NIST 800-53, tailored to a baseline you can defend
Twenty control families and the baseline your impact level calls for, adopted as a program with owners and evidence. Tailoring decisions live beside the control they affect, so the reason a control is out is in the system rather than in somebody's sent items.
- A low, moderate or high baseline, tailored and recorded
- Twenty control families, with owners and evidence
- Continuous monitoring, so a lapse shows the week it happens
- Most of the preparation for FedRAMP and FISMA
NIST SP 800-53
Organization-wide · Rev 5 · 184 controls
NIST 800-53 coverage
- Published by
- NIST
- Structure
- 20 control families
- Baselines
- Low, moderate, high (SP 800-53B)
- Sits under
- FedRAMP and FISMA
01
Adopt it, don't rebuild it
Adopt the catalog once and scope it to the system you are authorizing. Controls outside your baseline, and controls you tailor out, carry the decision and its reason rather than quietly disappearing from the count.
02
Evidence with a date on it
Continuous monitoring is the point of Rev. 5, and it is what a dated evidence record gives you: scans, reviews and tests each hold their own frequency, and a lapse is visible the week it happens.
03
What the assessor leaves with
An assessor gets access scoped to this program and its dates. Control status, implementation detail and the evidence behind each control export together, which is the body of a security assessment package.
What you adopt
NIST 800-53, in its own numbering
- ACAccess control
- ATAwareness and training
- AUAudit and accountability
- CAAssessment and monitoring
- CMConfiguration management
- CPContingency planning
- IAIdentification and authentication
- IRIncident response
- MAMaintenance
- MPMedia protection
- PEPhysical and environmental
- PLPlanning
- PMProgram management
- PSPersonnel security
- PTPII processing and transparency
- RARisk assessment
- SAAcquisition
- SCSystem and communications protection
- SISystem and information integrity
- SRSupply chain risk management
Twenty families. Your baseline decides which controls inside them apply, and every tailoring decision is recorded against the control it affects.
What you show
What an assessor will ask to see
Account management and access enforcement
The AC family. Accounts provisioned, reviewed and disabled, with least privilege you can show rather than assert.
Audit records
The AU family. What is logged, where it goes, how long it is kept, and who reviews it.
Baseline configuration and change control
The CM family. A known-good configuration, and changes assessed against it before they land.
Incident response, exercised
The IR family. A plan, a trained team, and a test that produced findings somebody closed.
Contingency planning
The CP family. Backups taken, and (the part that fails assessments) restores actually performed and recorded.
Supply chain risk management
The SR family, new in Rev. 5. Suppliers assessed, with the criticality of what they touch attached.
How it runs
Step 1
Adopt NIST 800-53
Your organization gets its own copy of every control in NIST 800-53, already mapped to the common controls you may satisfy for something else.
Step 2
Scope it
Organization-wide, or against a product, region or business line. Controls you scope out carry the reason you scoped them out.
Step 3
Collect the evidence
Connect a system or upload a document. Each piece is read, matched to the control it proves, dated, and given an expiry.
Step 4
Prove it
Invite your assessor to these frameworks and these dates, and nothing else. They leave with control status, implementation detail and evidence, together.
The standard
What NIST 800-53 asks for
SP 800-53 is NIST's catalog of security and privacy controls for federal information systems, and the reference most of US public-sector compliance is built on top of. Revision 5 dropped the federal-only framing, so plenty of private organizations now use it as a control catalog in its own right.
The controls sit in twenty families: access control, audit and accountability, configuration management, incident response, contingency planning, supply chain risk management and the rest. You are not expected to implement all of them: SP 800-53B defines low, moderate and high baselines, and you tailor from whichever one your impact level calls for.
If what you are actually chasing is FedRAMP or FISMA, this is the catalog underneath both. The control text does not change; what changes is which baseline you are held to, who authorizes the result, and how much of the evidence has to be independently assessed.
Questions
- Is NIST 800-53 the same as FedRAMP?
- No. FedRAMP is an authorization programme for cloud services and it uses 800-53 as its control catalog, with its own baselines and its own assessment process on top. Running 800-53 well is most of the preparation for FedRAMP; it is not the authorization.
- Which baseline should we start from?
- The one your impact level calls for: low, moderate or high under SP 800-53B, derived from what happens if the system's confidentiality, integrity or availability is lost. Moderate is where most cloud services land. Start there and tailor, recording each decision as you go.
- Does this overlap with NIST 800-171 or ISO 27001?
- Heavily, in both directions. 800-171 is a subset shaped for controlled unclassified information held by contractors, and ISO 27001's Annex A covers much of the same ground in different language. Common controls are how the same evidence counts in all three without being filed three times.
Provable today, not at audit time.
Run it yourself or have Bindsec run it for you. Either way, the evidence is current and the posture is one place.