Control catalogue
NIST SP 800-53 Rev. 5
A security and privacy control catalogue for turning risk decisions into testable safeguards.
On this page
Purpose, scope and authority
SP 800-53 provides selectable controls and enhancements, not a requirement to implement the entire catalogue. Establish the applicable baseline and tailor it for the system; SP 800-53B addresses baselines and SP 800-53A addresses assessment procedures. The publisher lists release 5.2.0 alongside the Rev. 5 document. Record which catalogue release your programme uses instead of assuming the original PDF contains every later change. [1]
Principles and operating logic [1]
1. Control structure and parameters
Read the control statement, enhancements, discussion and related controls together. Complete organisation-defined assignments and selections. A statement with an unresolved frequency, role or threshold is not an implementable specification. Enhancements add capabilities; they are not automatically required for every system.
2. Functionality and assurance
Ask both whether the mechanism provides the intended protection and how confidently that can be demonstrated. A policy alone does not establish operating effectiveness. Combine documented intent with configuration evidence, observation, testing and review appropriate to the risk.
3. Ownership and inheritance
Distinguish common, system-specific and hybrid controls. Identify who implements, operates and assesses each part. A shared platform may provide infrastructure protection while the application owner remains responsible for access decisions and information handling.
4. Selected control examples
AC-2 addresses account management; AC-6 addresses least privilege; AU-6 addresses audit review and analysis; CM-2 addresses baseline configuration; CP-4 addresses contingency-plan testing; IR-4 addresses incident handling. These are study entry points, not a sufficient baseline or an assertion that every enhancement applies.
The 20 control families [1]
| ID | The 20 control families | Management question |
|---|---|---|
| AC | Access control | Who can access what, and who reviews it? |
| AT | Awareness and training | Can people perform their security responsibilities? |
| AU | Audit and accountability | Can significant activity be reconstructed and reviewed? |
| CA | Assessment, authorisation and monitoring | Who tests controls and accepts remaining risk? |
| CM | Configuration management | What is the approved state and how is drift managed? |
| CP | Contingency planning | Can essential functions recover within their needs? |
| IA | Identification and authentication | How is identity established and verified? |
| IR | Incident response | Who coordinates detection, handling and escalation? |
| MA | Maintenance | How is maintenance, including remote work, controlled? |
| MP | Media protection | How are media handled, transported and sanitised? |
| PE | Physical and environmental protection | How are facilities and supporting utilities protected? |
| PL | Planning | Are the system’s security and privacy arrangements documented? |
| PM | Program management | Who directs resources and organisational oversight? |
| PS | Personnel security | How are access responsibilities managed across employment changes? |
| PT | PII processing and transparency | Why is personal information processed and how are people informed? |
| RA | Risk assessment | Which threats and impacts inform the priorities? |
| SA | System and services acquisition | Are requirements carried through procurement and development? |
| SC | System and communications protection | How are boundaries and communications protected? |
| SI | System and information integrity | How are flaws, malicious activity and integrity issues addressed? |
| SR | Supply-chain risk management | How are supplier and product dependencies assessed? |
Application · editorial recommendations
Our proposed worksheet records control identifier and release, applicability rationale, resolved parameters, implementation owner, inherited components, evidence location, assessment result and remediation date. For a privileged support account, follow its approval, creation, permissions, use, review and removal. Test the lifecycle rather than accepting a screenshot of the account settings as complete assurance.
Evidence for the CISO · proposed review pack
Ask for evidence that corresponds to the control actually selected. A configuration baseline needs an approved state and a way to detect drift; a recovery control needs a test and corrective actions; a logging control needs usable records and a review process. Document exceptions and compensating choices through the organisation’s risk process.
Common mistakes and limits
Do not select every control indiscriminately, equate policy text with implementation, or infer equivalence from a crosswalk to another standard. This study guide covers catalogue structure and all 20 family areas, with selected controls. It is not an exhaustive reproduction of the individual controls and enhancements.
Official sources and reading route
Read these sections in the source: Chapter 2; Chapter 3 control families; official release notes.
Original study commentary, not a reproduction of the full publication. Read the linked source for every individual requirement, control enhancement, condition and exception. Applicability depends on the organisation and its governing obligations.