Move from NIST 800-53 Rev. 4 to Rev. 5 without starting again
NIST SP 800-53 Rev. 4 is the fourth revision of the US National Institute of Standards and Technology's catalogue of security and privacy controls for federal information systems and organisations, published in April 2013 and updated in January 2015. NIST withdrew it on 23 September 2021, one year after Revision 5 was published, and it is now kept only for historical reference. Its controls sit in 18 security control families plus 8 privacy families in Appendix J.
Is NIST 800-53 Rev. 4 right for your organisation?
No organisation should start a new programme on Rev. 4, because NIST has superseded it with Rev. 5. It still matters to teams running legacy federal systems, older authorisations or contracts written against Rev. 4 baselines, and anyone mapping old Rev. 4 documentation onto Rev. 5 during a transition.
Adopting it is voluntary, though customers and auditors often expect it.
- Issued by
- National Institute of Standards and Technology (NIST)
- Published
- April 2013, updated 22 January 2015
- Status
- Withdrawn on 23 September 2021
- Superseded by
- NIST SP 800-53 Rev. 5 (September 2020)
- Structure
- 18 security control families plus 8 Appendix J privacy families
- Baselines
- Low, moderate and high, defined within the publication itself
- Assessment guide
- SP 800-53A Rev. 4, withdrawn January 2023
- Type
- Standard (voluntary)
- Region
- United States, US
- In OneClickComply
- Supported today
OneClickComply makes it simple
NIST SP 800-53 Rev. 4 is mapped in OneClickComply's control library and available on request, so legacy Rev. 4 control references can be tracked alongside the current Rev. 5 catalogue. Because one set of controls is mapped across frameworks, evidence you collect for Rev. 4 also counts towards Rev. 5, ISO 27001 and other standards, which makes the move to Rev. 5 a gap exercise rather than a rebuild.
Requirements covered
18 security control families (AC to PM) plus 8 privacy control families in Appendix J, organised into low, moderate and high security control baselines.
Manual NIST 800-53 Rev. 4 vs. OneClickComply
- Spreadsheets of Rev. 4 control IDs that no longer match the current catalogue
- Working out by hand which controls were withdrawn, merged or renamed in Rev. 5
- Re-collecting the same evidence for each framework and revision
- Policies and system security plans written for a withdrawn publication
- No clear view of which legacy controls have drifted since the last authorisation
- Rev. 4 references held alongside a maintained, current control set
- Mapped controls that show where Rev. 4 work carries into Rev. 5
- Evidence collected once and reused across every mapped framework
- Policies generated from your environment and ready to update for Rev. 5
- Continuous monitoring that flags control drift as it happens
Everything you need for NIST 800-53 Rev. 4
Rev. 4 control references mapped in the control library, available on request
Control mapping that carries Rev. 4 evidence across to Rev. 5
Automated evidence collection from 13,000+ integrations
AutoComplete policies generated from your real environment
Continuous monitoring with alerts when controls drift
Ask an Auditor guidance for planning your Rev. 5 transition
Three steps to NIST 800-53 Rev. 4 compliance
Connect & scan
Connect your cloud, identity and SaaS tools. OneClickComply checks them against NIST 800-53 Rev. 4 and shows you exactly where you stand.
Fix & generate
OneClickFix remediates technical gaps in one click, and AutoComplete generates NIST 800-53 Rev. 4-aligned policies from your real environment.
Monitor & evidence
Continuous monitoring keeps you compliant, and our in-house audit team is on hand when you need expert guidance.
NIST SP 800-53 Rev. 4 requirements
The 18 security control families and 8 Appendix J privacy control families of Rev. 4, which together contain the individual controls and control enhancements.
| Reference | Requirement |
|---|---|
| AC | Access Control |
| AT | Awareness and Training |
| AU | Audit and Accountability |
| CA | Security Assessment and Authorization |
| CM | Configuration Management |
| CP | Contingency Planning |
| IA | Identification and Authentication |
| IR | Incident Response |
| MA | Maintenance |
| MP | Media Protection |
| PE | Physical and Environmental Protection |
| PL | Planning |
| PS | Personnel Security |
| RA | Risk Assessment |
| SA | System and Services Acquisition |
| SC | System and Communications Protection |
| SI | System and Information Integrity |
| PM | Program Management |
| AP | Authority and Purpose (Appendix J privacy) |
| AR | Accountability, Audit, and Risk Management (Appendix J privacy) |
Always check the official NIST 800-53 Rev. 4 text for the exact wording.
NIST 800-53 Rev. 4 FAQs
What is NIST SP 800-53 Rev. 4?
NIST SP 800-53 Rev. 4 is the 2013 edition of NIST's catalogue of security and privacy controls for US federal information systems and organisations. It groups controls into 18 security families, such as Access Control and Incident Response, plus 8 privacy families in Appendix J, and defines low, moderate and high baselines. It was updated in January 2015 and withdrawn in September 2021.
Is NIST 800-53 Rev. 4 still valid?
No. NIST officially withdrew SP 800-53 Rev. 4 on 23 September 2021, one year after publishing Revision 5, and Rev. 5 supersedes it in its entirety. The Rev. 4 document remains available only for historical reference. Some legacy systems and contracts still cite Rev. 4, but new work and updated authorisations should use Rev. 5.
What is the difference between NIST 800-53 Rev. 4 and Rev. 5?
Rev. 5 makes the controls outcome-based and usable by any organisation rather than only federal systems, integrates privacy controls into the main catalogue instead of a separate Appendix J, and adds Supply Chain Risk Management and PII Processing and Transparency families. Rev. 5 also moves the baselines out into a separate publication, SP 800-53B.
How many control families are in NIST 800-53 Rev. 4?
NIST 800-53 Rev. 4 has 18 security control families: AC, AT, AU, CA, CM, CP, IA, IR, MA, MP, PE, PL, PS, RA, SA, SC, SI and PM. Appendix J adds 8 privacy control families: AP, AR, DI, DM, IP, SE, TR and UL. Rev. 5 restructures these into 20 families that cover both security and privacy.
Who still uses NIST 800-53 Rev. 4?
Rev. 4 mainly survives in legacy US federal systems, older authorisations to operate and contracts or system security plans written before the move to Rev. 5. Programmes built on 800-53, including FedRAMP, have transitioned to Rev. 5 baselines, so organisations still on Rev. 4 are typically planning or partway through that transition.
How do I move from NIST 800-53 Rev. 4 to Rev. 5?
Start by mapping your implemented Rev. 4 controls to their Rev. 5 equivalents, noting controls that were withdrawn, merged into others or newly added. Then close the gaps, particularly in supply chain risk management and privacy, update your policies and system security plan, and reassess against the Rev. 5 baseline that applies to your system.
How does NIST 800-53 Rev. 4 relate to ISO 27001?
Both are catalogues of security controls, but ISO 27001 is a certifiable management system standard, while NIST 800-53 Rev. 4 was a control catalogue for US federal systems with no certification of its own. Many controls overlap, so evidence for one often supports the other. NIST has published mappings between 800-53 and ISO/IEC 27001.
Does OneClickComply support NIST 800-53 Rev. 4?
NIST SP 800-53 Rev. 4 is mapped in OneClickComply's control library and available on request. Because Rev. 4 is withdrawn, we recommend working towards NIST SP 800-53 Rev. 5, and OneClickComply's control mapping lets evidence gathered against legacy Rev. 4 references count towards Rev. 5 and other frameworks you follow.
Related standards
All standards- NIST SP 800-53 Rev. 5Standard · US
- NIST SP 800-171 Rev. 3Standard · US
- NIST SP 800-53B Privacy BaselineStandard · US
- NIST SP 800-171 Rev. 2Standard · US
- NIST SP 800-53B Low BaselineStandard · US
- NIST SP 800-53B Moderate BaselineStandard · US
- NIST SP 800-53B High BaselineStandard · US
- NIST SP 800-172Standard · US
Get NIST 800-53 Rev. 4 ready, not stressed
Automate controls, gather evidence continuously and stay audit-ready, all on one platform.