Written and maintained by CASRAI Editorial Board
Last updated
NIST SP 800-53 Rev. 5, titled “Security and Privacy Controls for Information Systems and Organizations,” is a catalog of security and privacy controls published by the U.S. National Institute of Standards and Technology (NIST). It is mandatory for federal information systems and voluntary for everyone else, which is why a research institution usually meets it through a contract, data-use agreement or sponsor requirement rather than by default. Details below are as described on the official NIST pages on 2026-10-29.
What it is and who runs it
SP 800-53 is maintained by NIST and published through its Computer Security Resource Center (CSRC). Revision 5 was published in September 2020, and the CSRC page records the final version with update 1 incorporated on 10 December 2020. NIST describes it as a catalog of security and privacy controls for information systems and organizations, covering threats that range from hostile attacks to privacy risks. The same catalog integrates security and privacy controls rather than treating them as separate documents.
A minor release, Release 5.2.0, was issued on 27 August 2025, and the CSRC page notes it. The publication is presented there as current, not withdrawn. NIST also provides the catalog in machine-readable form (OSCAL content on GitHub) and an online catalog through its Cybersecurity and Privacy Reference Tool (CPRT). As described on the official page on 2026-10-29, those are the places to check the current control text and counts, which is why this guide does not quote a total number of controls.
Who must use it (eligibility)
NIST’s own scope statement draws the line clearly. The controls can be implemented within any organization or system that processes, stores or transmits information. Their use is mandatory for federal information systems in accordance with OMB Circular A-130 and the Federal Information Security Modernization Act (FISMA). The front matter adds that the publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States.
In practice this gives three situations for a university or research organization:
- It operates a federal information system. The mandatory use described above applies.
- A contract, agreement or sponsor terms name it. The obligation comes from that document, not from the publication. See the example clause in the data sharing agreement template guide.
- The institution adopts it voluntarily as a control framework for its own security program.
Rev. 5 also supports requirements of the Privacy Act of 1974, OMB policies and the Federal Information Processing Standards (FIPS). Related requirements for research contracts that handle controlled information are covered separately in CMMC compliance for research institutions and NIST SP 800-171.
What it contains: the 20 control families
Rev. 5 organizes the catalog into 20 families, each identified by a two-character code. The families are listed alphabetically by name. NIST states that this order does not imply any logical progression, level of prioritization or importance.
| ID | Family |
|---|---|
| AC | Access Control |
| AT | Awareness and Training |
| AU | Audit and Accountability |
| CA | Assessment, Authorization, and Monitoring |
| CM | Configuration Management |
| CP | Contingency Planning |
| IA | Identification and Authentication |
| IR | Incident Response |
| MA | Maintenance |
| MP | Media Protection |
| PE | Physical and Environmental Protection |
| PL | Planning |
| PM | Program Management |
| PS | Personnel Security |
| PT | PII Processing and Transparency |
| RA | Risk Assessment |
| SA | System and Services Acquisition |
| SC | System and Communications Protection |
| SI | System and Information Integrity |
| SR | Supply Chain Risk Management |
NIST notes that the Program Management (PM), PII Processing and Transparency (PT) and Supply Chain Risk Management (SR) families address enterprise-level program management, privacy and supply chain risk considerations that have emerged since FIPS 200.
How a control is laid out
Each control has a base control, a discussion, related controls, control enhancements and references. NIST also states that control designations are not re-used when a control is withdrawn, which helps keep citations to control numbers unambiguous.
Baselines: 800-53 is the catalog, 800-53B is the selection
SP 800-53 is the catalog. The baselines live in a companion publication, SP 800-53B. According to its CSRC page, 800-53B defines three security control baselines, one for each system impact level (low-impact, moderate-impact and high-impact), plus a privacy baseline that is applied to systems irrespective of impact level. It also provides tailoring guidance and overlay guidance. 800-53B was finalized on 10 December 2020, and the page states that Release 5.2.0 (27 August 2025) makes no changes to the baselines.
This distinction matters when you read an agreement. A phrase such as “NIST 800-53 moderate baseline” refers to the moderate-impact selection of controls in 800-53B, not to the whole catalog.
Steps to apply it
- Identify why you are applying it. Federal mandate, contract term or voluntary adoption determine who sets the scope.
- Determine the system impact level (low, moderate or high) so the matching baseline from 800-53B can be selected, and add the privacy baseline.
- Tailor the baseline. 800-53B includes tailoring and overlay guidance for adjusting a baseline to the system and organization.
- Implement the selected controls using the control text, discussion and enhancements in 800-53 Rev. 5.
- Record the revision and baseline you used, so later reviewers can cite exactly what was applied.
Typical timeline phases
NIST does not publish a calendar for adopting the catalog, so the phases below are an order of work, not dates.
- Scoping: decide the source of the requirement and the systems in scope.
- Selection and tailoring: choose the baseline and adjust it.
- Implementation: put the selected controls in place across the 20 families that apply.
- Maintenance: track new releases of the publication on the CSRC page.
Common mistakes
- Treating the whole catalog as a checklist. The catalog is a source from which baselines are selected; 800-53B is where the low, moderate and high selections are defined.
- Citing “800-53” without a revision or baseline. A contract that names neither leaves the scope open. Name the revision (Rev. 5) and the baseline (for example, moderate plus privacy).
- Assuming the publication binds every organization. NIST states mandatory use for federal information systems and voluntary use by nongovernmental organizations.
- Reading the family order as a priority list. NIST says the alphabetical order implies no prioritization.
Related programs and publications
| Item | How it relates | Where to read more |
|---|---|---|
| NIST SP 800-53B | Defines the low, moderate and high baselines, the privacy baseline, tailoring and overlays for the 800-53 catalog | NIST CSRC, SP 800-53B |
| NIST SP 800-171 | A separate NIST publication, used in the context of controlled information in research contracts | CASRAI dictionary entry |
| CMMC | A compliance program discussed for research institutions | CMMC guide |
| HIPAA | A separate regulatory topic for health information | HIPAA compliance checklist |
| Cybersecurity basics | Background on the field the controls belong to | What is cybersecurity? |
FAQ
What is NIST 800-53 Rev. 5?
It is NIST’s catalog of security and privacy controls for information systems and organizations, published in September 2020 with update 1 incorporated on 10 December 2020.
Is NIST 800-53 mandatory?
For federal information systems, yes, under OMB Circular A-130 and FISMA. Nongovernmental organizations may use it on a voluntary basis, and a contract may make it binding.
How many control families does Rev. 5 have?
Twenty, from Access Control (AC) to Supply Chain Risk Management (SR), listed in the table above.
Where are the low, moderate and high baselines?
In SP 800-53B, the companion publication, not in SP 800-53 itself.
Is Rev. 5 still current?
As described on the NIST CSRC page on 2026-10-29, yes: it is presented as current, with Release 5.2.0 issued on 27 August 2025.
Sources
- NIST CSRC, SP 800-53 Rev. 5 publication page, checked 2026-10-29.
- NIST SP 800-53 Rev. 5 full text (PDF), DOI 10.6028/NIST.SP.800-53r5, checked 2026-10-29.
- NIST CSRC, SP 800-53B publication page, checked 2026-10-29.
