8(1)PL-8(1) Security and Privacy Architectures | Defense in Depth
NIST800-PL-8(2)PL-8(2) Security and Privacy Architectures | Supplier Diversity
NIST800-PL-9PL-9 Central Management

PM - Program Management

37 controls
Controls in the PM - Program Management domain of NIST SP 800-53 Rev 5: 37 controls
CodeTitle
NIST800-PM-1PM-1 Information Security Program Plan
NIST800-PM-10PM-10 Authorization Process
NIST800-PM-11PM-11 Mission and Business Process Definition
NIST800-PM-12PM-12 Insider Threat Program
NIST800-PM-13PM-13 Security and Privacy Workforce
NIST800-PM-14PM-14 Testing, Training, and Monitoring
NIST800-PM-15PM-15 Security and Privacy Groups and Associations
NIST800-PM-16PM-16 Threat Awareness Program
NIST800-PM-16(1)PM-16(1) Threat Awareness Program | Automated Means for Sharing Threat Intelligence
NIST800-PM-17PM-17 Protecting Controlled Unclassified Information on External Systems
NIST800-PM-18PM-18 Privacy Program Plan
NIST800-PM-19PM-19 Privacy Program Leadership Role
NIST800-PM-2PM-2 Information Security Program Leadership Role
NIST800-PM-20PM-20 Dissemination of Privacy Program Information
NIST800-PM-20(1)PM-20(1) Dissemination of Privacy Program Information | Privacy Policies on Websites, Applications, and Digital Services
NIST800-PM-21PM-21 Accounting of Disclosures
NIST800-PM-22PM-22 Personally Identifiable Information Quality Management
NIST800-PM-23PM-23 Data Governance Body
NIST800-PM-24PM-24 Data Integrity Board
NIST800-PM-25PM-25 Minimization of Personally Identifiable Information Used in Testing, Training, and Research
NIST800-PM-26PM-26 Complaint Management
NIST800-PM-27PM-27 Privacy Reporting
NIST800-PM-28PM-28 Risk Framing
NIST800-PM-29PM-29 Risk Management Program Leadership Roles
NIST800-PM-3PM-3 Information Security and Privacy Resources
NIST800-PM-30PM-30 Supply Chain Risk Management Strategy
NIST800-PM-30(1)PM-30(1) Supply Chain Risk Management Strategy | Suppliers of Critical or Mission-essential Items
NIST800-PM-31PM-31 Continuous Monitoring Strategy
NIST800-PM-32PM-32 Purposing
NIST800-PM-4PM-4 Plan of Action and Milestones Process
NIST800-PM-5PM-5 System Inventory
NIST800-PM-5(1)PM-5(1) System Inventory | Inventory of Personally Identifiable Information
NIST800-PM-6PM-6 Measures of Performance
NIST800-PM-7PM-7 Enterprise Architecture
NIST800-PM-7(1)PM-7(1) Enterprise Architecture | Offloading
NIST800-PM-8PM-8 Critical Infrastructure Plan
NIST800-PM-9PM-9 Risk Management Strategy

PS - Personnel Security

17 controls

Personnel security controls

Controls in the PS - Personnel Security domain of NIST SP 800-53 Rev 5: 17 controls
CodeTitle
NIST800-PS-1PS-1 Policy and Procedures
NIST800-PS-2PS-2 Position Risk Designation
NIST800-PS-3PS-3 Personnel Screening
NIST800-PS-3(1)PS-3(1) Personnel Screening | Classified Information
NIST800-PS-3(2)PS-3(2) Personnel Screening | Formal Indoctrination
NIST800-PS-3(3)PS-3(3) Personnel Screening | Information Requiring Special Protective Measures
NIST800-PS-3(4)PS-3(4) Personnel Screening | Citizenship Requirements
NIST800-PS-4PS-4 Personnel Termination
NIST800-PS-4(1)PS-4(1) Personnel Termination | Post-employment Requirements
NIST800-PS-4(2)PS-4(2) Personnel Termination | Automated Actions
NIST800-PS-5PS-5 Personnel Transfer
NIST800-PS-6PS-6 Access Agreements
NIST800-PS-6(2)PS-6(2) Access Agreements | Classified Information Requiring Special Protection
NIST800-PS-6(3)PS-6(3) Access Agreements | Post-employment Requirements
NIST800-PS-7PS-7 External Personnel Security
NIST800-PS-8PS-8 Personnel Sanctions
NIST800-PS-9PS-9 Position Descriptions

PT - PII Processing and Transparency

21 controls
Controls in the PT - PII Processing and Transparency domain of NIST SP 800-53 Rev 5: 21 controls
CodeTitle
NIST800-PT-1PT-1 Policy and Procedures
NIST800-PT-2PT-2 Authority to Process Personally Identifiable Information
NIST800-PT-2(1)PT-2(1) Authority to Process Personally Identifiable Information | Data Tagging
NIST800-PT-2(2)PT-2(2) Authority to Process Personally Identifiable Information | Automation
NIST800-PT-3PT-3 Personally Identifiable Information Processing Purposes
NIST800-PT-3(1)PT-3(1) Personally Identifiable Information Processing Purposes | Data Tagging
NIST800-PT-3(2)PT-3(2) Personally Identifiable Information Processing Purposes | Automation
NIST800-PT-4PT-4 Consent
NIST800-PT-4(1)PT-4(1) Consent | Tailored Consent
NIST800-PT-4(2)PT-4(2) Consent | Just-in-time Consent
NIST800-PT-4(3)PT-4(3) Consent | Revocation
NIST800-PT-5PT-5 Privacy Notice
NIST800-PT-5(1)PT-5(1) Privacy Notice | Just-in-time Notice
NIST800-PT-5(2)PT-5(2) Privacy Notice | Privacy Act Statements
NIST800-PT-6PT-6 System of Records Notice
NIST800-PT-6(1)PT-6(1) System of Records Notice | Routine Uses
NIST800-PT-6(2)PT-6(2) System of Records Notice | Exemption Rules
NIST800-PT-7PT-7 Specific Categories of Personally Identifiable Information
NIST800-PT-7(1)PT-7(1) Specific Categories of Personally Identifiable Information | Social Security Numbers
NIST800-PT-7(2)PT-7(2) Specific Categories of Personally Identifiable Information | First Amendment Information
NIST800-PT-8PT-8 Computer Matching Requirements

RA - Risk Assessment

22 controls

Risk assessment controls

Controls in the RA - Risk Assessment domain of NIST SP 800-53 Rev 5: 22 controls
CodeTitle
NIST800-RA-1RA-1 Policy and Procedures
NIST800-RA-10RA-10 Threat Hunting
NIST800-RA-2RA-2 Security Categorization
NIST800-RA-2(1)RA-2(1) Security Categorization | Impact-level Prioritization
NIST800-RA-3RA-3 Risk Assessment
NIST800-RA-3(1)RA-3(1) Risk Assessment | Supply Chain Risk Assessment
NIST800-RA-3(2)RA-3(2) Risk Assessment | Use of All-source Intelligence
NIST800-RA-3(3)RA-3(3) Risk Assessment | Dynamic Threat Awareness
NIST800-RA-3(4)RA-3(4) Risk Assessment | Predictive Cyber Analytics
NIST800-RA-5RA-5 Vulnerability Monitoring and Scanning
NIST800-RA-5(10)RA-5(10) Vulnerability Monitoring and Scanning | Correlate Scanning Information
NIST800-RA-5(11)RA-5(11) Vulnerability Monitoring and Scanning | Public Disclosure Program
NIST800-RA-5(2)RA-5(2) Vulnerability Monitoring and Scanning | Update Vulnerabilities to Be Scanned
NIST800-RA-5(3)RA-5(3) Vulnerability Monitoring and Scanning | Breadth and Depth of Coverage
NIST800-RA-5(4)RA-5(4) Vulnerability Monitoring and Scanning | Discoverable Information
NIST800-RA-5(5)RA-5(5) Vulnerability Monitoring and Scanning | Privileged Access
NIST800-RA-5(6)RA-5(6) Vulnerability Monitoring and Scanning | Automated Trend Analyses
NIST800-RA-5(8)RA-5(8) Vulnerability Monitoring and Scanning | Review Historic Audit Logs
NIST800-RA-6RA-6 Technical Surveillance Countermeasures Survey
NIST800-RA-7RA-7 Risk Response
NIST800-RA-8RA-8 Privacy Impact Assessments
NIST800-RA-9RA-9 Criticality Analysis

SA - System and Services Acquisition

108 controls

System and services acquisition controls

Controls in the SA - System and Services Acquisition domain of NIST SP 800-53 Rev 5: 108 controls
CodeTitle
NIST800-SA-1SA-1 Policy and Procedures
NIST800-SA-10SA-10 Developer Configuration Management
NIST800-SA-10(1)SA-10(1) Developer Configuration Management | Software and Firmware Integrity Verification
NIST800-SA-10(2)SA-10(2) Developer Configuration Management | Alternative Configuration Management Processes
NIST800-SA-10(3)SA-10(3) Developer Configuration Management | Hardware Integrity Verification
NIST800-SA-10(4)SA-10(4) Developer Configuration Management | Trusted Generation
NIST800-SA-10(5)SA-10(5) Developer Configuration Management | Mapping Integrity for Version Control
NIST800-SA-10(6)SA-10(6) Developer Configuration Management | Trusted Distribution
NIST800-SA-10(7)SA-10(7) Developer Configuration Management | Security and Privacy Representatives
NIST800-SA-11SA-11 Developer Testing and Evaluation
NIST800-SA-11(1)SA-11(1) Developer Testing and Evaluation | Static Code Analysis
NIST800-SA-11(2)SA-11(2) Developer Testing and Evaluation | Threat Modeling and Vulnerability Analyses
NIST800-SA-11(3)SA-11(3) Developer Testing and Evaluation | Independent Verification of Assessment Plans and Evidence
NIST800-SA-11(4)SA-11(4) Developer Testing and Evaluation | Manual Code Reviews
NIST800-SA-11(5)SA-11(5) Developer Testing and Evaluation | Penetration Testing
NIST800-SA-11(6)SA-11(6) Developer Testing and Evaluation | Attack Surface Reviews
NIST800-SA-11(7)SA-11(7) Developer Testing and Evaluation | Verify Scope of Testing and Evaluation
NIST800-SA-11(8)SA-11(8) Developer Testing and Evaluation | Dynamic Code Analysis
NIST800-SA-11(9)SA-11(9) Developer Testing and Evaluation | Interactive Application Security Testing
NIST800-SA-15SA-15 Development Process, Standards, and Tools
NIST800-SA-15(1)SA-15(1) Development Process, Standards, and Tools | Quality Metrics
NIST800-SA-15(10)SA-15(10) Development Process, Standards, and Tools | Incident Response Plan
NIST800-SA-15(11)SA-15(11) Development Process, Standards, and Tools | Archive System or Component
NIST800-SA-15(12)SA-15(12) Development Process, Standards, and Tools | Minimize Personally Identifiable Information
NIST800-SA-15(13)SA-15(13) Development Process, Standards, and Tools | Logging Syntax
NIST800-SA-15(2)SA-15(2) Development Process, Standards, and Tools | Security and Privacy Tracking Tools
NIST800-SA-15(3)SA-15(3) Development Process, Standards, and Tools | Criticality Analysis
NIST800-SA-15(5)SA-15(5) Development Process, Standards, and Tools | Attack Surface Reduction
NIST800-SA-15(6)SA-15(6) Development Process, Standards, and Tools | Continuous Improvement
NIST800-SA-15(7)SA-15(7) Development Process, Standards, and Tools | Automated Vulnerability Analysis
NIST800-SA-15(8)SA-15(8) Development Process, Standards, and Tools | Reuse of Threat and Vulnerability Information
NIST800-SA-16SA-16 Developer-provided Training
NIST800-SA-17SA-17 Developer Security and Privacy Architecture and Design
NIST800-SA-17(1)SA-17(1) Developer Security and Privacy Architecture and Design | Formal Policy Model
NIST800-SA-17(2)SA-17(2) Developer Security and Privacy Architecture and Design | Security-relevant Components
NIST800-SA-17(3)SA-17(3) Developer Security and Privacy Architecture and Design | Formal Correspondence
NIST800-SA-17(4)SA-17(4) Developer Security and Privacy Architecture and Design | Informal Correspondence
NIST800-SA-17(5)SA-17(5) Developer Security and Privacy Architecture and Design | Conceptually Simple Design
NIST800-SA-17(6)SA-17(6) Developer Security and Privacy Architecture and Design | Structure for Testing
NIST800-SA-17(7)SA-17(7) Developer Security and Privacy Architecture and Design | Structure for Least Privilege
NIST800-SA-17(8)SA-17(8) Developer Security and Privacy Architecture and Design | Orchestration
NIST800-SA-17(9)SA-17(9) Developer Security and Privacy Architecture and Design | Design Diversity
NIST800-SA-2SA-2 Allocation of Resources
NIST800-SA-20SA-20 Customized Development of Critical Components
NIST800-SA-21SA-21 Developer Screening
NIST800-SA-22SA-22 Unsupported System Components
NIST800-SA-23SA-23 Specialization
NIST800-SA-24SA-24 Design For Cyber Resiliency
NIST800-SA-3SA-3 System Development Life Cycle
NIST800-SA-3(1)SA-3(1) System Development Life Cycle | Manage Preproduction Environment
NIST800-SA-3(2)SA-3(2) System Development Life Cycle | Use of Live or Operational Data
NIST800-SA-3(3)SA-3(3) System Development Life Cycle | Technology Refresh
NIST800-SA-4SA-4 Acquisition Process
NIST800-SA-4(1)SA-4(1) Acquisition Process | Functional Properties of Controls
NIST800-SA-4(10)SA-4(10) Acquisition Process | Use of Approved PIV Products
NIST800-SA-4(11)SA-4(11) Acquisition Process | System of Records
NIST800-SA-4(12)SA-4(12) Acquisition Process | Data Ownership
NIST800-SA-4(2)SA-4(2) Acquisition Process | Design and Implementation Information for Controls
NIST800-SA-4(3)SA-4(3) Acquisition Process | Development Methods, Techniques, and Practices
NIST800-SA-4(5)SA-4(5) Acquisition Process | System, Component, and Service Configurations
NIST800-SA-4(6)SA-4(6) Acquisition Process | Use of Information Assurance Products
NIST800-SA-4(7)SA-4(7) Acquisition Process | NIAP-approved Protection Profiles
NIST800-SA-4(8)SA-4(8) Acquisition Process | Continuous Monitoring Plan for Controls
NIST800-SA-4(9)SA-4(9) Acquisition Process | Functions, Ports, Protocols, and Services in Use
NIST800-SA-5SA-5 System Documentation
NIST800-SA-8SA-8 Security and Privacy Engineering Principles
NIST800-SA-8(1)SA-8(1) Security and Privacy Engineering Principles | Clear Abstractions
NIST800-SA-8(10)SA-8(10) Security and Privacy Engineering Principles | Hierarchical Trust
NIST800-SA-8(11)SA-8(11) Security and Privacy Engineering Principles | Inverse Modification Threshold
NIST800-SA-8(12)SA-8(12) Security and Privacy Engineering Principles | Hierarchical Protection
NIST800-SA-8(13)SA-8(13) Security and Privacy Engineering Principles | Minimized Security Elements
NIST800-SA-8(14)SA-8(14) Security and Privacy Engineering Principles | Least Privilege
NIST800-SA-8(15)SA-8(15) Security and Privacy Engineering Principles | Predicate Permission
NIST800-SA-8(16)SA-8(16) Security and Privacy Engineering Principles | Self-reliant Trustworthiness
NIST800-SA-8(17)SA-8(17) Security and Privacy Engineering Principles | Secure Distributed Composition
NIST800-SA-8(18)SA-8(18) Security and Privacy Engineering Principles | Trusted Communications Channels
NIST800-SA-8(19)SA-8(19) Security and Privacy Engineering Principles | Continuous Protection
NIST800-SA-8(2)SA-8(2) Security and Privacy Engineering Principles | Least Common Mechanism
NIST800-SA-8(20)SA-8(20) Security and Privacy Engineering Principles | Secure Metadata Management
NIST800-SA-8(21)SA-8(21) Security and Privacy Engineering Principles | Self-analysis
NIST800-SA-8(22)SA-8(22) Security and Privacy Engineering Principles | Accountability and Traceability
NIST800-SA-8(23)SA-8(23) Security and Privacy Engineering Principles | Secure Defaults
NIST800-SA-8(24)SA-8(24) Security and Privacy Engineering Principles | Secure Failure and Recovery
NIST800-SA-8(25)SA-8(25) Security and Privacy Engineering Principles | Economic Security
NIST800-SA-8(26)SA-8(26) Security and Privacy Engineering Principles | Performance Security
NIST800-SA-8(27)SA-8(27) Security and Privacy Engineering Principles | Human Factored Security
NIST800-SA-8(28)SA-8(28) Security and Privacy Engineering Principles | Acceptable Security
NIST800-SA-8(29)SA-8(29) Security and Privacy Engineering Principles | Repeatable and Documented Procedures
NIST800-SA-8(3)SA-8(3) Security and Privacy Engineering Principles | Modularity and Layering
NIST800-SA-8(30)SA-8(30) Security and Privacy Engineering Principles | Procedural Rigor
NIST800-SA-8(31)SA-8(31) Security and Privacy Engineering Principles | Secure System Modification
NIST800-SA-8(32)SA-8(32) Security and Privacy Engineering Principles | Sufficient Documentation
NIST800-SA-8(33)SA-8(33) Security and Privacy Engineering Principles | Minimization
NIST800-SA-8(4)SA-8(4) Security and Privacy Engineering Principles | Partially Ordered Dependencies
NIST800-SA-8(5)SA-8(5) Security and Privacy Engineering Principles | Efficiently Mediated Access
NIST800-SA-8(6)SA-8(6) Security and Privacy Engineering Principles | Minimized Sharing
NIST800-SA-8(7)SA-8(7) Security and Privacy Engineering Principles | Reduced Complexity
NIST800-SA-8(8)SA-8(8) Security and Privacy Engineering Principles | Secure Evolvability
NIST800-SA-8(9)SA-8(9) Security and Privacy Engineering Principles | Trusted Components
NIST800-SA-9SA-9 External System Services
NIST800-SA-9(1)SA-9(1) External System Services | Risk Assessments and Organizational Approvals
NIST800-SA-9(2)SA-9(2) External System Services | Identification of Functions, Ports, Protocols, and Services
NIST800-SA-9(3)SA-9(3) External System Services | Establish and Maintain Trust Relationship with Providers
NIST800-SA-9(4)SA-9(4) External System Services | Consistent Interests of Consumers and Providers
NIST800-SA-9(5)SA-9(5) External System Services | Processing, Storage, and Service Location
NIST800-SA-9(6)SA-9(6) External System Services | Organization-controlled Cryptographic Keys
NIST800-SA-9(7)SA-9(7) External System Services | Organization-controlled Integrity Checking
NIST800-SA-9(8)SA-9(8) External System Services | Processing and Storage Location: U.S. Jurisdiction

SC - System and Communications Protection

139 controls

System and communications protection controls

Controls in the SC - System and Communications Protection domain of NIST SP 800-53 Rev 5: 139 controls
CodeTitle
NIST800-SC-1SC-1 Policy and Procedures
NIST800-SC-10SC-10 Network Disconnect
NIST800-SC-11SC-11 Trusted Path
NIST800-SC-11(1)SC-11(1) Trusted Path | Irrefutable Communications Path
NIST800-SC-12SC-12 Cryptographic Key Establishment and Management
NIST800-SC-12(1)SC-12(1) Cryptographic Key Establishment and Management | Availability
NIST800-SC-12(2)SC-12(2) Cryptographic Key Establishment and Management | Symmetric Keys
NIST800-SC-12(3)SC-12(3) Cryptographic Key Establishment and Management | Asymmetric Keys
NIST800-SC-12(6)SC-12(6) Cryptographic Key Establishment and Management | Physical Control of Keys
NIST800-SC-13SC-13 Cryptographic Protection
NIST800-SC-15SC-15 Collaborative Computing Devices and Applications
NIST800-SC-15(1)SC-15(1) Collaborative Computing Devices and Applications | Physical or Logical Disconnect
NIST800-SC-15(3)SC-15(3) Collaborative Computing Devices and Applications | Disabling and Removal in Secure Work Areas
NIST800-SC-15(4)SC-15(4) Collaborative Computing Devices and Applications | Explicitly Indicate Current Participants
NIST800-SC-16SC-16 Transmission of Security and Privacy Attributes
NIST800-SC-16(1)SC-16(1) Transmission of Security and Privacy Attributes | Integrity Verification
NIST800-SC-16(2)SC-16(2) Transmission of Security and Privacy Attributes | Anti-spoofing Mechanisms
NIST800-SC-16(3)SC-16(3) Transmission of Security and Privacy Attributes | Cryptographic Binding
NIST800-SC-17SC-17 Public Key Infrastructure Certificates
NIST800-SC-18SC-18 Mobile Code
NIST800-SC-18(1)SC-18(1) Mobile Code | Identify Unacceptable Code and Take Corrective Actions
NIST800-SC-18(2)SC-18(2) Mobile Code | Acquisition, Development, and Use
NIST800-SC-18(3)SC-18(3) Mobile Code | Prevent Downloading and Execution
NIST800-SC-18(4)SC-18(4) Mobile Code | Prevent Automatic Execution
NIST800-SC-18(5)SC-18(5) Mobile Code | Allow Execution Only in Confined Environments
NIST800-SC-2SC-2 Separation of System and User Functionality
NIST800-SC-2(1)SC-2(1) Separation of System and User Functionality | Interfaces for Non-privileged Users
NIST800-SC-2(2)SC-2(2) Separation of System and User Functionality | Disassociability
NIST800-SC-20SC-20 Secure Name/Address Resolution Service (Authoritative Source)
NIST800-SC-20(2)SC-20(2) Secure Name/Address Resolution Service (Authoritative Source) | Data Origin and Integrity
NIST800-SC-21SC-21 Secure Name/Address Resolution Service (Recursive or Caching Resolver)
NIST800-SC-22SC-22 Architecture and Provisioning for Name/Address Resolution Service
NIST800-SC-23SC-23 Session Authenticity
NIST800-SC-23(1)SC-23(1) Session Authenticity | Invalidate Session Identifiers at Logout
NIST800-SC-23(3)SC-23(3) Session Authenticity | Unique System-generated Session Identifiers
NIST800-SC-23(5)SC-23(5) Session Authenticity | Allowed Certificate Authorities
NIST800-SC-24SC-24 Fail in Known State
NIST800-SC-25SC-25 Thin Nodes
NIST800-SC-26SC-26 Decoys
NIST800-SC-27SC-27 Platform-independent Applications
NIST800-SC-28SC-28 Protection of Information at Rest
NIST800-SC-28(1)SC-28(1) Protection of Information at Rest | Cryptographic Protection
NIST800-SC-28(2)SC-28(2) Protection of Information at Rest | Offline Storage
NIST800-SC-28(3)SC-28(3) Protection of Information at Rest | Cryptographic Keys
NIST800-SC-29SC-29 Heterogeneity
NIST800-SC-29(1)SC-29(1) Heterogeneity | Virtualization Techniques
NIST800-SC-3SC-3 Security Function Isolation
NIST800-SC-3(1)SC-3(1) Security Function Isolation | Hardware Separation
NIST800-SC-3(2)SC-3(2) Security Function Isolation | Access and Flow Control Functions
NIST800-SC-3(3)SC-3(3) Security Function Isolation | Minimize Nonsecurity Functionality
NIST800-SC-3(4)SC-3(4) Security Function Isolation | Module Coupling and Cohesiveness
NIST800-SC-3(5)SC-3(5) Security Function Isolation | Layered Structures
NIST800-SC-30SC-30 Concealment and Misdirection
NIST800-SC-30(2)SC-30(2) Concealment and Misdirection | Randomness
NIST800-SC-30(3)SC-30(3) Concealment and Misdirection | Change Processing and Storage Locations
NIST800-SC-30(4)SC-30(4) Concealment and Misdirection | Misleading Information
NIST800-SC-30(5)SC-30(5) Concealment and Misdirection | Concealment of System Components
NIST800-SC-31SC-31 Covert Channel Analysis
NIST800-SC-31(1)SC-31(1) Covert Channel Analysis | Test Covert Channels for Exploitability
NIST800-SC-31(2)SC-31(2) Covert Channel Analysis | Maximum Bandwidth
NIST800-SC-31(3)SC-31(3) Covert Channel Analysis | Measure Bandwidth in Operational Environments
NIST800-SC-32SC-32 System Partitioning
NIST800-SC-32(1)SC-32(1) System Partitioning | Separate Physical Domains for Privileged Functions
NIST800-SC-34SC-34 Non-modifiable Executable Programs
NIST800-SC-34(1)SC-34(1) Non-modifiable Executable Programs | No Writable Storage
NIST800-SC-34(2)SC-34(2) Non-modifiable Executable Programs | Integrity Protection on Read-only Media
NIST800-SC-35SC-35 External Malicious Code Identification
NIST800-SC-36SC-36 Distributed Processing and Storage
NIST800-SC-36(1)SC-36(1) Distributed Processing and Storage | Polling Techniques
NIST800-SC-36(2)SC-36(2) Distributed Processing and Storage | Synchronization
NIST800-SC-37SC-37 Out-of-band Channels
NIST800-SC-37(1)SC-37(1) Out-of-band Channels | Ensure Delivery and Transmission
NIST800-SC-38SC-38 Operations Security
NIST800-SC-39SC-39 Process Isolation
NIST800-SC-39(1)SC-39(1) Process Isolation | Hardware Separation
NIST800-SC-39(2)SC-39(2) Process Isolation | Separate Execution Domain Per Thread
NIST800-SC-4SC-4 Information in Shared System Resources
NIST800-SC-4(2)SC-4(2) Information in Shared System Resources | Multilevel or Periods Processing
NIST800-SC-40SC-40 Wireless Link Protection
NIST800-SC-40(1)SC-40(1) Wireless Link Protection | Electromagnetic Interference
NIST800-SC-40(2)SC-40(2) Wireless Link Protection | Reduce Detection Potential
NIST800-SC-40(3)SC-40(3) Wireless Link Protection | Imitative or Manipulative Communications Deception
NIST800-SC-40(4)SC-40(4) Wireless Link Protection | Signal Parameter Identification
NIST800-SC-41SC-41 Port and I/O Device Access
NIST800-SC-42SC-42 Sensor Capability and Data
NIST800-SC-42(1)SC-42(1) Sensor Capability and Data | Reporting to Authorized Individuals or Roles
NIST800-SC-42(2)SC-42(2) Sensor Capability and Data | Authorized Use
NIST800-SC-42(4)SC-42(4) Sensor Capability and Data | Notice of Collection
NIST800-SC-42(5)SC-42(5) Sensor Capability and Data | Collection Minimization
NIST800-SC-43SC-43 Usage Restrictions
NIST800-SC-44SC-44 Detonation Chambers
NIST800-SC-45SC-45 System Time Synchronization
NIST800-SC-45(1)SC-45(1) System Time Synchronization | Synchronization with Authoritative Time Source
NIST800-SC-45(2)SC-45(2) System Time Synchronization | Secondary Authoritative Time Source
NIST800-SC-46SC-46 Cross Domain Policy Enforcement
NIST800-SC-47SC-47 Alternate Communications Paths
NIST800-SC-48SC-48 Sensor Relocation
NIST800-SC-48(1)SC-48(1) Sensor Relocation | Dynamic Relocation of Sensors or Monitoring Capabilities
NIST800-SC-49SC-49 Hardware-enforced Separation and Policy Enforcement
NIST800-SC-5SC-5 Denial-of-service Protection
NIST800-SC-5(1)SC-5(1) Denial-of-service Protection | Restrict Ability to Attack Other Systems
NIST800-SC-5(2)SC-5(2) Denial-of-service Protection | Capacity, Bandwidth, and Redundancy
NIST800-SC-5(3)SC-5(3) Denial-of-service Protection | Detection and Monitoring
NIST800-SC-50SC-50 Software-enforced Separation and Policy Enforcement
NIST800-SC-51SC-51 Hardware-based Protection
NIST800-SC-6SC-6 Resource Availability
NIST800-SC-7SC-7 Boundary Protection
NIST800-SC-7(10)SC-7(10) Boundary Protection | Prevent Exfiltration
NIST800-SC-7(11)SC-7(11) Boundary Protection | Restrict Incoming Communications Traffic
NIST800-SC-7(12)SC-7(12) Boundary Protection | Host-based Protection
NIST800-SC-7(13)SC-7(13) Boundary Protection | Isolation of Security Tools, Mechanisms, and Support Components
NIST800-SC-7(14)SC-7(14) Boundary Protection | Protect Against Unauthorized Physical Connections
NIST800-SC-7(15)SC-7(15) Boundary Protection | Networked Privileged Accesses
NIST800-SC-7(16)SC-7(16) Boundary Protection | Prevent Discovery of System Components
NIST800-SC-7(17)SC-7(17) Boundary Protection | Automated Enforcement of Protocol Formats
NIST800-SC-7(18)SC-7(18) Boundary Protection | Fail Secure
NIST800-SC-7(19)SC-7(19) Boundary Protection | Block Communication from Non-organizationally Configured Hosts
NIST800-SC-7(20)SC-7(20) Boundary Protection | Dynamic Isolation and Segregation
NIST800-SC-7(21)SC-7(21) Boundary Protection | Isolation of System Components
NIST800-SC-7(22)SC-7(22) Boundary Protection | Separate Subnets for Connecting to Different Security Domains
NIST800-SC-7(23)SC-7(23) Boundary Protection | Disable Sender Feedback on Protocol Validation Failure
NIST800-SC-7(24)SC-7(24) Boundary Protection | Personally Identifiable Information
NIST800-SC-7(25)SC-7(25) Boundary Protection | Unclassified National Security System Connections
NIST800-SC-7(26)SC-7(26) Boundary Protection | Classified National Security System Connections
NIST800-SC-7(27)SC-7(27) Boundary Protection | Unclassified Non-national Security System Connections
NIST800-SC-7(28)SC-7(28) Boundary Protection | Connections to Public Networks
NIST800-SC-7(29)SC-7(29) Boundary Protection | Separate Subnets to Isolate Functions
NIST800-SC-7(3)SC-7(3) Boundary Protection | Access Points
NIST800-SC-7(4)SC-7(4) Boundary Protection | External Telecommunications Services
NIST800-SC-7(5)SC-7(5) Boundary Protection | Deny by Default: Allow by Exception
NIST800-SC-7(7)SC-7(7) Boundary Protection | Split Tunneling for Remote Devices
NIST800-SC-7(8)SC-7(8) Boundary Protection | Route Traffic to Authenticated Proxy Servers
NIST800-SC-7(9)SC-7(9) Boundary Protection | Restrict Threatening Outgoing Communications Traffic
NIST800-SC-8SC-8 Transmission Confidentiality and Integrity
NIST800-SC-8(1)SC-8(1) Transmission Confidentiality and Integrity | Cryptographic Protection
NIST800-SC-8(2)SC-8(2) Transmission Confidentiality and Integrity | Pre- and Post-transmission Handling
NIST800-SC-8(3)SC-8(3) Transmission Confidentiality and Integrity | Cryptographic Protection for Message Externals
NIST800-SC-8(4)SC-8(4) Transmission Confidentiality and Integrity | Conceal or Randomize Communications
NIST800-SC-8(5)SC-8(5) Transmission Confidentiality and Integrity | Protected Distribution System

SI - System and Information Integrity

102 controls

System and information integrity controls

Controls in the SI - System and Information Integrity domain of NIST SP 800-53 Rev 5: 102 controls
CodeTitle
NIST800-SI-1SI-1 Policy and Procedures
NIST800-SI-10SI-10 Information Input Validation
NIST800-SI-10(1)SI-10(1) Information Input Validation | Manual Override Capability
NIST800-SI-10(2)SI-10(2) Information Input Validation | Review and Resolve Errors
NIST800-SI-10(3)SI-10(3) Information Input Validation | Predictable Behavior
NIST800-SI-10(4)SI-10(4) Information Input Validation | Timing Interactions
NIST800-SI-10(5)SI-10(5) Information Input Validation | Restrict Inputs to Trusted Sources and Approved Formats
NIST800-SI-10(6)SI-10(6) Information Input Validation | Injection Prevention
NIST800-SI-11SI-11 Error Handling
NIST800-SI-12SI-12 Information Management and Retention
NIST800-SI-12(1)SI-12(1) Information Management and Retention | Limit Personally Identifiable Information Elements
NIST800-SI-12(2)SI-12(2) Information Management and Retention | Minimize Personally Identifiable Information in Testing, Training, and Research
NIST800-SI-12(3)SI-12(3) Information Management and Retention | Information Disposal
NIST800-SI-13SI-13 Predictable Failure Prevention
NIST800-SI-13(1)SI-13(1) Predictable Failure Prevention | Transferring Component Responsibilities
NIST800-SI-13(3)SI-13(3) Predictable Failure Prevention | Manual Transfer Between Components
NIST800-SI-13(4)SI-13(4) Predictable Failure Prevention | Standby Component Installation and Notification
NIST800-SI-13(5)SI-13(5) Predictable Failure Prevention | Failover Capability
NIST800-SI-14SI-14 Non-persistence
NIST800-SI-14(1)SI-14(1) Non-persistence | Refresh from Trusted Sources
NIST800-SI-14(2)SI-14(2) Non-persistence | Non-persistent Information
NIST800-SI-14(3)SI-14(3) Non-persistence | Non-persistent Connectivity
NIST800-SI-15SI-15 Information Output Filtering
NIST800-SI-16SI-16 Memory Protection
NIST800-SI-17SI-17 Fail-safe Procedures
NIST800-SI-18SI-18 Personally Identifiable Information Quality Operations
NIST800-SI-18(1)SI-18(1) Personally Identifiable Information Quality Operations | Automation Support
NIST800-SI-18(2)SI-18(2) Personally Identifiable Information Quality Operations | Data Tags
NIST800-SI-18(3)SI-18(3) Personally Identifiable Information Quality Operations | Collection
NIST800-SI-18(4)SI-18(4) Personally Identifiable Information Quality Operations | Individual Requests
NIST800-SI-18(5)SI-18(5) Personally Identifiable Information Quality Operations | Notice of Correction or Deletion
NIST800-SI-19SI-19 De-identification
NIST800-SI-19(1)SI-19(1) De-identification | Collection
NIST800-SI-19(2)SI-19(2) De-identification | Archiving
NIST800-SI-19(3)SI-19(3) De-identification | Release
NIST800-SI-19(4)SI-19(4) De-identification | Removal, Masking, Encryption, Hashing, or Replacement of Direct Identifiers
NIST800-SI-19(5)SI-19(5) De-identification | Statistical Disclosure Control
NIST800-SI-19(6)SI-19(6) De-identification | Differential Privacy
NIST800-SI-19(7)SI-19(7) De-identification | Validated Algorithms and Software
NIST800-SI-19(8)SI-19(8) De-identification | Motivated Intruder
NIST800-SI-2SI-2 Flaw Remediation
NIST800-SI-2(2)SI-2(2) Flaw Remediation | Automated Flaw Remediation Status
NIST800-SI-2(3)SI-2(3) Flaw Remediation | Time to Remediate Flaws and Benchmarks for Corrective Actions
NIST800-SI-2(4)SI-2(4) Flaw Remediation | Automated Patch Management Tools
NIST800-SI-2(5)SI-2(5) Flaw Remediation | Automatic Software and Firmware Updates
NIST800-SI-2(6)SI-2(6) Flaw Remediation | Removal of Previous Versions of Software and Firmware
NIST800-SI-2(7)SI-2(7) Flaw Remediation | Root Cause Analysis
NIST800-SI-20SI-20 Tainting
NIST800-SI-21SI-21 Information Refresh
NIST800-SI-22SI-22 Information Diversity
NIST800-SI-23SI-23 Information Fragmentation
NIST800-SI-3SI-3 Malicious Code Protection
NIST800-SI-3(10)SI-3(10) Malicious Code Protection | Malicious Code Analysis
NIST800-SI-3(4)SI-3(4) Malicious Code Protection | Updates Only by Privileged Users
NIST800-SI-3(6)SI-3(6) Malicious Code Protection | Testing and Verification
NIST800-SI-3(8)SI-3(8) Malicious Code Protection | Detect Unauthorized Commands
NIST800-SI-4SI-4 System Monitoring
NIST800-SI-4(1)SI-4(1) System Monitoring | System-wide Intrusion Detection System
NIST800-SI-4(10)SI-4(10) System Monitoring | Visibility of Encrypted Communications
NIST800-SI-4(11)SI-4(11) System Monitoring | Analyze Communications Traffic Anomalies
NIST800-SI-4(12)SI-4(12) System Monitoring | Automated Organization-generated Alerts
NIST800-SI-4(13)SI-4(13) System Monitoring | Analyze Traffic and Event Patterns
NIST800-SI-4(14)SI-4(14) System Monitoring | Wireless Intrusion Detection
NIST800-SI-4(15)SI-4(15) System Monitoring | Wireless to Wireline Communications
NIST800-SI-4(16)SI-4(16) System Monitoring | Correlate Monitoring Information
NIST800-SI-4(17)SI-4(17) System Monitoring | Integrated Situational Awareness
NIST800-SI-4(18)SI-4(18) System Monitoring | Analyze Traffic and Covert Exfiltration
NIST800-SI-4(19)SI-4(19) System Monitoring | Risk for Individuals
NIST800-SI-4(2)SI-4(2) System Monitoring | Automated Tools and Mechanisms for Real-time Analysis
NIST800-SI-4(20)SI-4(20) System Monitoring | Privileged Users
NIST800-SI-4(21)SI-4(21) System Monitoring | Probationary Periods
NIST800-SI-4(22)SI-4(22) System Monitoring | Unauthorized Network Services
NIST800-SI-4(23)SI-4(23) System Monitoring | Host-based Devices
NIST800-SI-4(24)SI-4(24) System Monitoring | Indicators of Compromise
NIST800-SI-4(25)SI-4(25) System Monitoring | Optimize Network Traffic Analysis
NIST800-SI-4(3)SI-4(3) System Monitoring | Automated Tool and Mechanism Integration
NIST800-SI-4(4)SI-4(4) System Monitoring | Inbound and Outbound Communications Traffic
NIST800-SI-4(5)SI-4(5) System Monitoring | System-generated Alerts
NIST800-SI-4(7)SI-4(7) System Monitoring | Automated Response to Suspicious Events
NIST800-SI-4(9)SI-4(9) System Monitoring | Testing of Monitoring Tools and Mechanisms
NIST800-SI-5SI-5 Security Alerts, Advisories, and Directives
NIST800-SI-5(1)SI-5(1) Security Alerts, Advisories, and Directives | Automated Alerts and Advisories
NIST800-SI-6SI-6 Security and Privacy Function Verification
NIST800-SI-6(2)SI-6(2) Security and Privacy Function Verification | Automation Support for Distributed Testing
NIST800-SI-6(3)SI-6(3) Security and Privacy Function Verification | Report Verification Results
NIST800-SI-7SI-7 Software, Firmware, and Information Integrity
NIST800-SI-7(1)SI-7(1) Software, Firmware, and Information Integrity | Integrity Checks
NIST800-SI-7(10)SI-7(10) Software, Firmware, and Information Integrity | Protection of Boot Firmware
NIST800-SI-7(12)SI-7(12) Software, Firmware, and Information Integrity | Integrity Verification
NIST800-SI-7(15)SI-7(15) Software, Firmware, and Information Integrity | Code Authentication
NIST800-SI-7(16)SI-7(16) Software, Firmware, and Information Integrity | Time Limit on Process Execution Without Supervision
NIST800-SI-7(17)SI-7(17) Software, Firmware, and Information Integrity | Runtime Application Self-protection
NIST800-SI-7(2)SI-7(2) Software, Firmware, and Information Integrity | Automated Notifications of Integrity Violations
NIST800-SI-7(3)SI-7(3) Software, Firmware, and Information Integrity | Centrally Managed Integrity Tools
NIST800-SI-7(5)SI-7(5) Software, Firmware, and Information Integrity | Automated Response to Integrity Violations
NIST800-SI-7(6)SI-7(6) Software, Firmware, and Information Integrity | Cryptographic Protection
NIST800-SI-7(7)SI-7(7) Software, Firmware, and Information Integrity | Integration of Detection and Response
NIST800-SI-7(8)SI-7(8) Software, Firmware, and Information Integrity | Auditing Capability for Significant Events
NIST800-SI-7(9)SI-7(9) Software, Firmware, and Information Integrity | Verify Boot Process
NIST800-SI-8SI-8 Spam Protection
NIST800-SI-8(2)SI-8(2) Spam Protection | Automatic Updates
NIST800-SI-8(3)SI-8(3) Spam Protection | Continuous Learning Capability

SR - Supply Chain Risk Management

27 controls

Supply chain risk management controls

Controls in the SR - Supply Chain Risk Management domain of NIST SP 800-53 Rev 5: 27 controls
CodeTitle
NIST800-SR-1SR-1 Policy and Procedures
NIST800-SR-10SR-10 Inspection of Systems or Components
NIST800-SR-11SR-11 Component Authenticity
NIST800-SR-11(1)SR-11(1) Component Authenticity | Anti-counterfeit Training
NIST800-SR-11(2)SR-11(2) Component Authenticity | Configuration Control for Component Service and Repair
NIST800-SR-11(3)SR-11(3) Component Authenticity | Anti-counterfeit Scanning
NIST800-SR-12SR-12 Component Disposal
NIST800-SR-2SR-2 Supply Chain Risk Management Plan
NIST800-SR-2(1)SR-2(1) Supply Chain Risk Management Plan | Establish SCRM Team
NIST800-SR-3SR-3 Supply Chain Controls and Processes
NIST800-SR-3(1)SR-3(1) Supply Chain Controls and Processes | Diverse Supply Base
NIST800-SR-3(2)SR-3(2) Supply Chain Controls and Processes | Limitation of Harm
NIST800-SR-3(3)SR-3(3) Supply Chain Controls and Processes | Sub-tier Flow Down
NIST800-SR-4SR-4 Provenance
NIST800-SR-4(1)SR-4(1) Provenance | Identity
NIST800-SR-4(2)SR-4(2) Provenance | Track and Trace
NIST800-SR-4(3)SR-4(3) Provenance | Validate as Genuine and Not Altered
NIST800-SR-4(4)SR-4(4) Provenance | Supply Chain Integrity: Pedigree
NIST800-SR-5SR-5 Acquisition Strategies, Tools, and Methods
NIST800-SR-5(1)SR-5(1) Acquisition Strategies, Tools, and Methods | Adequate Supply
NIST800-SR-5(2)SR-5(2) Acquisition Strategies, Tools, and Methods | Assessments Prior to Selection, Acceptance, Modification, or Update
NIST800-SR-6SR-6 Supplier Assessments and Reviews
NIST800-SR-6(1)SR-6(1) Supplier Assessments and Reviews | Testing and Analysis
NIST800-SR-7SR-7 Supply Chain Operations Security
NIST800-SR-8SR-8 Notification Agreements
NIST800-SR-9SR-9 Tamper Resistance and Detection
NIST800-SR-9(1)SR-9(1) Tamper Resistance and Detection | Multiple Stages of System Development Life Cycle

Your Compliance Coverage

If you comply with NIST SP 800-53 Rev 5, you already cover:

NIST SP 800-53 Rev 5 HIGH

36%

370 controls mapped

Compare →

NIST SP 800-53 Rev 5 MODERATE

28%

287 controls mapped

Compare →

SOC 2

26%

266 controls mapped

Compare →

+ 268 more: ISO 27002:2022 (26%), ISO 27001:2022 (25%)

See all 271 mapped frameworks ↓

Maps to 271 other frameworks

1014 total controls
NIST SP 800-53 Rev 5 HIGH
370 source controls mapped|370 target controls covered
36%
NIST SP 800-53 Rev 5 MODERATE
287 source controls mapped|287 target controls covered
28%
SOC 2
266 source controls mapped|61 target controls covered
26%
ISO 27002:2022
262 source controls mapped|93 target controls covered
26%
ISO 27001:2022
253 source controls mapped|93 target controls covered
25%
NIST Cybersecurity Framework 2.0
237 source controls mapped|106 target controls covered
23%
Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1
208 source controls mapped|193 target controls covered
21%
FedRAMP High
206 source controls mapped|323 target controls covered
20%
FedRAMP Moderate
206 source controls mapped|322 target controls covered
20%
PCI DSS 4.0
205 source controls mapped|246 target controls covered
20%
NIST SP 800-161 Rev 1
191 source controls mapped|190 target controls covered
19%
CIS Controls v8
187 source controls mapped|153 target controls covered
18%
ISO 27701:2019
181 source controls mapped|103 target controls covered
18%
C5 (Germany)
166 source controls mapped|111 target controls covered
16%
NIST SP 800-53 Rev 5 LOW
149 source controls mapped|149 target controls covered
15%
CMMC 2.0
140 source controls mapped|110 target controls covered
14%
HIPAA Security Rule
133 source controls mapped|66 target controls covered
13%
NIST SP 800-171 Rev 3
133 source controls mapped|95 target controls covered
13%
NIST SP 800-66 Rev 2
127 source controls mapped|55 target controls covered
13%
Azure Security Benchmark
121 source controls mapped|85 target controls covered
12%
AWS Well-Architected Security Pillar
95 source controls mapped|63 target controls covered
9%
CFTC System Safeguards (17 CFR 37, 38, 39, 49)
91 source controls mapped|35 target controls covered
9%
EU AI Act
86 source controls mapped|39 target controls covered
8%
ISO 22301:2019
81 source controls mapped|53 target controls covered
8%
ANSSI Guide d'hygiene informatique (42 mesures, v2.0)
80 source controls mapped|42 target controls covered
8%
NIST SP 800-172
80 source controls mapped|35 target controls covered
8%
Australia Consumer Data Right - Banking (CDR)
64 source controls mapped|21 target controls covered
6%
DORA
57 source controls mapped|26 target controls covered
6%
ASD Strategies to Mitigate Cyber Security Incidents
57 source controls mapped|37 target controls covered
6%
NIS2 Directive
56 source controls mapped|20 target controls covered
6%
APRA CPS 230 Operational Risk Management
54 source controls mapped|46 target controls covered
5%
APRA CPS 234
51 source controls mapped|35 target controls covered
5%
ISO/IEC 42001:2023
49 source controls mapped|31 target controls covered
5%
Australia My Health Records Act 2012
49 source controls mapped|27 target controls covered
5%
GDPR
47 source controls mapped|30 target controls covered
5%
NIST SP 800-218
44 source controls mapped|42 target controls covered
4%
ACSC Essential Eight
36 source controls mapped|24 target controls covered
4%
NIST SP 800-171
35 source controls mapped|35 target controls covered
3%
APPI
34 source controls mapped|27 target controls covered
3%
UK Cyber Essentials
33 source controls mapped|31 target controls covered
3%
NIST SP 800-82 Revision 3: Guide to Industrial Control Systems (ICS) Security
32 source controls mapped|6 target controls covered
3%
South Korea ISMS-P
32 source controls mapped|13 target controls covered
3%
Canada ITSG-33 - IT Security Risk Management
31 source controls mapped|23 target controls covered
3%
API 1164
31 source controls mapped|22 target controls covered
3%
NIST SP 800-207
29 source controls mapped|32 target controls covered
3%
BSI IT-Grundschutz
28 source controls mapped|19 target controls covered
3%
NIST SP 800-190
27 source controls mapped|13 target controls covered
3%
PTES
27 source controls mapped|14 target controls covered
3%
NIST Privacy Framework
26 source controls mapped|4 target controls covered
3%
TISAX - Trusted Information Security Assessment Exchange
26 source controls mapped|10 target controls covered
3%
Annex 11 to EU GMP - Computerised Systems
25 source controls mapped|9 target controls covered
2%
AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association)
23 source controls mapped|10 target controls covered
2%
Authorised Economic Operator (AEO) Programmes - Global Standards
23 source controls mapped|14 target controls covered
2%
TSA Pipeline Cybersecurity Directives
23 source controls mapped|2 target controls covered
2%
PAS 1192-5:2015 - Security-Minded Approach to BIM and Digital Built Environments
23 source controls mapped|4 target controls covered
2%
Singapore Government Instruction Manual on ICT&SS Management (IM8)
23 source controls mapped|9 target controls covered
2%
Oman National Cybersecurity Framework
22 source controls mapped|5 target controls covered
2%
SSAE 18 - Attestation Standards (SOC Reporting)
22 source controls mapped|13 target controls covered
2%
ISO/IEC 27011:2024
22 source controls mapped|13 target controls covered
2%
IAEA Nuclear Security Series - Computer Security at Nuclear Facilities (NSS-17-T Rev 1)
21 source controls mapped|6 target controls covered
2%
FFIEC Cybersecurity Assessment Tool (CAT)
21 source controls mapped|8 target controls covered
2%
SOC for Cybersecurity - Cybersecurity Risk Management Examination
21 source controls mapped|9 target controls covered
2%
US Executive Order 14144 - Strengthening and Promoting Innovation in the Nation's Cybersecurity
20 source controls mapped|21 target controls covered
2%
ISO/IEC 27010:2015
20 source controls mapped|8 target controls covered
2%
Security of Critical Infrastructure Act 2018 (SOCI)
20 source controls mapped|10 target controls covered
2%
SLSA
20 source controls mapped|2 target controls covered
2%
SIG (Shared Assessments)
20 source controls mapped|3 target controls covered
2%
OWASP SAMM
20 source controls mapped|3 target controls covered
2%
OpenSSF Scorecard
20 source controls mapped|5 target controls covered
2%
O-RAN WG11 Security Specification
20 source controls mapped|4 target controls covered
2%
NIST SP 800-92
20 source controls mapped|5 target controls covered
2%
NIST SP 800-88
20 source controls mapped|4 target controls covered
2%
ISO 27799:2025
20 source controls mapped|9 target controls covered
2%
ISO/SAE 21434
20 source controls mapped|12 target controls covered
2%
ISO/IEC 27043:2015
20 source controls mapped|13 target controls covered
2%
NIST SP 1800-32
19 source controls mapped|13 target controls covered
2%
IEC 62443
19 source controls mapped|13 target controls covered
2%
ISO/IEC 27019:2024
19 source controls mapped|13 target controls covered
2%
NIST SP 800-187
19 source controls mapped|32 target controls covered
2%
APRA CPS 220 Risk Management
19 source controls mapped|29 target controls covered
2%
GLI-33 - Gaming Laboratories International Event Wagering Systems
19 source controls mapped|24 target controls covered
2%
APEC Cross-Border Privacy Rules (CBPR) System
18 source controls mapped|35 target controls covered
2%
CISA Zero Trust Maturity Model
18 source controls mapped|24 target controls covered
2%
FBI CJIS Security Policy
18 source controls mapped|7 target controls covered
2%
Sigstore - Software Artifact Signing and Verification
18 source controls mapped|5 target controls covered
2%
ISO/IEC 27400:2022
17 source controls mapped|5 target controls covered
2%
3GPP 5G Security Architecture (TS 33.501)
17 source controls mapped|38 target controls covered
2%
FTC GLBA Safeguards Rule (16 CFR Part 314)
17 source controls mapped|3 target controls covered
2%
CISA Industrial Control Systems (ICS) Security Guidance
17 source controls mapped|16 target controls covered
2%
NIST SP 800-160
16 source controls mapped|29 target controls covered
2%
Secure by Design: A Guide for Manufacturers (CISA)
16 source controls mapped|5 target controls covered
2%
ISO 28001:2007 Supply Chain Security Management
16 source controls mapped|5 target controls covered
2%
UK Telecommunications (Security) Act 2021
16 source controls mapped|4 target controls covered
2%
CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0
16 source controls mapped|10 target controls covered
2%
UK Gambling Commission LCCP and Remote Technical Standards
15 source controls mapped|1 target controls covered
1%
PSD2 SCA
14 source controls mapped|4 target controls covered
1%
OSFI B-13
14 source controls mapped|5 target controls covered
1%
Open Banking Security
14 source controls mapped|4 target controls covered
1%
FFIEC IT Examination Handbook
14 source controls mapped|9 target controls covered
1%
PCI P2PE
14 source controls mapped|9 target controls covered
1%
PCI PIN Security
14 source controls mapped|9 target controls covered
1%
PCI SSF
14 source controls mapped|9 target controls covered
1%
UK Security and Emergency Measures Direction (SEMD) - Water Industry
14 source controls mapped|5 target controls covered
1%
NRC 10 CFR 73.54 - Nuclear Facility Cybersecurity
12 source controls mapped|5 target controls covered
1%
NIST SP 800-181
12 source controls mapped|9 target controls covered
1%
NRF Cybersecurity and Data Privacy Framework (National Retail Federation)
12 source controls mapped|3 target controls covered
1%
Virginia CDPA
12 source controls mapped|2 target controls covered
1%
Vietnam PDPD
12 source controls mapped|2 target controls covered
1%
Uruguay DPL
12 source controls mapped|3 target controls covered
1%
Texas Data Privacy and Security Act (TDPSA)
12 source controls mapped|2 target controls covered
1%
Taiwan PDPA
12 source controls mapped|2 target controls covered
1%
Qatar DPL
12 source controls mapped|3 target controls covered
1%
Privacy Act 2020
12 source controls mapped|3 target controls covered
1%
POPIA
12 source controls mapped|2 target controls covered
1%
Personal Data Act (personopplysningsloven)
12 source controls mapped|3 target controls covered
1%
PDPA Thailand
12 source controls mapped|3 target controls covered
1%
PDPA Singapore
12 source controls mapped|3 target controls covered
1%
Oregon Consumer Privacy Act
12 source controls mapped|3 target controls covered
1%
New Jersey Data Privacy Act
12 source controls mapped|3 target controls covered
1%
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL)
12 source controls mapped|4 target controls covered
1%
Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023)
12 source controls mapped|7 target controls covered
1%
NIST SP 800-124 Revision 2 - Guidelines for Managing the Security of Mobile Devices
12 source controls mapped|5 target controls covered
1%
Bahrain PDPL
12 source controls mapped|5 target controls covered
1%
Saudi Arabia PDPL
12 source controls mapped|5 target controls covered
1%
New Zealand Information Security Manual (NZISM)
12 source controls mapped|3 target controls covered
1%
IEC 62351 - Power Systems Communication Security
12 source controls mapped|3 target controls covered
1%
NIST SP 800-161
11 source controls mapped|15 target controls covered
1%
CNCF Security Technical Advisory Group (TAG)
11 source controls mapped|18 target controls covered
1%
CMMC 2.0 Level 1
11 source controls mapped|17 target controls covered
1%
DoD Zero Trust Reference Architecture
11 source controls mapped|15 target controls covered
1%
DAMA-DMBOK2 - Data Management Body of Knowledge (2nd Edition)
11 source controls mapped|3 target controls covered
1%
Cloud Security Alliance Cloud Controls Matrix (CCM) v4.1
10 source controls mapped|9 target controls covered
1%
ITIL 4
10 source controls mapped|4 target controls covered
1%
ISO/IEC 20000-1:2018
10 source controls mapped|4 target controls covered
1%
Australian Energy Sector Cyber Security Framework (AESCSF)
10 source controls mapped|9 target controls covered
1%
US Maritime Transportation Security Act (MTSA) and USCG Cybersecurity Requirements
10 source controls mapped|3 target controls covered
1%
NIST SP 800-53A Rev. 5
9 source controls mapped|11 target controls covered
1%
NIST SP 800-171A - Assessing Security Requirements for Controlled Unclassified Information (CUI)
9 source controls mapped|4 target controls covered
1%
ASEAN Data Management Framework
9 source controls mapped|23 target controls covered
1%
ASIC Cyber Resilience Good Practices
9 source controls mapped|8 target controls covered
1%
NIST SP 800-128
9 source controls mapped|21 target controls covered
1%
South Korea PIPA
9 source controls mapped|3 target controls covered
1%
Peru DPL
9 source controls mapped|2 target controls covered
1%
Nigeria Open Banking Regulatory Framework (CBN, 2023)
9 source controls mapped|3 target controls covered
1%
EASA Part-IS - Information Security in Aviation
9 source controls mapped|8 target controls covered
1%
US Consumer Product Safety Act (CPSC) Manufacturer and Importer Duties
9 source controls mapped|2 target controls covered
1%
AML/CTF Act 2006 (Australia)
9 source controls mapped|3 target controls covered
1%
ICAO Annex 17 - Aviation Security (AVSEC)
9 source controls mapped|2 target controls covered
1%
FedRAMP Rev 5
8 source controls mapped|6 target controls covered
1%
NIST SP 800-183
8 source controls mapped|10 target controls covered
1%
ISO/IEC 23894:2023
8 source controls mapped|8 target controls covered
1%
CCSDS 350.0-G-3 - Space Communications Security (Consultative Committee for Space Data Systems)
8 source controls mapped|14 target controls covered
1%
ISO 22320:2018
8 source controls mapped|4 target controls covered
1%
ASIS SPC.1-2009 - Organizational Resilience Standard
8 source controls mapped|3 target controls covered
1%
NFPA 1600 - Standard on Continuity, Emergency, and Crisis Management
8 source controls mapped|4 target controls covered
1%
SANS Incident Handler's Handbook and PICERL Methodology
8 source controls mapped|6 target controls covered
1%
AICPA Privacy Management Framework (PMF)
8 source controls mapped|3 target controls covered
1%
UK Open Banking Standard
8 source controls mapped|5 target controls covered
1%
Protective Security Policy Framework (PSPF) Release 2026
8 source controls mapped|7 target controls covered
1%
UK FCA/PRA Operational Resilience Framework
8 source controls mapped|3 target controls covered
1%
Kuwait National Cybersecurity Framework
8 source controls mapped|1 target controls covered
1%
Responsible Minerals Initiative (RMI) - Responsible Minerals Assurance Process
8 source controls mapped|7 target controls covered
1%
IEC 62304:2015 Medical Device Software Lifecycle Processes
7 source controls mapped|5 target controls covered
1%
ISO 26262:2018 - Functional Safety for Road Vehicles
7 source controls mapped|3 target controls covered
1%
Telecommunications Sector Security Reforms (TSSR)
7 source controls mapped|5 target controls covered
1%
US ITAR and EAR - Export Control and Data Security
7 source controls mapped|3 target controls covered
1%
French Sapin II Law (Law No. 2016-1691)
7 source controls mapped|3 target controls covered
1%
UAE Virtual Asset Regulatory Authority (VARA) Regulations
7 source controls mapped|4 target controls covered
1%
APRA SPS 220 Risk Management (Superannuation)
7 source controls mapped|4 target controls covered
1%
Australia IRAP - Information Security Registered Assessors Program
7 source controls mapped|14 target controls covered
1%
AS9100D - Aerospace Quality Management System
6 source controls mapped|2 target controls covered
1%
Automotive SPICE (ASPICE) v4.1 - Process Assessment Model
6 source controls mapped|2 target controls covered
1%
UK GDPR (UK General Data Protection Regulation)
6 source controls mapped|1 target controls covered
1%
Barbados Data Protection Act 2019
6 source controls mapped|1 target controls covered
1%
NIST SP 800-150
6 source controls mapped|17 target controls covered
1%
African Union Malabo Convention
6 source controls mapped|6 target controls covered
1%
ITU-T X.805 - Security Architecture for End-to-End Communications
6 source controls mapped|2 target controls covered
1%
ISO 15189:2022 - Medical Laboratories Requirements for Quality and Competence
6 source controls mapped|4 target controls covered
1%
Space ISAC (Information Sharing and Analysis Center) - Threat Framework
6 source controls mapped|2 target controls covered
1%
UK AI Regulation Framework
6 source controls mapped|1 target controls covered
1%
SEC Climate Disclosure Rule
6 source controls mapped|1 target controls covered
1%
PIC/S Guide to Good Manufacturing Practice for Medicinal Products
6 source controls mapped|3 target controls covered
1%
Own Risk and Solvency Assessment (ORSA) - NAIC Model Act
6 source controls mapped|2 target controls covered
1%
OECD Guidelines for Multinational Enterprises on Responsible Business Conduct (2023 Update)
6 source controls mapped|1 target controls covered
1%
OECD AI Principles
6 source controls mapped|2 target controls covered
1%
ISO/IEC 27557:2022 - Organisational Privacy Risk Management
6 source controls mapped|7 target controls covered
1%
ISO/IEC 27003:2017
6 source controls mapped|4 target controls covered
1%
SQF Code Edition 9 - Safe Quality Food
6 source controls mapped|2 target controls covered
1%
Aged Care Quality Standards 2019 (repealed edition)
6 source controls mapped|4 target controls covered
1%
ISO/IEC 29147:2018
6 source controls mapped|4 target controls covered
1%
DISA Security Technical Implementation Guides (STIGs)
5 source controls mapped|5 target controls covered
0%
SASB Standards
5 source controls mapped|8 target controls covered
0%
ISO/IEC 30111:2019
5 source controls mapped|4 target controls covered
0%
UK Defence Standard 05-138 - Cyber Security for Defence Suppliers
5 source controls mapped|3 target controls covered
0%
Aged Care Act 2024 (Australia)
5 source controls mapped|3 target controls covered
0%
ETSI EN 303 645
5 source controls mapped|5 target controls covered
0%
W3C Verifiable Credentials (VC) Data Model 2.0
5 source controls mapped|2 target controls covered
0%
FIDO2 / WebAuthn
5 source controls mapped|1 target controls covered
0%
ISO/IEC 29115:2013 - Entity Authentication Assurance Framework
5 source controls mapped|4 target controls covered
0%
ISO/IEC 23837:2023
5 source controls mapped|4 target controls covered
0%
ISO 22316
5 source controls mapped|3 target controls covered
0%
ISO/TS 22317:2021
5 source controls mapped|3 target controls covered
0%
ISO/IEC 27031:2011
5 source controls mapped|4 target controls covered
0%
ISO/TS 22318:2021
5 source controls mapped|3 target controls covered
0%
Act on the Implementation of the General Data Protection Regulation (OG 42/2018)
5 source controls mapped|4 target controls covered
0%
SA8000:2014 - Social Accountability Standard
5 source controls mapped|2 target controls covered
0%
IAIS Insurance Core Principles (ICPs)
5 source controls mapped|4 target controls covered
0%
ISO/IEC 29134:2023
5 source controls mapped|4 target controls covered
0%
Singapore Cybersecurity Act 2018
5 source controls mapped|2 target controls covered
0%
ICH Q10 - Pharmaceutical Quality System
4 source controls mapped|3 target controls covered
0%
Papua New Guinea National Cybersecurity Policy & Cybercrime Act (2016)
4 source controls mapped|2 target controls covered
0%
Florida Digital Bill of Rights (FDBR)
4 source controls mapped|3 target controls covered
0%
NSA Guidance for Transition to Quantum-Resistant Cryptography
4 source controls mapped|4 target controls covered
0%
US Automated Commercial Environment (ACE) - CBP Trade Data Requirements
4 source controls mapped|2 target controls covered
0%
Uganda Data Protection and Privacy Act (2019)
4 source controls mapped|2 target controls covered
0%
Austria Data Protection Act (Datenschutzgesetz, DSG, amended 2018)
4 source controls mapped|1 target controls covered
0%
IEC 60601-1 - Medical Electrical Equipment Safety
4 source controls mapped|4 target controls covered
0%
21 CFR Part 211 - Current Good Manufacturing Practice
4 source controls mapped|4 target controls covered
0%
Trinidad and Tobago Data Protection Act 2011
3 source controls mapped|1 target controls covered
0%
Tanzania Personal Data Protection Act 2022
3 source controls mapped|1 target controls covered
0%
Nevada Gaming Control Board Cybersecurity Requirements
3 source controls mapped|1 target controls covered
0%
COSO Internal Control - Integrated Framework (2013)
3 source controls mapped|1 target controls covered
0%
CIRCIA (Cyber Incident Reporting for Critical Infrastructure Act)
3 source controls mapped|7 target controls covered
0%
WCAG 2.2
3 source controls mapped|1 target controls covered
0%
Regional Comprehensive Economic Partnership (RCEP) - E-Commerce Chapter
3 source controls mapped|1 target controls covered
0%
Bank Secrecy Act / Anti-Money Laundering (BSA/AML)
3 source controls mapped|1 target controls covered
0%
Armenia Law on Protection of Personal Data (2015)
3 source controls mapped|1 target controls covered
0%
Illinois Biometric Information Privacy Act (BIPA)
3 source controls mapped|2 target controls covered
0%
NATO STANAG 4774 (Confidentiality Metadata Labels) and STANAG 4778 (Metadata Binding)
3 source controls mapped|1 target controls covered
0%
ISO 19650 - Organisation and Digitisation of Information about Buildings and Civil Engineering Works (BIM)
3 source controls mapped|1 target controls covered
0%
Samoa Telecommunications Act 2005
3 source controls mapped|2 target controls covered
0%
IATA Operational Safety Audit (IOSA) Standards Manual
3 source controls mapped|1 target controls covered
0%
21 CFR Part 58 - Good Laboratory Practice (GLP)
3 source controls mapped|1 target controls covered
0%
OECD Recommendation on Artificial Intelligence (2024 Update)
3 source controls mapped|1 target controls covered
0%
ISO 50001:2018 - Energy Management Systems
3 source controls mapped|1 target controls covered
0%
ISO 20400:2017 - Sustainable Procurement
3 source controls mapped|4 target controls covered
0%
ISO 26000:2010
3 source controls mapped|1 target controls covered
0%
BS 65000:2014 - Guidance on Organizational Resilience
3 source controls mapped|2 target controls covered
0%
BREEAM - Building Research Establishment Environmental Assessment Method
3 source controls mapped|1 target controls covered
0%
ISO 41001:2018 - Facility Management Systems
3 source controls mapped|1 target controls covered
0%
Singapore AI Governance Framework
3 source controls mapped|1 target controls covered
0%
Solvency II
3 source controls mapped|4 target controls covered
0%
UNICEF Policy Guidance on AI for Children (2021)
3 source controls mapped|1 target controls covered
0%
UNESCO Recommendation on the Ethics of AI
3 source controls mapped|2 target controls covered
0%
ISO 22000:2018
3 source controls mapped|1 target controls covered
0%
ISO 22313:2020 - Guidance on Business Continuity Management Systems
3 source controls mapped|1 target controls covered
0%
UK Age Appropriate Design Code (Children's Code)
3 source controls mapped|1 target controls covered
0%
UK Modern Slavery Act 2015
3 source controls mapped|1 target controls covered
0%
ISO/IEC 25012:2008 - Data Quality Model
3 source controls mapped|1 target controls covered
0%
DFARS 252.204-7012 - Safeguarding Covered Defense Information
2 source controls mapped|2 target controls covered
0%
Commercial National Security Algorithm Suite (CNSA) 2.0
2 source controls mapped|7 target controls covered
0%
Colorado Artificial Intelligence Act (proposed SB 24-205)
1 source controls mapped|1 target controls covered
0%
ISO 9001:2015
1 source controls mapped|1 target controls covered
0%
ISO 30401
1 source controls mapped|1 target controls covered
0%
EBA Guidelines on ICT and Security Risk Management (EBA/GL/2019/04)
1 source controls mapped|1 target controls covered
0%
FCC Customer Proprietary Network Information (CPNI) and Data Breach Rules (47 CFR 64.2001-2011)
1 source controls mapped|1 target controls covered
0%
Albania Law No. 124/2024 on Personal Data Protection
1 source controls mapped|1 target controls covered
0%
Competition and Consumer Act 2010 Part IVD (Consumer Data Right)
1 source controls mapped|1 target controls covered
0%
FDA Quality Management System Regulation (QMSR)
1 source controls mapped|1 target controls covered
0%
ISO 14064 - Greenhouse Gas Accounting and Verification (Parts 1-3)
1 source controls mapped|1 target controls covered
0%
ISO 27005:2022
1 source controls mapped|1 target controls covered
0%
NIST SP 800-115 (Technical Guide to Information Security Testing and Assessment)
1 source controls mapped|1 target controls covered
0%
MARS-E
1 source controls mapped|1 target controls covered
0%
US OFAC Sanctions Compliance Framework
1 source controls mapped|4 target controls covered
0%
Sweden Data Protection Act (Dataskyddslag, 2018:218)
1 source controls mapped|1 target controls covered
0%
Singapore Payment Services Act 2019
1 source controls mapped|1 target controls covered
0%
ISO 27018:2019
1 source controls mapped|1 target controls covered
0%
Administrative Measures for the Security Assessment of Generative AI Services (2023) and Algorithmic Recommendation Management Provisions (2022)
1 source controls mapped|1 target controls covered
0%
ECB TIBER-EU Framework
1 source controls mapped|1 target controls covered
0%
ISO/IEC 27006-1:2024
1 source controls mapped|1 target controls covered
0%
US SEC Digital Assets and Crypto Regulatory Framework
1 source controls mapped|1 target controls covered
0%
Compare NIST SP 800-53 Rev 5 with NIST SP 800-53 Rev 5 HIGH

Coverage is not the same as your position

This page shows what NIST SP 800-53 Rev 5 overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.

The Compliance Position Diagnostic, $5,000 fixed, ten business days

What is NIST SP 800-53 Rev 5 and who does it apply to?

NIST SP 800-53 Rev 5 is a compliance framework from United States (federal information systems; voluntary for other organizations) with 20 domains and 1014 controls. The complete NIST SP 800-53 Rev 5 catalog at release 5.2.0: 1014 security and privacy controls and control enhancements in 20 families, each with its public-domain control statement (parameters organization-defined), its SP 800-53B baseline allocation and the SP 800-53A Rev 5 evidence an assessor examines. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does NIST SP 800-53 Rev 5 actually require?

NIST SP 800-53 Rev 5 has 1014 controls organised across 20 domains. The largest domains are SC - System and Communications Protection (139 controls), AC - Access Control (131 controls), SA - System and Services Acquisition (108 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of NIST SP 800-53 Rev 5 do I already cover?

NIST SP 800-53 Rev 5 maps to 271 other compliance frameworks. The top mapping partners are NIST SP 800-53 Rev 5 HIGH (36% coverage), NIST SP 800-53 Rev 5 MODERATE (28% coverage), SOC 2 (26% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I implement NIST SP 800-53 Rev 5?

Start your NIST SP 800-53 Rev 5 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about NIST SP 800-53 Rev 5 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 1014 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,120 frameworks.

Get Started Free →

Free forever, no credit card required