NIST SP 800-53

NIST Special Publication 800-53 Revision 5 is the foundational US catalog of security and privacy controls for federal information systems, organized into 20 control families (Access Control, Audit and Accountability, Incident Response, and others) that agencies implement based on a system's risk categorization under FIPS 199. It underlies most other major US government security programs — FedRAMP authorizations and FISMA compliance are both built directly on 800-53 controls — and is also widely referenced by private-sector risk frameworks and vendor security questionnaires outside government contracting. Rather than issuing a whole new revision for every change, NIST releases incremental patch updates in place; the current baseline is Release 5.2.0 (August 27, 2025), which added and revised several controls.