NIST SP 800-53 security and privacy controls for federal information systems

What it is

NIST Special Publication 800-53 Revision 5 is the catalogue of security and privacy controls the US federal government requires its information systems and organizations to select controls from. It is organized into 20 control families, Access Control, Awareness and Training, Audit and Accountability, Assessment, Authorization, and Monitoring, Configuration Management, Contingency Planning, Identification and Authentication, Incident Response, Maintenance, Media Protection, Physical and Environmental Protection, Planning, Program Management, Personnel Security, Personally Identifiable Information Processing and Transparency, Risk Assessment, System and Services Acquisition, System and Communications Protection, System and Information Integrity, and Supply Chain Risk Management. This is Revision 5, published September 2020.

Who it addresses, and how it binds

The catalogue assigns responsibility at the programme level as much as to a single named party: "Federal information security programs are responsible for protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction," and federal privacy programs carry the parallel responsibility for "managing risks to individuals associated with the creation, collection, use, processing, storage, maintenance, dissemination, disclosure, or disposal" of personal information, with the two sharing responsibility where a system processes personal data. Underneath those programmes, individual controls address "the organization" implementing and tailoring them for a given system, and, in the Program Management family alone, the organization as a whole rather than any one system.

"The controls established in this publication are mandatory for federal information systems and organizations," under the Federal Information Security Modernization Act (FISMA) and OMB Circular A-130. Outside the federal government, "state, local, and tribal governments as well as private sector organizations are encouraged to consider using these guidelines, as appropriate," on a voluntary basis. The Authority notice adds that information security standards and guidelines "shall not apply to national security systems without the express approval of the appropriate federal officials exercising policy authority over such systems," so national security systems follow a separate approval path.

The 20 control families, and how a control is laid out

Every control in Chapter Three, "The Controls," is laid out the same way: a control statement, a discussion explaining its intent, a list of related controls elsewhere in the catalogue, numbered control enhancements that build on the base control, and a references list of other publications that bear on it. Every family also opens with its own Policy and Procedures control, AC-1 through SR-1, before the family's substantive controls follow.

Wherever a control needs organization-specific detail, a role, a frequency, a scope, the catalogue leaves it open for the adopting organization to complete rather than fixing it centrally, and the catalogue is explicit that organizations may implement a selected control in whatever manner suits their own mission or business needs, consistent with law, regulation and policy. A number of controls and enhancements are formally withdrawn from the catalogue and folded into another control as revisions retire some identifiers into others, which Chapter Three's own cross-references record individually rather than leaving a reader to guess.

Program Management: controls for the organization, not the system

One family stands apart structurally. The catalogue says plainly that "the program management (PM) controls described in this section are implemented at the organization level and not directed at individual information systems," where every other family's controls apply to a system. This is where the catalogue's federal programme obligations concentrate: an information security programme plan and a privacy programme plan, named leadership roles for each, an organization-wide risk management strategy, a system inventory, an insider threat programme, and a cluster of controls specific to personally identifiable information, accounting for its disclosure, managing its quality, minimizing its use in testing and research, and handling complaints and privacy reporting about it.

How the appendix marks implementation, withdrawal and assurance

A glossary of common terms and an appendix of common abbreviations sit behind the controls themselves, and Appendix C, "Control Summaries," gives every control and enhancement a row in one of 20 tables, one per family. Each row marks how the control is typically realized: "S" for one "typically implemented by an information system through technical means," "O" for one "typically implemented by an organization (i.e., by an individual through nontechnical means)," and "O/S" for one that "can be implemented by an organization, a system, or a combination of the two." The same tables mark a withdrawn control with a "W" and a note recording what it was incorporated into or moved to, and flag some controls and enhancements with a checkmark for assurance, defined in the catalogue as "the measure of confidence that the security and privacy functions, features, practices, policies, procedures, mechanisms, and architecture of organizational systems accurately mediate and enforce established security and privacy policies."

How you are evaluated

Nobody is "NIST SP 800-53 certified." The catalogue names no accredited certification body and describes no certification scheme for an organization; whether a control has been implemented correctly is a question this document hands to its companion publication, SP 800-53A, worked through in practice by the catalogue's own Assessment, Authorization, and Monitoring (CA) family of controls. The glossary defines an assessor as "the individual, group, or organization responsible for conducting a security or privacy control assessment," and a control assessment by "the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security or privacy requirements for the system." The result feeds a decision made inside the same organization that owns the system: an authorizing official, the "official or officials to authorize operation of an information system and to explicitly accept the risk to agency operations," issues an authorization to operate. That decision is not a certificate: no outside body issues it, and it does not transfer to another organization.

A handful of schemes named elsewhere in the catalogue are easy to mistake for an organizational certification and are not one. Where a specific enhancement points to a government-wide approved products list, to the Common Criteria evaluation and validation scheme, or to NIST's own Cryptographic Module and Cryptographic Algorithm Validation Programmes, what gets validated is a product, an algorithm or a cryptographic module, never the organization implementing the catalogue.

Standards it references

NIST SP 800-53 is built to work inside a cluster of companion NIST publications rather than stand alone. The control baselines this catalogue used to hold now live in SP 800-53B; the procedures for assessing whether a selected control is actually implemented and working are in SP 800-53A; and the wider process of categorizing a system, selecting and tailoring its controls, implementing, assessing, and authorizing it is NIST SP 800-37's Risk Management Framework, named here as "an example of a comprehensive risk management process." The catalogue's own footnote observes that "Of the 20 control families in NIST SP 800-53, 17 are aligned with the minimum security requirements in [FIPS 200]." NIST SP 800-30 supplies the risk assessment process several controls draw on, and SP 800-39 the underlying organization, mission and system risk model. The catalogue also names the NIST Cybersecurity Framework (cited here at Version 1.1) and the NIST Privacy Framework as alternative processes an organization can use to select controls from it, and SP 800-160-1's systems engineering guidance as background toward the trustworthy systems its higher-assurance controls assume.

Beyond the NIST series, individual control enhancements point to product- and module-level schemes rather than document-level companions: the Common Criteria evaluation criteria (published as ISO 15408) and NIST's own Cryptographic Module and Cryptographic Algorithm Validation Programmes. None of these validates the organization implementing the catalogue; they validate a product, a module or an algorithm, the same distinction the section above sets out in full.