NIST SP 800-53B Low BaselineSupported in OneClickComply

Implement the NIST 800-53 Low baseline with less manual effort

The NIST SP 800-53B low baseline is the minimum set of 149 security controls and enhancements, drawn from SP 800-53 Rev. 5, for systems categorised as low impact under FIPS 199. It gives a starting point that organisations tailor to their system, covering 18 control families from access control to supply chain risk management.

See the NIST 800-53 Low requirements

NIST 800-53 Low Aligned

Automated Evidence

OneClickFix Enabled

Continuous Monitoring

In-House Audit Team

Who needs NIST 800-53 Low

Is NIST 800-53 Low right for your organisation?

US federal agencies must apply the low baseline to every information system categorised as low impact, where a security failure would have only a limited adverse effect. Contractors and service providers running such systems for agencies usually inherit it through their contracts. Other organisations adopt it as a recognised minimum baseline for lower-risk systems.

It is a legal or regulatory requirement for organisations in scope.

Issued by: National Institute of Standards and Technology (NIST)
Publication: SP 800-53B, Control Baselines for Information Systems and Organizations (October 2020)
Control catalogue: NIST SP 800-53 Rev. 5
Baseline size: 149 controls and enhancements across 18 families
Applies to: Systems categorised as low impact under FIPS 199
Legal basis: FISMA, FIPS 200 and OMB Circular A-130 for federal systems
Assessment route: Control assessment and authorisation to operate by an authorising official
Type: Standard (mandatory)
Region: US
In OneClickComply: Supported today

How we help

OneClickComply makes it simple

OneClickComply maps the 149 low baseline controls to a single control set, so evidence collected for ISO 27001, SOC 2 or other frameworks also counts here. Automated evidence collection, continuous monitoring and AutoComplete policies cover the operational and policy controls, including the 18 family policy and procedures controls. The low baseline is mapped in our control library and available on request.

Requirements covered

149 controls and control enhancements from SP 800-53 Rev. 5 across 18 control families, each family opening with a policy and procedures control (such as AC-1).

Already working towards another framework?

ISO 2700121% of NIST 800-53 Low overlaps
SOC 270% of NIST 800-53 Low overlaps
NIST CSF56% of NIST 800-53 Low overlaps
GDPR18% of NIST 800-53 Low overlaps

Evidence you collect once counts towards every framework it applies to.

Manual NIST 800-53 Low vs. OneClickComply

Manual NIST 800-53 Low

Tracking 149 controls and enhancements across 18 families in spreadsheets
Writing 18 separate policy and procedures documents by hand
Screenshotting account, logging and MFA settings for every assessment
Finding configuration drift only when an assessor asks for evidence
Repeating the same evidence work for ISO 27001, SOC 2 and federal customers

With OneClickComply

One control set tracks every low baseline control with its status and owner
AutoComplete generates family policies from your real environment
Evidence is collected automatically from connected cloud, identity and device tools
Continuous monitoring flags drift as it happens, not at assessment time
Evidence collected once counts towards every mapped framework

Capabilities

Everything you need for NIST 800-53 Low

All 149 low baseline controls mapped to one shared control set

Automated evidence for account management, logging and MFA controls

AutoComplete policies for each family's policy and procedures control

Continuous monitoring with alerts when baseline configurations drift

OneClickFix for supported misconfigurations, logged as evidence

Vendor risk management for supply chain and external service controls

How it works

Three steps to NIST 800-53 Low compliance

Connect & scan

Connect your cloud, identity and SaaS tools. OneClickComply checks them against NIST 800-53 Low and shows you exactly where you stand.

Fix & generate

OneClickFix remediates technical gaps in one click, and AutoComplete generates NIST 800-53 Low-aligned policies from your real environment.

Monitor & evidence

Continuous monitoring keeps you compliant, and our in-house audit team is on hand when you need expert guidance.

Requirements

NIST SP 800-53B Low Baseline requirements

All 149 controls and control enhancements in the NIST SP 800-53B low baseline, with official SP 800-53 Rev. 5 identifiers and titles (enhancements shown under their parent control).

Reference	Requirement
AC-1	Access Control Policy and Procedures
AC-2	Account Management
AC-3	Access Enforcement
AC-7	Unsuccessful Logon Attempts
AC-8	System Use Notification
AC-14	Permitted Actions Without Identification or Authentication
AC-17	Remote Access
AC-18	Wireless Access
AC-19	Access Control for Mobile Devices
AC-20	Use of External Systems
AC-22	Publicly Accessible Content
AT-1	Awareness and Training Policy and Procedures
AT-2	Literacy Training and Awareness
AT-2(2)	Literacy Training and Awareness: Insider Threat
AT-3	Role-based Training
AT-4	Training Records
AU-1	Audit and Accountability Policy and Procedures
AU-2	Event Logging
AU-3	Content of Audit Records
AU-4	Audit Log Storage Capacity
AU-5	Response to Audit Logging Process Failures
AU-6	Audit Record Review, Analysis, and Reporting
AU-8	Time Stamps
AU-9	Protection of Audit Information
AU-11	Audit Record Retention
AU-12	Audit Record Generation
CA-1	Assessment, Authorization, and Monitoring Policy and Procedures
CA-2	Control Assessments
CA-3	Information Exchange
CA-5	Plan of Action and Milestones
CA-6	Authorization
CA-7	Continuous Monitoring
CA-7(4)	Continuous Monitoring: Risk Monitoring
CA-9	Internal System Connections
CM-1	Configuration Management Policy and Procedures
CM-2	Baseline Configuration
CM-4	Impact Analyses
CM-5	Access Restrictions for Change
CM-6	Configuration Settings
CM-7	Least Functionality
CM-8	System Component Inventory
CM-10	Software Usage Restrictions
CM-11	User-installed Software
CP-1	Contingency Planning Policy and Procedures
CP-2	Contingency Plan
CP-3	Contingency Training
CP-4	Contingency Plan Testing
CP-9	System Backup
CP-10	System Recovery and Reconstitution
IA-1	Identification and Authentication Policy and Procedures
IA-2	Identification and Authentication (Organizational Users)
IA-2(1)	Identification and Authentication (Organizational Users): Multi-factor Authentication to Privileged Accounts
IA-2(2)	Identification and Authentication (Organizational Users): Multi-factor Authentication to Non-privileged Accounts
IA-2(8)	Identification and Authentication (Organizational Users): Access to Accounts, Replay Resistant
IA-2(12)	Identification and Authentication (Organizational Users): Acceptance of PIV Credentials
IA-4	Identifier Management
IA-5	Authenticator Management
IA-5(1)	Authenticator Management: Password-based Authentication
IA-6	Authentication Feedback
IA-7	Cryptographic Module Authentication
IA-8	Identification and Authentication (Non-organizational Users)
IA-8(1)	Identification and Authentication (Non-organizational Users): Acceptance of PIV Credentials from Other Agencies
IA-8(2)	Identification and Authentication (Non-organizational Users): Acceptance of External Authenticators
IA-8(4)	Identification and Authentication (Non-organizational Users): Use of Defined Profiles
IA-11	Re-authentication
IR-1	Incident Response Policy and Procedures
IR-2	Incident Response Training
IR-4	Incident Handling
IR-5	Incident Monitoring
IR-6	Incident Reporting
IR-7	Incident Response Assistance
IR-8	Incident Response Plan
MA-1	Maintenance Policy and Procedures
MA-2	Controlled Maintenance
MA-4	Nonlocal Maintenance
MA-5	Maintenance Personnel
MP-1	Media Protection Policy and Procedures
MP-2	Media Access
MP-6	Media Sanitization
MP-7	Media Use
PE-1	Physical and Environmental Protection Policy and Procedures
PE-2	Physical Access Authorizations
PE-3	Physical Access Control
PE-6	Monitoring Physical Access
PE-8	Visitor Access Records
PE-12	Emergency Lighting
PE-13	Fire Protection
PE-14	Environmental Controls
PE-15	Water Damage Protection
PE-16	Delivery and Removal
PL-1	Planning Policy and Procedures
PL-2	System Security and Privacy Plans
PL-4	Rules of Behavior
PL-4(1)	Rules of Behavior: Social Media and External Site/Application Usage Restrictions
PL-10	Baseline Selection
PL-11	Baseline Tailoring
PS-1	Personnel Security Policy and Procedures
PS-2	Position Risk Designation
PS-3	Personnel Screening
PS-4	Personnel Termination
PS-5	Personnel Transfer
PS-6	Access Agreements
PS-7	External Personnel Security
PS-8	Personnel Sanctions
PS-9	Position Descriptions
RA-1	Risk Assessment Policy and Procedures
RA-2	Security Categorization
RA-3	Risk Assessment
RA-3(1)	Risk Assessment: Supply Chain Risk Assessment
RA-5	Vulnerability Monitoring and Scanning
RA-5(2)	Vulnerability Monitoring and Scanning: Update Vulnerabilities to Be Scanned
RA-5(11)	Vulnerability Monitoring and Scanning: Public Disclosure Program
RA-7	Risk Response
SA-1	System and Services Acquisition Policy and Procedures
SA-2	Allocation of Resources
SA-3	System Development Life Cycle
SA-4	Acquisition Process
SA-4(10)	Acquisition Process: Use of Approved PIV Products
SA-5	System Documentation
SA-8	Security and Privacy Engineering Principles
SA-9	External System Services
SA-22	Unsupported System Components
SC-1	System and Communications Protection Policy and Procedures
SC-5	Denial-of-service Protection
SC-7	Boundary Protection
SC-12	Cryptographic Key Establishment and Management
SC-13	Cryptographic Protection
SC-15	Collaborative Computing Devices and Applications
SC-20	Secure Name/Address Resolution Service (Authoritative Source)
SC-21	Secure Name/Address Resolution Service (Recursive or Caching Resolver)
SC-22	Architecture and Provisioning for Name/Address Resolution Service
SC-39	Process Isolation
SI-1	System and Information Integrity Policy and Procedures
SI-2	Flaw Remediation
SI-3	Malicious Code Protection
SI-4	System Monitoring
SI-5	Security Alerts, Advisories, and Directives
SI-12	Information Management and Retention
SR-1	Supply Chain Risk Management Policy and Procedures
SR-2	Supply Chain Risk Management Plan
SR-2(1)	Supply Chain Risk Management Plan: Establish SCRM Team
SR-3	Supply Chain Controls and Processes
SR-5	Acquisition Strategies, Tools, and Methods
SR-8	Notification Agreements
SR-10	Inspection of Systems or Components
SR-11	Component Authenticity
SR-11(1)	Component Authenticity: Anti-counterfeit Training
SR-11(2)	Component Authenticity: Configuration Control for Component Service and Repair
SR-12	Component Disposal

Always check the official NIST 800-53 Low text for the exact wording.

NIST 800-53 Low FAQs

What is the NIST SP 800-53B low baseline?

The low baseline is the set of security controls NIST SP 800-53B selects from the SP 800-53 Rev. 5 catalogue for information systems categorised as low impact. It contains 149 controls and control enhancements across 18 families. Organisations start from this baseline, then tailor it by scoping, adding compensating controls and setting organisation-defined parameters to match the system's actual risk.

Which systems need the 800-53 low baseline?

Systems categorised as low impact under FIPS 199 need the low baseline. A system is low impact when the loss of confidentiality, integrity or availability would have a limited adverse effect on operations, assets or individuals, and every security objective is rated low. If any objective is moderate or high, the system moves to the moderate or high baseline instead.

Is the NIST 800-53 low baseline mandatory?

Yes, for US federal information systems. FIPS 200 and OMB Circular A-130 require federal agencies to select an SP 800-53 control baseline matching each system's impact level, so low-impact federal systems must implement the low baseline. Contractors operating federal systems usually inherit the requirement through their contracts. For private organisations outside federal work, adopting it is voluntary.

How many controls are in the NIST 800-53 low baseline?

The low baseline contains 149 controls and control enhancements according to NIST's published baseline profile for SP 800-53 Rev. 5. They span 18 of the 20 control families, because the Program Management and PII Processing and Transparency families are not allocated to the security baselines. Every family includes its own policy and procedures control, such as AC-1 or IR-1.

How does the low baseline differ from the moderate and high baselines?

The low baseline is the smallest of the three security baselines and is the foundation the others build on. Moderate and high add more controls and many more control enhancements, such as stronger audit, configuration and contingency requirements. Choosing the right one depends on the FIPS 199 categorisation: the highest impact level across confidentiality, integrity and availability decides the baseline.

How does the 800-53 low baseline relate to ISO 27001 and SOC 2?

They overlap heavily. Access control, logging, incident response, risk assessment, configuration management and supplier controls appear in all three, so evidence for ISO 27001 Annex A or SOC 2 often supports low baseline controls too. The differences are purpose and assurance: the low baseline feeds a US federal authorisation decision, while ISO 27001 leads to certification and SOC 2 to an attestation report.

How long does it take to implement the low baseline?

It depends on the system's size, how many controls can be inherited from a cloud provider or common control provider, and how mature existing policies and logging are. There is no fixed timeline. Organisations already aligned with ISO 27001 or SOC 2 can usually reuse much of their existing work, leaving mainly federal-specific items such as PIV acceptance and authorisation documentation.

Does OneClickComply support the NIST 800-53 low baseline?

The NIST SP 800-53B low baseline is mapped in OneClickComply's control library and is available on request. Its 149 controls are linked to the same controls used for other frameworks, so evidence you already collect counts towards it. Contact OneClickComply to enable it for your account. OneClickComply does not grant authorisations; that decision rests with the authorising official.

Related standards

All standards

Get NIST 800-53 Low ready, not stressed

Automate controls, gather evidence continuously and stay audit-ready, all on one platform.