Put the full NIST 800-53 Rev. 5 control catalogue to work

NIST SP 800-53 Rev. 5 is a catalogue of security and privacy controls published by the US National Institute of Standards and Technology. It organises more than 1,000 controls and control enhancements into 20 families, such as access control, incident response and supply chain risk management. Organisations select and tailor controls from it to protect their systems, operations and individuals' privacy.

US federal agencies must implement NIST SP 800-53 controls for their information systems under FISMA. Contractors, cloud providers seeking FedRAMP authorisation and other government suppliers are often required to follow it through contracts. For everyone else, including UK organisations, it is voluntary, although many adopt it as a thorough, freely available control catalogue.

Rev. 5 made controls outcome-based, so they apply to any organisation rather than only federal agencies. It fully integrated privacy controls into the catalogue, added the Supply Chain Risk Management (SR) and PII Processing and Transparency (PT) families, and moved the control baselines into a separate publication, SP 800-53B. Rev. 4 was withdrawn in September 2021.

NIST SP 800-53 Rev. 5 has 20 control families: Access Control, Awareness and Training, Audit and Accountability, Assessment, Authorization and Monitoring, Configuration Management, Contingency Planning, Identification and Authentication, Incident Response, Maintenance, Media Protection, Physical and Environmental Protection, Planning, Program Management, Personnel Security, PII Processing and Transparency, Risk Assessment, System and Services Acquisition, System and Communications Protection, System and Information Integrity, and Supply Chain Risk Management.

NIST SP 800-53 Rev. 5 is the full catalogue of controls, while SP 800-53B sets out which of those controls to select as a starting point. SP 800-53B defines low, moderate and high security baselines based on system impact, plus a privacy baseline. Federal agencies start from a baseline and tailor it; other organisations can use the baselines or pick controls directly from the catalogue.

NIST 800-53 overlaps heavily with ISO 27001 and SOC 2 but is far more detailed. ISO 27001 is a certifiable management system standard with 93 Annex A controls, and SOC 2 is an attestation report against the AICPA Trust Services Criteria. NIST publishes official mappings between 800-53 and ISO 27001, so much of the evidence for one supports the others.

No, there is no official NIST 800-53 certification. Controls are assessed using the procedures in NIST SP 800-53A. Federal systems receive an authorisation to operate through the NIST Risk Management Framework, and cloud services can obtain FedRAMP authorisation, which is built on 800-53 controls. Private organisations usually rely on independent assessments or audits.

Yes, on request. NIST SP 800-53 Rev. 5 is mapped in OneClickComply's control library and is available on request rather than enabled by default. Once enabled, controls and evidence you already hold for frameworks such as ISO 27001 or SOC 2 count towards it, and automated evidence collection, policy generation and expert audit guidance help you work through the catalogue.