The Ultimate Guide to NIST SP 800-53

Introduction

As cyber attacks continue to evolve and become more frequent, more sophisticated, and more destructive than ever, having an effective IT and cyber defense mechanism is no longer a matter of choice. CISOs and CIOs need to stay one step ahead and proactively anticipate and mitigate cyber risks. Central to a robust IT and cyber defense mechanism is the control environment of an organization.

National Institute of Standards and Technology (NIST), a non-regulatory US agency, publishes research reports, standards, frameworks, and guidelines to help organizations enhance the security and privacy of their information and information systems. This includes Federal Information Processing Standards (FIPS), Special Publication (SP) 800 series, NIST Cybersecurity Framework (CSF), and more.

NIST SP 800-53 is a comprehensive catalogue of security and privacy controls published by the National Institute of Standards and Technology, mandatory for US federal information systems under FISMA and for FedRAMP cloud authorisation, covering over 1,000 controls across 20 families from access control through supply chain risk management.

In August 2025, NIST published Release 5.2.0 of SP 800-53 in direct response to Executive Order 14306, adding new controls covering secure software patching and supply chain integrity, including three new controls and enhancements across the SA and SI families. The update signals that SP 800-53 is not a static compliance baseline but an actively maintained framework that organisations must monitor for changes affecting their control libraries, assessment procedures, and FedRAMP authorisation documentation.

This article provides a detailed overview of the NIST SP 800-53, including its scope, key requirements and security controls, important measures for achieving compliance, and more.

Key Takeaways

• Developed by the National Institute of Standards and Technology (NIST), NIST SP 800-53 comprises security and privacy controls for the protection of individuals, information systems, and organizations.
• The standard is not mandatory for organizations outside the federal government but can be used by any organization to secure their data and information systems.
• The NIST SP 800-53 Revision 5 security controls are categorized under 20 different areas, including access, awareness and training, audit, contingency planning, risk assessment, supply chain risk management, and others.
• To comply with the standard’s requirements, organizations need to implement a comprehensive approach involving risk assessment, planning, training, monitoring, and continuous improvement.

What is NIST SP 800-53?

NIST SP 800-53 is an information security standard that provides a catalog of security controls for federal information systems and organizations operating under government contracts. It outlines a set of security and privacy controls for organizations to protect their information systems from threats and vulnerabilities.

NIST Special Publication 800-53 Revision 5, Security and Privacy Controls for Information Systems and Organizations, was published in September 2020.

Who is Covered Under NIST SP 800-53?

Who is Covered Under NIST SP 800-53? While NIST SP 800-53 was initially developed for federal agencies, it has become widely adopted by organizations in other sectors as a best practice for cybersecurity. Many organizations use NIST SP 800-53 as a framework for developing their cybersecurity policies and procedures. It has also been incorporated into other security standards and frameworks, such as the NIST Cybersecurity Framework and the ISO 27001 standard.

To secure their information systems and data, it can be helpful to:

• Federal agencies 
• Contractors 

However, as a best practice for cybersecurity, it can also be used by:

• State and local governments
• Non-profit organizations
• Private sector businesses
• Critical infrastructure service

For example, it could be particularly relevant for organizations handling sensitive or confidential information, such as personally identifiable information (PII), financial data, or intellectual property.

What are NIST SP 800-53 Requirements?

While compliance with NIST SP 800-53 is not mandatory for organizations outside the federal government, it has become widely adopted as a best practice for cybersecurity across industries. Organizations that want to demonstrate their commitment to cybersecurity and information security may implement the security controls and guidelines outlined in NIST SP 800-53 as part of their overall cybersecurity strategy. Additionally, compliance with NIST SP 800-53 may be required for organizations that do business with the federal government, either as a prime contractor or a subcontractor. 

The controls cover 18 different areas and offer guidance on implementing and managing the controls, assessing the controls' effectiveness, and developing a risk management strategy that aligns with the organization's business objectives.

The 20 different areas into which the security controls are organized under NIST SP 800-53 Revision 5 are:

• Access Control (AC)

  The AC family comprises security criteria that describe system logging. It involves determining who has access to which assets and reporting features such as account management, system rights, information flow enforcement, and remote access logs to identify when users can access the system and to what degree.

• Awareness and Training (AT)

  These control sets are tailored to your security training and processes, including role-based training, security training records, etc.

• Audit and Accountability (AU) 

  The AU control family includes security measures relevant to an organization's audit capabilities. It comprises audit rules and processes, event logging, audit report generation, and protection of audit information.

• Assessment, Authorization, and Monitoring (CA) 

  The CA family involves assessment, authorization, and monitoring of policy and procedures related to the controls in the CA family implemented in an organization. This includes control assessments, information exchange, plan of action and milestones, authorization, and continuous monitoring.

• Configuration Management (CM) 

  Configuration management controls are customized to an organization's configuration management policy. It includes a baseline configuration as the foundation for future information system upgrades or modifications, impact analyses, access restrictions for change, and configuration management plan.

• Contingency Planning (CP)

  The CP control family comprises controls that are particular to an organization's contingency plan in the case of a cybersecurity disaster. Controls such as contingency plan testing, updates, training, backup, and system reconstitution are included.

• Identification and Authentication (IA) 

  IA controls are particular to an organization's identity and authentication procedures. It involves identifying and authenticating organizational and non-organizational users and managing such systems.

• Incident Response (IR)

  IR controls are tailored to a company's incident response policies and processes. It involves training for incident response, monitoring, testing, and reporting.

• Maintenance (MA)

  The maintenance controls in NIST SP 800-53 Revision 5 outline requirements for maintaining organizational systems and tools.

• Media Protection (MP)

  These are the controls related to media access, marking, storage, transport policies, sanitization, and defined organizational media use.

• Physical and Environmental Protection (PE)

  The Physical and Environmental Protection control family protects against physical hazards to systems, buildings, and supporting infrastructure. These controls include physical access permissions, monitoring, visitor records, emergency shutdown, electricity, lighting, fire protection, and water damage prevention.

• Planning (PL)

  The NIST SP 800-53 control PL family is tailored to an organization's security planning policies and must cover the objective, scope, functions, and responsibilities while providing guidelines relating to management commitment, entity coordination, and organizational compliance.

• Program Management (PM)

  The PM control family specifies who oversees and executes the cybersecurity program. It encompasses, but is not restricted to, a critical infrastructure plan, an information security program plan, milestones, a risk management strategy, and enterprise architecture.

• Personnel Security (PS) 

  This family of controls are focused on ensuring security of the personnel and includes personnel screening, termination, and transfer, access agreements, position descriptions, etc. 

• Personally Identifiable Information Processing and Transparency (PT) 

  PT controls are related to the processing of personally identifiable information and ensuring transparency of the process. This includes controls that establish proper authority, ensure consent prior to collection of information, provide privacy notice to individuals, etc.

• Risk Assessment (RA)

  These controls are associated with an organization's risk assessment policies, threat hunting and vulnerability monitoring and scanning capabilities, criticality analysis, and determining risk response.

• System and Services Acquisition (SA)

  The SA control family is associated with controls safeguarding authorized resources and an organization's system development life cycle. It includes controls for information system documentation, development configuration management, evaluation controls, and developer security testing.

• System and Communications Protection (SC)

  The SC control family is responsible for system and communications security. It covers boundary protection, information-at-rest protection, cryptographic protection, DDoS protection, collaborative computing devices, and other features.

• System and Information Integrity (SI) 

  The SI control family is associated with controls safeguarding systems and information integrity. For example, NIST SI 7 is a control family with defect remediation, malicious code mitigation, information system monitoring, security notifications, software and firmware integrity, and spam protection.

• Supply Chain Risk Management (SR) 

  These are the controls that keep the risks from an organization’s supply chain in check and includes supply chain risk management plan, related controls and processes, provenance, supplier assessments and reviews, supply chain operations security, etc.

20 Control Families Reference

NIST SP 800-53 vs Other NIST Frameworks Comparison

Organisations often encounter multiple NIST publications in the same programme. The table below clarifies how SP 800-53 relates to the other frameworks most commonly referenced alongside it:

How to Achieve NIST SP 800-53 Compliance?

Compliance with NIST SP 800-53 requires a comprehensive approach that involves risk assessment, planning, training, monitoring, and continuous improvement. It requires significant effort and resources but can be critical in protecting an organization's information systems and data from cyber threats. 

Here are some of the key measures for successfully achieving compliance with NIST SP 800-53:

• Security Categorization: 

  Categorizing information systems based on the potential impact of a security breach.

• Risk Assessment: 

  Conducting risk assessments to identify potential security risks, including those from the supply chain, and implementing NIST controls.

• Security Plan: 

  Creating comprehensive security plans to outline the necessary security controls and processes. 

• Security Control Implementation: 

  Implementing necessary security controls and processes outlined in the security plan.

• Continuous Monitoring: 

  Monitoring compliance with NIST controls and conducting regular audits to identify areas for improvement.

• Incident Response: 

  Developing incident response plans that outline how the organization responds to security incidents.

• Contingency Planning: 

  Building contingency plans in case of a disruption to business operations or loss of critical data.

• Security Awareness and Training: 

  Training employees on the importance of cybersecurity and the organization's security policies and procedures.

• Security Assessment: 

  Assessing the effectiveness of security controls and processes to identify areas for improvement.

The baseline selected for a given system determines the minimum set of controls required. The table below outlines the four baselines defined in NIST SP 800-53B:

Implementation Baselines Table

How MetricStream Helps with NIST SP 800-53 Compliance?

MetricStream helps companies comply with many regulations and security standards, including those from the National Institute of Standards and Technology (NIST). MetricStream IT and Cyber Compliance Management enables organizations to leverage the 'test once, comply with many' approach to harmonize mappings across multiple regulations, frameworks, standards. Companies can quickly get their IT compliance program up and running by uploading pre-packaged information such as NIST Cybersecurity Framework and NIST SP 800-53.

To learn more about how MetricStream can help with IT compliance management, request a personalized product demo.