NIST SP 800-53 Rev 5

United States

vRev 5

22 domains

192 controls

Security and privacy controls for information systems and organizations

Verified

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (22)

AC - Access Control

15 controls

Policies and procedures for access control

Controls in the AC - Access Control domain of NIST SP 800-53 Rev 5 — 15 controls
Code	Title	Description
NIST800-AC-1	Access control policy and procedures	Access control policy and procedures. Control from NIST SP 800-53 Rev 5 framework, domain: AC - Access Control.
NIST800-AC-11	Device lock	Device lock. Control from NIST SP 800-53 Rev 5 framework, domain: AC - Access Control.
NIST800-AC-12	Session control	Session control. Control from NIST SP 800-53 Rev 5 framework, domain: AC - Access Control.
NIST800-AC-14	Permitted actions without identification or authentication	Permitted actions without identification or authentication. Control from NIST SP 800-53 Rev 5 framework, domain: AC - Ac...
NIST800-AC-17	Remote access	Remote access. Control from NIST SP 800-53 Rev 5 framework, domain: AC - Access Control.
NIST800-AC-18	Wireless access	Wireless access. Control from NIST SP 800-53 Rev 5 framework, domain: AC - Access Control.
NIST800-AC-19	Access control for mobile devices	Access control for mobile devices. Control from NIST SP 800-53 Rev 5 framework, domain: AC - Access Control.
NIST800-AC-2	Account management	Account management. Control from NIST SP 800-53 Rev 5 framework, domain: AC - Access Control.
NIST800-AC-20	Use of external systems	Use of external systems. Control from NIST SP 800-53 Rev 5 framework, domain: AC - Access Control.
NIST800-AC-22	Publicly accessible content	Publicly accessible content. Control from NIST SP 800-53 Rev 5 framework, domain: AC - Access Control.
NIST800-AC-3	Access enforcement	Access enforcement. Control from NIST SP 800-53 Rev 5 framework, domain: AC - Access Control.
NIST800-AC-4	Information flow enforcement	Information flow enforcement. Control from NIST SP 800-53 Rev 5 framework, domain: AC - Access Control.
NIST800-AC-5	Separation of duties	Separation of duties. Control from NIST SP 800-53 Rev 5 framework, domain: AC - Access Control.
NIST800-AC-6	Least privilege	Least privilege. Control from NIST SP 800-53 Rev 5 framework, domain: AC - Access Control.
NIST800-AC-7	Unsuccessful logon attempts	Unsuccessful logon attempts. Control from NIST SP 800-53 Rev 5 framework, domain: AC - Access Control.

AT - Awareness and Training

5 controls

Security awareness and training programs

Controls in the AT - Awareness and Training domain of NIST SP 800-53 Rev 5 — 5 controls
Code	Title	Description
NIST800-AT-1	Policy and procedures for awareness and training	Policy and procedures for awareness and training. Control from NIST SP 800-53 Rev 5 framework, domain: AT - Awareness an...
NIST800-AT-2	Literacy training and awareness	Literacy training and awareness. Control from NIST SP 800-53 Rev 5 framework, domain: AT - Awareness and Training.
NIST800-AT-3	Role-based training	Role-based training. Control from NIST SP 800-53 Rev 5 framework, domain: AT - Awareness and Training.
NIST800-AT-4	Training records	Training records. Control from NIST SP 800-53 Rev 5 framework, domain: AT - Awareness and Training.
NIST800-AT-6	Training feedback	Training feedback. Control from NIST SP 800-53 Rev 5 framework, domain: AT - Awareness and Training.

AU - Audit and Accountability

11 controls

Audit and accountability controls

Controls in the AU - Audit and Accountability domain of NIST SP 800-53 Rev 5 — 11 controls
Code	Title	Description
NIST800-AU-1	Policy and procedures for audit and accountability	Policy and procedures for audit and accountability. Control from NIST SP 800-53 Rev 5 framework, domain: AU - Audit and...
NIST800-AU-11	Audit record retention	Audit record retention. Control from NIST SP 800-53 Rev 5 framework, domain: AU - Audit and Accountability.
NIST800-AU-12	Audit record generation	Audit record generation. Control from NIST SP 800-53 Rev 5 framework, domain: AU - Audit and Accountability.
NIST800-AU-2	Event logging	Event logging. Control from NIST SP 800-53 Rev 5 framework, domain: AU - Audit and Accountability.
NIST800-AU-3	Content of audit records	Content of audit records. Control from NIST SP 800-53 Rev 5 framework, domain: AU - Audit and Accountability.
NIST800-AU-4	Audit log storage capacity	Audit log storage capacity. Control from NIST SP 800-53 Rev 5 framework, domain: AU - Audit and Accountability.
NIST800-AU-5	Response to audit logging process failures	Response to audit logging process failures. Control from NIST SP 800-53 Rev 5 framework, domain: AU - Audit and Accounta...
NIST800-AU-6	Audit record review, analysis, and reporting	Audit record review, analysis, and reporting. Control from NIST SP 800-53 Rev 5 framework, domain: AU - Audit and Accoun...
NIST800-AU-7	Audit record reduction and report generation	Audit record reduction and report generation. Control from NIST SP 800-53 Rev 5 framework, domain: AU - Audit and Accoun...
NIST800-AU-8	Time stamps	Time stamps. Control from NIST SP 800-53 Rev 5 framework, domain: AU - Audit and Accountability.
NIST800-AU-9	Protection of audit information	Protection of audit information. Control from NIST SP 800-53 Rev 5 framework, domain: AU - Audit and Accountability.

CA - Assessment, Authorization, and Monitoring

8 controls

Security assessment, authorization, and monitoring

Controls in the CA - Assessment, Authorization, and Monitoring domain of NIST SP 800-53 Rev 5 — 8 controls
Code	Title	Description
NIST800-CA-1	Policy and procedures for assessment, authorization, and monitoring	Policy and procedures for assessment, authorization, and monitoring. Control from NIST SP 800-53 Rev 5 framework, domain...
NIST800-CA-2	Control assessments	Control assessments. Control from NIST SP 800-53 Rev 5 framework, domain: CA - Assessment, Authorization, and Monitoring...
NIST800-CA-3	Information exchange	Information exchange. Control from NIST SP 800-53 Rev 5 framework, domain: CA - Assessment, Authorization, and Monitorin...
NIST800-CA-5	Plan of action and milestones	Plan of action and milestones. Control from NIST SP 800-53 Rev 5 framework, domain: CA - Assessment, Authorization, and...
NIST800-CA-6	Authorization	Authorization. Control from NIST SP 800-53 Rev 5 framework, domain: CA - Assessment, Authorization, and Monitoring.
NIST800-CA-7	Continuous monitoring	Continuous monitoring. Control from NIST SP 800-53 Rev 5 framework, domain: CA - Assessment, Authorization, and Monitori...
NIST800-CA-8	Penetration testing	Penetration testing. Control from NIST SP 800-53 Rev 5 framework, domain: CA - Assessment, Authorization, and Monitoring...
NIST800-CA-9	Internal system connections	Internal system connections. Control from NIST SP 800-53 Rev 5 framework, domain: CA - Assessment, Authorization, and Mo...

CM - Configuration Management

11 controls

Configuration management controls

Controls in the CM - Configuration Management domain of NIST SP 800-53 Rev 5 — 11 controls
Code	Title	Description
NIST800-CM-1	Policy and procedures for configuration management	Policy and procedures for configuration management. Control from NIST SP 800-53 Rev 5 framework, domain: CM - Configurat...
NIST800-CM-10	Software usage restrictions	Software usage restrictions. Control from NIST SP 800-53 Rev 5 framework, domain: CM - Configuration Management.
NIST800-CM-11	User-installed software	User-installed software. Control from NIST SP 800-53 Rev 5 framework, domain: CM - Configuration Management.
NIST800-CM-2	Baseline configuration	Baseline configuration. Control from NIST SP 800-53 Rev 5 framework, domain: CM - Configuration Management.
NIST800-CM-3	Configuration change control	Configuration change control. Control from NIST SP 800-53 Rev 5 framework, domain: CM - Configuration Management.
NIST800-CM-4	Impact analyses	Impact analyses. Control from NIST SP 800-53 Rev 5 framework, domain: CM - Configuration Management.
NIST800-CM-5	Access restrictions for change	Access restrictions for change. Control from NIST SP 800-53 Rev 5 framework, domain: CM - Configuration Management.
NIST800-CM-6	Configuration settings	Configuration settings. Control from NIST SP 800-53 Rev 5 framework, domain: CM - Configuration Management.
NIST800-CM-7	Least functionality	Least functionality. Control from NIST SP 800-53 Rev 5 framework, domain: CM - Configuration Management.
NIST800-CM-8	System component inventory	System component inventory. Control from NIST SP 800-53 Rev 5 framework, domain: CM - Configuration Management.
NIST800-CM-9	Configuration management plan	Configuration management plan. Control from NIST SP 800-53 Rev 5 framework, domain: CM - Configuration Management.

CP - Contingency Planning

9 controls

Contingency planning controls

Controls in the CP - Contingency Planning domain of NIST SP 800-53 Rev 5 — 9 controls
Code	Title	Description
NIST800-CP-1	Policy and procedures for contingency planning	Policy and procedures for contingency planning. Control from NIST SP 800-53 Rev 5 framework, domain: CP - Contingency Pl...
NIST800-CP-10	System recovery and reconstitution	System recovery and reconstitution. Control from NIST SP 800-53 Rev 5 framework, domain: CP - Contingency Planning.
NIST800-CP-2	Contingency plan	Contingency plan. Control from NIST SP 800-53 Rev 5 framework, domain: CP - Contingency Planning.
NIST800-CP-3	Contingency training	Contingency training. Control from NIST SP 800-53 Rev 5 framework, domain: CP - Contingency Planning.
NIST800-CP-4	Contingency plan testing	Contingency plan testing. Control from NIST SP 800-53 Rev 5 framework, domain: CP - Contingency Planning.
NIST800-CP-6	Alternate storage site	Alternate storage site. Control from NIST SP 800-53 Rev 5 framework, domain: CP - Contingency Planning.
NIST800-CP-7	Alternate processing site	Alternate processing site. Control from NIST SP 800-53 Rev 5 framework, domain: CP - Contingency Planning.
NIST800-CP-8	Telecommunications services	Telecommunications services. Control from NIST SP 800-53 Rev 5 framework, domain: CP - Contingency Planning.
NIST800-CP-9	System backup	System backup. Control from NIST SP 800-53 Rev 5 framework, domain: CP - Contingency Planning.

IA - Identification and Authentication

10 controls

Identification and authentication controls

Controls in the IA - Identification and Authentication domain of NIST SP 800-53 Rev 5 — 10 controls
Code	Title	Description
NIST800-IA-1	Policy and procedures for identification and authentication	Policy and procedures for identification and authentication. Control from NIST SP 800-53 Rev 5 framework, domain: IA - I...
NIST800-IA-11	Re-authentication	Re-authentication. Control from NIST SP 800-53 Rev 5 framework, domain: IA - Identification and Authentication.
NIST800-IA-12	Identity proofing	Identity proofing. Control from NIST SP 800-53 Rev 5 framework, domain: IA - Identification and Authentication.
NIST800-IA-2	Identification and authentication of organizational users	Identification and authentication of organizational users. Control from NIST SP 800-53 Rev 5 framework, domain: IA - Ide...
NIST800-IA-3	Device identification and authentication	Device identification and authentication. Control from NIST SP 800-53 Rev 5 framework, domain: IA - Identification and A...
NIST800-IA-4	Identifier management	Identifier management. Control from NIST SP 800-53 Rev 5 framework, domain: IA - Identification and Authentication.
NIST800-IA-5	Authenticator management	Authenticator management. Control from NIST SP 800-53 Rev 5 framework, domain: IA - Identification and Authentication.
NIST800-IA-6	Authentication feedback	Authentication feedback. Control from NIST SP 800-53 Rev 5 framework, domain: IA - Identification and Authentication.
NIST800-IA-7	Cryptographic module authentication	Cryptographic module authentication. Control from NIST SP 800-53 Rev 5 framework, domain: IA - Identification and Authen...
NIST800-IA-8	Identification and authentication of non-organizational users	Identification and authentication of non-organizational users. Control from NIST SP 800-53 Rev 5 framework, domain: IA -...

IR - Incident Response

8 controls

Incident response controls

Controls in the IR - Incident Response domain of NIST SP 800-53 Rev 5 — 8 controls
Code	Title	Description
NIST800-IR-1	Policy and procedures for incident response	Policy and procedures for incident response. Control from NIST SP 800-53 Rev 5 framework, domain: IR - Incident Response...
NIST800-IR-2	Incident response training	Incident response training. Control from NIST SP 800-53 Rev 5 framework, domain: IR - Incident Response.
NIST800-IR-3	Incident response testing	Incident response testing. Control from NIST SP 800-53 Rev 5 framework, domain: IR - Incident Response.
NIST800-IR-4	Incident handling	Incident handling. Control from NIST SP 800-53 Rev 5 framework, domain: IR - Incident Response.
NIST800-IR-5	Incident monitoring	Incident monitoring. Control from NIST SP 800-53 Rev 5 framework, domain: IR - Incident Response.
NIST800-IR-6	Incident reporting	Incident reporting. Control from NIST SP 800-53 Rev 5 framework, domain: IR - Incident Response.
NIST800-IR-7	Incident response assistance	Incident response assistance. Control from NIST SP 800-53 Rev 5 framework, domain: IR - Incident Response.
NIST800-IR-8	Incident response plan	Incident response plan. Control from NIST SP 800-53 Rev 5 framework, domain: IR - Incident Response.

MA - Maintenance

5 controls

System maintenance controls

Controls in the MA - Maintenance domain of NIST SP 800-53 Rev 5 — 5 controls
Code	Title	Description
NIST800-MA-1	Policy and procedures for maintenance	Policy and procedures for maintenance. Control from NIST SP 800-53 Rev 5 framework, domain: MA - Maintenance.
NIST800-MA-2	Controlled maintenance	Controlled maintenance. Control from NIST SP 800-53 Rev 5 framework, domain: MA - Maintenance.
NIST800-MA-3	Maintenance tools	Maintenance tools. Control from NIST SP 800-53 Rev 5 framework, domain: MA - Maintenance.
NIST800-MA-4	Nonlocal maintenance	Nonlocal maintenance. Control from NIST SP 800-53 Rev 5 framework, domain: MA - Maintenance.
NIST800-MA-5	Maintenance personnel	Maintenance personnel. Control from NIST SP 800-53 Rev 5 framework, domain: MA - Maintenance.

MP - Media Protection

7 controls

Media protection controls

Controls in the MP - Media Protection domain of NIST SP 800-53 Rev 5 — 7 controls
Code	Title	Description
NIST800-MP-1	Policy and procedures for media protection	Policy and procedures for media protection. Control from NIST SP 800-53 Rev 5 framework, domain: MP - Media Protection.
NIST800-MP-2	Media access	Media access. Control from NIST SP 800-53 Rev 5 framework, domain: MP - Media Protection.
NIST800-MP-3	Media marking	Media marking. Control from NIST SP 800-53 Rev 5 framework, domain: MP - Media Protection.
NIST800-MP-4	Media storage	Media storage. Control from NIST SP 800-53 Rev 5 framework, domain: MP - Media Protection.
NIST800-MP-5	Media transport	Media transport. Control from NIST SP 800-53 Rev 5 framework, domain: MP - Media Protection.
NIST800-MP-6	Media sanitization	Media sanitization. Control from NIST SP 800-53 Rev 5 framework, domain: MP - Media Protection.
NIST800-MP-7	Media use	Media use. Control from NIST SP 800-53 Rev 5 framework, domain: MP - Media Protection.

Management

6 controls

Controls in the Management domain of NIST SP 800-53 Rev 5 — 6 controls
Code	Title	Description
SP800-53-CA	Assessment, Authorization, and Monitoring Family	The organization plans and conducts control assessments, system authorizations, ongoing monitoring, and connection autho...
SP800-53-PL	Planning Family	Security and privacy plans are developed and maintained, including rules of behavior, baseline tailoring, and central ma...
SP800-53-PM	Program Management Family	The organization maintains a program management function for security and privacy, including strategic plans, risk manag...
SP800-53-RA	Risk Assessment Family	The organization conducts risk assessments, threat awareness activities, privacy risk assessments, vulnerability monitor...
SP800-53-SA	System and Services Acquisition Family	Security and privacy requirements are addressed in acquisition processes, including supplier evaluation, system developm...
SP800-53-SR	Supply Chain Risk Management Family	The organization implements supply chain risk management including policy, plans, supplier reviews, provenance, tamperin...

Operational

8 controls

Controls in the Operational domain of NIST SP 800-53 Rev 5 — 8 controls
Code	Title	Description
SP800-53-AT	Awareness and Training Family	The organization provides security and privacy literacy training, role-based training, and training feedback aligned wit...
SP800-53-CM	Configuration Management Family	Configuration baselines are established, changes controlled, security impact analyses performed, and configurations moni...
SP800-53-CP	Contingency Planning Family	The organization develops contingency plans, trains personnel, tests plans, provides alternate storage and processing si...
SP800-53-IR	Incident Response Family	The organization establishes an incident response capability including planning, training, testing, handling, monitoring...
SP800-53-MA	Maintenance Family	Controlled maintenance is performed on systems, including timely maintenance, maintenance tools, nonlocal maintenance, a...
SP800-53-MP	Media Protection Family	Media containing system information is protected through access controls, marking, storage, transport, sanitization, and...
SP800-53-PE	Physical and Environmental Protection Family	Physical access to systems and facilities is controlled, environmental hazards mitigated, and visitors managed, with mon...
SP800-53-PS	Personnel Security Family	Personnel are screened, terminated and transferred under controlled procedures, with access agreements and sanctions for...

PE - Physical and Environmental Protection

15 controls

Physical and environmental protection controls

Controls in the PE - Physical and Environmental Protection domain of NIST SP 800-53 Rev 5 — 15 controls
Code	Title	Description
NIST800-PE-1	Policy and procedures for physical and environmental protection	Policy and procedures for physical and environmental protection. Control from NIST SP 800-53 Rev 5 framework, domain: PE...
NIST800-PE-10	Emergency shutoff	Emergency shutoff. Control from NIST SP 800-53 Rev 5 framework, domain: PE - Physical and Environmental Protection.
NIST800-PE-11	Emergency power	Emergency power. Control from NIST SP 800-53 Rev 5 framework, domain: PE - Physical and Environmental Protection.
NIST800-PE-12	Emergency lighting	Emergency lighting. Control from NIST SP 800-53 Rev 5 framework, domain: PE - Physical and Environmental Protection.
NIST800-PE-13	Fire protection	Fire protection. Control from NIST SP 800-53 Rev 5 framework, domain: PE - Physical and Environmental Protection.
NIST800-PE-14	Environmental controls	Environmental controls. Control from NIST SP 800-53 Rev 5 framework, domain: PE - Physical and Environmental Protection.
NIST800-PE-15	Water damage protection	Water damage protection. Control from NIST SP 800-53 Rev 5 framework, domain: PE - Physical and Environmental Protection...
NIST800-PE-17	Alternate work site	Alternate work site. Control from NIST SP 800-53 Rev 5 framework, domain: PE - Physical and Environmental Protection.
NIST800-PE-2	Physical access authorizations	Physical access authorizations. Control from NIST SP 800-53 Rev 5 framework, domain: PE - Physical and Environmental Pro...
NIST800-PE-3	Physical access control	Physical access control. Control from NIST SP 800-53 Rev 5 framework, domain: PE - Physical and Environmental Protection...
NIST800-PE-4	Access control for transmission	Access control for transmission. Control from NIST SP 800-53 Rev 5 framework, domain: PE - Physical and Environmental Pr...
NIST800-PE-5	Access control for output devices	Access control for output devices. Control from NIST SP 800-53 Rev 5 framework, domain: PE - Physical and Environmental...
NIST800-PE-6	Monitoring physical access	Monitoring physical access. Control from NIST SP 800-53 Rev 5 framework, domain: PE - Physical and Environmental Protect...
NIST800-PE-8	Visitor access records	Visitor access records. Control from NIST SP 800-53 Rev 5 framework, domain: PE - Physical and Environmental Protection.
NIST800-PE-9	Power equipment and cabling	Power equipment and cabling. Control from NIST SP 800-53 Rev 5 framework, domain: PE - Physical and Environmental Protec...

PL - Planning

6 controls

Security planning controls

Controls in the PL - Planning domain of NIST SP 800-53 Rev 5 — 6 controls
Code	Title	Description
NIST800-PL-1	Policy and procedures for planning	Policy and procedures for planning. Control from NIST SP 800-53 Rev 5 framework, domain: PL - Planning.
NIST800-PL-10	Baseline selection	Baseline selection. Control from NIST SP 800-53 Rev 5 framework, domain: PL - Planning.
NIST800-PL-11	Baseline tailoring	Baseline tailoring. Control from NIST SP 800-53 Rev 5 framework, domain: PL - Planning.
NIST800-PL-2	System security and privacy plans	System security and privacy plans. Control from NIST SP 800-53 Rev 5 framework, domain: PL - Planning.
NIST800-PL-4	Rules of behavior	Rules of behavior. Control from NIST SP 800-53 Rev 5 framework, domain: PL - Planning.
NIST800-PL-8	Security and privacy architectures	Security and privacy architectures. Control from NIST SP 800-53 Rev 5 framework, domain: PL - Planning.

PS - Personnel Security

9 controls

Personnel security controls

Controls in the PS - Personnel Security domain of NIST SP 800-53 Rev 5 — 9 controls
Code	Title	Description
NIST800-PS-1	Policy and procedures for personnel security	Policy and procedures for personnel security. Control from NIST SP 800-53 Rev 5 framework, domain: PS - Personnel Securi...
NIST800-PS-2	Position risk designation	Position risk designation. Control from NIST SP 800-53 Rev 5 framework, domain: PS - Personnel Security.
NIST800-PS-3	Personnel screening	Personnel screening. Control from NIST SP 800-53 Rev 5 framework, domain: PS - Personnel Security.
NIST800-PS-4	Personnel termination	Personnel termination. Control from NIST SP 800-53 Rev 5 framework, domain: PS - Personnel Security.
NIST800-PS-5	Personnel transfer	Personnel transfer. Control from NIST SP 800-53 Rev 5 framework, domain: PS - Personnel Security.
NIST800-PS-6	Access agreements	Access agreements. Control from NIST SP 800-53 Rev 5 framework, domain: PS - Personnel Security.
NIST800-PS-7	External personnel security	External personnel security. Control from NIST SP 800-53 Rev 5 framework, domain: PS - Personnel Security.
NIST800-PS-8	Personnel sanctions	Personnel sanctions. Control from NIST SP 800-53 Rev 5 framework, domain: PS - Personnel Security.
NIST800-PS-9	Position descriptions	Position descriptions. Control from NIST SP 800-53 Rev 5 framework, domain: PS - Personnel Security.

Privacy

1 controls

Controls in the Privacy domain of NIST SP 800-53 Rev 5 — 1 controls
Code	Title	Description
SP800-53-PT	PII Processing and Transparency Family	Personally identifiable information processing has documented authority, purpose specification, consent, individual acce...

RA - Risk Assessment

7 controls

Risk assessment controls

Controls in the RA - Risk Assessment domain of NIST SP 800-53 Rev 5 — 7 controls
Code	Title	Description
NIST800-RA-1	Policy and procedures for risk assessment	Policy and procedures for risk assessment. Control from NIST SP 800-53 Rev 5 framework, domain: RA - Risk Assessment.
NIST800-RA-10	Threat hunting	Threat hunting. Control from NIST SP 800-53 Rev 5 framework, domain: RA - Risk Assessment.
NIST800-RA-2	Security categorization	Security categorization. Control from NIST SP 800-53 Rev 5 framework, domain: RA - Risk Assessment.
NIST800-RA-3	Risk assessment	Risk assessment. Control from NIST SP 800-53 Rev 5 framework, domain: RA - Risk Assessment.
NIST800-RA-5	Vulnerability monitoring and scanning	Vulnerability monitoring and scanning. Control from NIST SP 800-53 Rev 5 framework, domain: RA - Risk Assessment.
NIST800-RA-7	Risk response	Risk response. Control from NIST SP 800-53 Rev 5 framework, domain: RA - Risk Assessment.
NIST800-RA-9	Criticality analysis	Criticality analysis. Control from NIST SP 800-53 Rev 5 framework, domain: RA - Risk Assessment.

SA - System and Services Acquisition

11 controls

System and services acquisition controls

Controls in the SA - System and Services Acquisition domain of NIST SP 800-53 Rev 5 — 11 controls
Code	Title	Description
NIST800-SA-1	Policy and procedures for system and services acquisition	Policy and procedures for system and services acquisition. Control from NIST SP 800-53 Rev 5 framework, domain: SA - Sys...
NIST800-SA-10	Developer configuration management	Developer configuration management. Control from NIST SP 800-53 Rev 5 framework, domain: SA - System and Services Acquis...
NIST800-SA-11	Developer testing and evaluation	Developer testing and evaluation. Control from NIST SP 800-53 Rev 5 framework, domain: SA - System and Services Acquisit...
NIST800-SA-15	Development process, standards, and tools	Development process, standards, and tools. Control from NIST SP 800-53 Rev 5 framework, domain: SA - System and Services...
NIST800-SA-2	Allocation of resources	Allocation of resources. Control from NIST SP 800-53 Rev 5 framework, domain: SA - System and Services Acquisition.
NIST800-SA-22	Developer security and privacy architecture	Developer security and privacy architecture. Control from NIST SP 800-53 Rev 5 framework, domain: SA - System and Servic...
NIST800-SA-3	System development life cycle	System development life cycle. Control from NIST SP 800-53 Rev 5 framework, domain: SA - System and Services Acquisition...
NIST800-SA-4	Acquisition process	Acquisition process. Control from NIST SP 800-53 Rev 5 framework, domain: SA - System and Services Acquisition.
NIST800-SA-5	System documentation	System documentation. Control from NIST SP 800-53 Rev 5 framework, domain: SA - System and Services Acquisition.
NIST800-SA-8	Security and privacy engineering principles	Security and privacy engineering principles. Control from NIST SP 800-53 Rev 5 framework, domain: SA - System and Servic...
NIST800-SA-9	External system services	External system services. Control from NIST SP 800-53 Rev 5 framework, domain: SA - System and Services Acquisition.

SC - System and Communications Protection

17 controls

System and communications protection controls

SI - System and Information Integrity

9 controls

System and information integrity controls

Controls in the SI - System and Information Integrity domain of NIST SP 800-53 Rev 5 — 9 controls
Code	Title	Description
NIST800-SI-1	Policy and procedures for system and information integrity	Policy and procedures for system and information integrity. Control from NIST SP 800-53 Rev 5 framework, domain: SI - Sy...
NIST800-SI-10	Information input validation	Information input validation. Control from NIST SP 800-53 Rev 5 framework, domain: SI - System and Information Integrity...
NIST800-SI-12	Information management and retention	Information management and retention. Control from NIST SP 800-53 Rev 5 framework, domain: SI - System and Information I...
NIST800-SI-16	Memory protection	Memory protection. Control from NIST SP 800-53 Rev 5 framework, domain: SI - System and Information Integrity.
NIST800-SI-2	Flaw remediation	Flaw remediation. Control from NIST SP 800-53 Rev 5 framework, domain: SI - System and Information Integrity.
NIST800-SI-3	Malicious code protection	Malicious code protection. Control from NIST SP 800-53 Rev 5 framework, domain: SI - System and Information Integrity.
NIST800-SI-4	System monitoring	System monitoring. Control from NIST SP 800-53 Rev 5 framework, domain: SI - System and Information Integrity.
NIST800-SI-5	Security alerts, advisories, and directives	Security alerts, advisories, and directives. Control from NIST SP 800-53 Rev 5 framework, domain: SI - System and Inform...
NIST800-SI-7	Software, firmware, and information integrity	Software, firmware, and information integrity. Control from NIST SP 800-53 Rev 5 framework, domain: SI - System and Info...

SR - Supply Chain Risk Management

9 controls

Supply chain risk management controls

Controls in the SR - Supply Chain Risk Management domain of NIST SP 800-53 Rev 5 — 9 controls
Code	Title	Description
NIST800-SR-1	Policy and procedures for supply chain risk management	Policy and procedures for supply chain risk management. Control from NIST SP 800-53 Rev 5 framework, domain: SR - Supply...
NIST800-SR-10	Inspection of systems or components	Inspection of systems or components. Control from NIST SP 800-53 Rev 5 framework, domain: SR - Supply Chain Risk Managem...
NIST800-SR-11	Component authenticity	Component authenticity. Control from NIST SP 800-53 Rev 5 framework, domain: SR - Supply Chain Risk Management.
NIST800-SR-12	Component disposal	Component disposal. Control from NIST SP 800-53 Rev 5 framework, domain: SR - Supply Chain Risk Management.
NIST800-SR-2	Supply chain risk management plan	Supply chain risk management plan. Control from NIST SP 800-53 Rev 5 framework, domain: SR - Supply Chain Risk Managemen...
NIST800-SR-3	Supply chain controls and processes	Supply chain controls and processes. Control from NIST SP 800-53 Rev 5 framework, domain: SR - Supply Chain Risk Managem...
NIST800-SR-5	Acquisition strategies, tools, and methods	Acquisition strategies, tools, and methods. Control from NIST SP 800-53 Rev 5 framework, domain: SR - Supply Chain Risk...
NIST800-SR-6	Supplier assessments and reviews	Supplier assessments and reviews. Control from NIST SP 800-53 Rev 5 framework, domain: SR - Supply Chain Risk Management...
NIST800-SR-8	Notification agreements	Notification agreements. Control from NIST SP 800-53 Rev 5 framework, domain: SR - Supply Chain Risk Management.

Technical

5 controls

Controls in the Technical domain of NIST SP 800-53 Rev 5 — 5 controls
Code	Title	Description
SP800-53-AC	Access Control Family	The organization manages account types, access enforcement, separation of duties, least privilege, unsuccessful logon at...
SP800-53-AU	Audit and Accountability Family	Systems generate audit records for defined events, with content sufficient to support investigation, with protection of...
SP800-53-IA	Identification and Authentication Family	Users and devices are uniquely identified and authenticated using mechanisms appropriate to assurance levels, with manag...
SP800-53-SC	System and Communications Protection Family	The organization protects communications and applies cryptographic protections, boundary protections, denial of service...
SP800-53-SI	System and Information Integrity Family	The organization identifies, reports, and corrects information system flaws, provides malicious code protection, monitor...

Your Compliance Coverage

If you comply with NIST SP 800-53 Rev 5, you already cover:

ISO 27001:2022

68%

130 controls mapped

Compare →

NIST SP 800-171

21%

40 controls mapped

Compare →

TISAX - Trusted Information Security Assessment Exchange

18%

35 controls mapped

Compare →

+ 420 more: NIST SP 800-171A Rev 3 - Assessing CUI Security Requirements (18%), PAS 1192-5:2015 - Security-Minded Approach to BIM and Digital Built Environments (17%)

See all 423 mapped frameworks ↓

Maps to 423 other frameworks

192 total controls

ISO 27001:2022

130 source controls mapped|78 target controls covered

68%

NIST SP 800-171

40 source controls mapped|38 target controls covered

21%

TISAX - Trusted Information Security Assessment Exchange

35 source controls mapped|19 target controls covered

18%

NIST SP 800-171A Rev 3 - Assessing CUI Security Requirements

34 source controls mapped|18 target controls covered

18%

PAS 1192-5:2015 - Security-Minded Approach to BIM and Digital Built Environments

33 source controls mapped|15 target controls covered

17%

New Zealand Information Security Manual (NZISM)

33 source controls mapped|13 target controls covered

17%

MARS-E - Minimum Acceptable Risk Standards for Exchanges

33 source controls mapped|13 target controls covered

17%

South Korea Cloud Security Assurance Program (CSAP)

33 source controls mapped|14 target controls covered

17%

NRC 10 CFR 73.54 - Nuclear Facility Cybersecurity

33 source controls mapped|13 target controls covered

17%

South Korea ISMS-P

32 source controls mapped|13 target controls covered

17%

NIST SP 800-82 Revision 3: Guide to Industrial Control Systems (ICS) Security

32 source controls mapped|14 target controls covered

17%

CMMC 2.0

32 source controls mapped|32 target controls covered

17%

APRA CPS 234

31 source controls mapped|25 target controls covered

16%

API 1164

31 source controls mapped|22 target controls covered

16%

NIST Privacy Framework 1.0

31 source controls mapped|17 target controls covered

16%

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1

30 source controls mapped|33 target controls covered

16%

Oman National Cybersecurity Framework

30 source controls mapped|10 target controls covered

16%

NIST SP 800-207

29 source controls mapped|32 target controls covered

15%

UK Gambling Commission - Cyber Resilience Requirements

29 source controls mapped|12 target controls covered

15%

BSI IT-Grundschutz

28 source controls mapped|19 target controls covered

15%

Spain ENS

28 source controls mapped|19 target controls covered

15%

Saudi NCA ECC

28 source controls mapped|19 target controls covered

15%

ISO 27017

27 source controls mapped|13 target controls covered

14%

NIST SP 800-144

27 source controls mapped|13 target controls covered

14%

ISO 27018

27 source controls mapped|13 target controls covered

14%

NIST SP 800-145

27 source controls mapped|13 target controls covered

14%

NIST SP 800-190

27 source controls mapped|13 target controls covered

14%

MTCS (Singapore)

27 source controls mapped|13 target controls covered

14%

NIST SP 800-146

27 source controls mapped|13 target controls covered

14%

Azure Security Benchmark

27 source controls mapped|13 target controls covered

14%

AWS Well-Architected Security Pillar

27 source controls mapped|13 target controls covered

14%

TSA Pipeline Security

27 source controls mapped|14 target controls covered

14%

Protective Security Policy Framework (PSPF) Release 2024

27 source controls mapped|22 target controls covered

14%

Telecommunications Sector Security Reforms (TSSR)

27 source controls mapped|14 target controls covered

14%

FBI CJIS Security Policy

26 source controls mapped|11 target controls covered

14%

UK Defence Standard 05-138 - Cyber Security for Defence Suppliers

26 source controls mapped|14 target controls covered

14%

NIST SP 800-171A - Assessing Security Requirements for Controlled Unclassified Information (CUI)

26 source controls mapped|19 target controls covered

14%

Annex 11 to EU GMP - Computerised Systems

25 source controls mapped|9 target controls covered

13%

OWASP DevSecOps Maturity Model (DSOMM)

24 source controls mapped|12 target controls covered

13%

NIST SP 800-172

24 source controls mapped|36 target controls covered

13%

NIS2 Directive Implementing Acts

24 source controls mapped|10 target controls covered

13%

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association)

23 source controls mapped|10 target controls covered

12%

NIST Cybersecurity Framework 2.0

23 source controls mapped|18 target controls covered

12%

OWASP Top 10:2025

23 source controls mapped|9 target controls covered

12%

APRA CPS 230 Operational Risk Management

23 source controls mapped|26 target controls covered

12%

SSAE 18 - Attestation Standards (SOC Reporting)

23 source controls mapped|14 target controls covered

12%

Singapore Government Instruction Manual on ICT&SS Management (IM8)

23 source controls mapped|10 target controls covered

12%

TSA Pipeline Cybersecurity Directives

23 source controls mapped|9 target controls covered

12%

Canada ITSG-33 - IT Security Risk Management

22 source controls mapped|22 target controls covered

11%

NIST SP 800-53A Rev. 5

22 source controls mapped|30 target controls covered

11%

ISO/IEC 27011:2024

22 source controls mapped|13 target controls covered

11%

IAEA Nuclear Security Series - Computer Security at Nuclear Facilities (NSS-17-T Rev 1)

21 source controls mapped|6 target controls covered

11%

FFIEC Cybersecurity Assessment Tool (CAT)

21 source controls mapped|8 target controls covered

11%

SOC for Cybersecurity - Cybersecurity Risk Management Examination

21 source controls mapped|9 target controls covered

11%

NIST SP 800-115 (Technical Guide to Information Security Testing and Assessment)

21 source controls mapped|13 target controls covered

11%

NIST SP 800-61

21 source controls mapped|12 target controls covered

11%

MARS-E

21 source controls mapped|10 target controls covered

11%

NIST SP 800-123

21 source controls mapped|13 target controls covered

11%

NAIC Insurance Data Security Model Law (MDL-668)

21 source controls mapped|13 target controls covered

11%

NIS2 Directive

20 source controls mapped|17 target controls covered

10%

ISO/IEC 27010:2015

20 source controls mapped|8 target controls covered

10%

Security of Critical Infrastructure Act 2018 (SOCI)

20 source controls mapped|10 target controls covered

10%

OWASP MASVS

20 source controls mapped|10 target controls covered

10%

NIST SP 800-66

20 source controls mapped|9 target controls covered

10%

MITRE ATT&CK

20 source controls mapped|12 target controls covered

10%

NIST SP 800-137

20 source controls mapped|13 target controls covered

10%

ISO 27799

20 source controls mapped|9 target controls covered

10%

OWASP ASVS

20 source controls mapped|12 target controls covered

10%

MITRE D3FEND

20 source controls mapped|13 target controls covered

10%

ISO 13485

20 source controls mapped|10 target controls covered

10%

ISO/SAE 21434

20 source controls mapped|12 target controls covered

10%

ISO 27043

20 source controls mapped|13 target controls covered

10%

MDS2 (Medical Device)

20 source controls mapped|9 target controls covered

10%

NIST SP 800-63-4

20 source controls mapped|11 target controls covered

10%

O-RAN WG11 Security Specification

20 source controls mapped|7 target controls covered

10%

UNECE WP.29 R155

20 source controls mapped|11 target controls covered

10%

PTES

20 source controls mapped|12 target controls covered

10%

UK PSTI Act

20 source controls mapped|12 target controls covered

10%

OWASP SAMM

20 source controls mapped|11 target controls covered

10%

SSDF (NIST)

20 source controls mapped|12 target controls covered

10%

SLSA

20 source controls mapped|12 target controls covered

10%

NIST SP 800-88

20 source controls mapped|12 target controls covered

10%

UNECE WP.29 R156

20 source controls mapped|12 target controls covered

10%

SIG (Shared Assessments)

20 source controls mapped|12 target controls covered

10%

NIST SP 800-92

20 source controls mapped|12 target controls covered

10%

OpenSSF Scorecard

20 source controls mapped|14 target controls covered

10%

NIST SP 1800-32

19 source controls mapped|13 target controls covered

10%

IEC 62443

19 source controls mapped|13 target controls covered

10%

ISO 27019

19 source controls mapped|13 target controls covered

10%

RBI Cybersecurity Framework for Banks

19 source controls mapped|10 target controls covered

10%

CISA Zero Trust Maturity Model

18 source controls mapped|24 target controls covered

ISO/IEC 27400:2022

18 source controls mapped|8 target controls covered

Sigstore - Software Artifact Signing and Verification

18 source controls mapped|9 target controls covered

ASD Strategies to Mitigate Cyber Security Incidents

17 source controls mapped|14 target controls covered

3GPP 5G Security Architecture (TS 33.501)

17 source controls mapped|38 target controls covered

CISA Industrial Control Systems (ICS) Security Guidance

17 source controls mapped|16 target controls covered

FTC GLBA Safeguards Rule (16 CFR Part 314)

17 source controls mapped|3 target controls covered

ISO 28001:2007 Supply Chain Security Management

17 source controls mapped|6 target controls covered

NIST SP 800-160

16 source controls mapped|29 target controls covered

NERC CIP

16 source controls mapped|9 target controls covered

Secure by Design: A Guide for Manufacturers (CISA)

16 source controls mapped|8 target controls covered

SWIFT CSCF

16 source controls mapped|10 target controls covered

UK Telecommunications (Security) Act 2021

16 source controls mapped|5 target controls covered

CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0

16 source controls mapped|10 target controls covered

PropTech Security Standards - Smart Building Cybersecurity

15 source controls mapped|6 target controls covered

NIST AI Risk Management Framework (AI RMF 1.0)

15 source controls mapped|10 target controls covered

NIST AI 600-1: Generative AI Profile

15 source controls mapped|10 target controls covered

US Maritime Transportation Security Act (MTSA) and USCG Cybersecurity Requirements

15 source controls mapped|9 target controls covered

UK Security and Emergency Measures Direction (SEMD) - Water Industry

15 source controls mapped|9 target controls covered

Monetary Authority of Singapore Technology Risk Management Guidelines

14 source controls mapped|9 target controls covered

ISO 20000-1

14 source controls mapped|6 target controls covered

FFIEC IT Examination Handbook

14 source controls mapped|9 target controls covered

OWASP API Security Top 10 - 2023

14 source controls mapped|5 target controls covered

PCI P2PE

14 source controls mapped|9 target controls covered

PCI PIN Security

14 source controls mapped|9 target controls covered

SWIFT CSP

14 source controls mapped|9 target controls covered

PCI SSF

14 source controls mapped|9 target controls covered

PSD2 SCA

14 source controls mapped|9 target controls covered

OSFI B-13

14 source controls mapped|9 target controls covered

Open Banking Security

14 source controls mapped|9 target controls covered

SWIFT Customer Security Programme (CSP)

14 source controls mapped|5 target controls covered

ANSSI Cybersecurity Framework

14 source controls mapped|14 target controls covered

SOC 2

14 source controls mapped|8 target controls covered

US Executive Order 14028 - Improving the Nation's Cybersecurity

14 source controls mapped|5 target controls covered

AS9100D:2016 - Quality Management Systems for Aviation, Space, and Defence

13 source controls mapped|7 target controls covered

US NRC 10 CFR 73.54 - Cyber Security for Nuclear Power Plants

13 source controls mapped|6 target controls covered

NIST Privacy Framework Version 1.0

13 source controls mapped|4 target controls covered

NIST SP 800-218

12 source controls mapped|40 target controls covered

NRF Cybersecurity and Data Privacy Framework (National Retail Federation)

12 source controls mapped|6 target controls covered

Mexico LFPDPPP