Skip to content

Framework

NIST SP 800-53, the federal control catalogue

Reviewed 6 October 2026

NIST 800-53

NIST Special Publication 800-53 is a catalogue of security and privacy controls published by the US National Institute of Standards and Technology. Revision 5 contains over a thousand controls across twenty families. Controls are applied through baselines - low, moderate or high - selected according to the impact level of the system being protected.

Definition

What is NIST 800-53?

NIST 800-53 is a catalogue, not a standard to be certified against. It is used by selecting a baseline appropriate to the system's impact level, then tailoring it: adding controls, removing ones that do not apply, and documenting the justification for each decision. The tailoring record is as important as the control selection.

It is mandatory for US federal information systems under FISMA, and applies to contractors through FedRAMP for cloud services and through contract clauses for others. Outside that context it is voluntary, and it is used by organisations that want a control catalogue more detailed than ISO 27001's Annex A.

NIST 800-53 is frequently confused with the NIST Cybersecurity Framework. They do different jobs. The CSF is a high-level framework of outcomes organised into functions - Govern, Identify, Protect, Detect, Respond, Recover - useful for board conversations and maturity assessment. NIST 800-53 is the detailed control catalogue underneath, and CSF outcomes map onto specific 800-53 controls.

Who NIST 800-53 applies to

  • UK organisations selling cloud services into US federal agencies, where FedRAMP authorisation is built on NIST 800-53 baselines.
  • Suppliers with contract clauses requiring NIST 800-53 alignment, common in defence and aerospace supply chains.
  • Organisations wanting a more granular control catalogue than ISO 27001 Annex A provides.
  • Security teams using the NIST Cybersecurity Framework who need the control detail beneath the outcomes.

The path

How long does NIST 800-53 actually take?

Realistic elapsed durations for an organisation starting without a dedicated compliance function. Elapsed time, not effort - the two are routinely confused when this gets scoped.

  1. 012-3 weeks

    Categorise the system

    Establish the impact level - low, moderate or high - against confidentiality, integrity and availability, following FIPS 199. Categorisation determines which baseline applies, and getting it wrong at the start makes every subsequent decision wrong too.

  2. 024-6 weeks

    Select and tailor the baseline

    Apply the baseline for the impact level, then tailor: add controls for specific risks, remove ones that genuinely do not apply, and document every decision with its justification. An untailored baseline applied literally produces enormous unnecessary work.

  3. 033-8 months

    Implement and document

    Implement the selected controls and write the System Security Plan, describing how each control is met. The SSP is the primary artefact an assessor works from, and its quality determines how the assessment goes more than the controls themselves.

  4. 042-4 months

    Assess and authorise

    An independent assessment produces a Security Assessment Report, gaps go into a Plan of Action and Milestones, and an authorising official grants an Authority to Operate. Continuous monitoring then runs indefinitely.

Cost and internal effort figures are being confirmed with the practice before publication: cost and effort figures · Q15

Failure points

Where NIST 800-53 programmes usually go wrong

Not the theory. The specific things that cause a delayed audit, a major non-conformity, or a certificate that does not survive its first surveillance visit.

Applying the baseline without tailoring

The moderate baseline contains hundreds of controls, many irrelevant to any given system. Implementing all of them literally is the most expensive possible route and produces controls nobody maintains. Tailoring is part of the method, not a shortcut.

Categorising the system too high

Impact level drives the baseline, and each step up adds substantial cost. Categorising as high because it feels prudent, without the FIPS 199 analysis to support it, commits the organisation to controls it never needed.

A System Security Plan that restates the control

Assessors read the SSP to understand how each control is actually met. An SSP that paraphrases the control text back tells them nothing and guarantees a long assessment with many findings. It has to describe the specific implementation.

Confusing NIST 800-53 with the Cybersecurity Framework

Organisations agree to NIST alignment in a contract without establishing which NIST publication is meant. CSF alignment is a maturity conversation; 800-53 at moderate baseline is a multi-month control implementation programme. Clarify before signing.

Inherited controls not evidenced

Controls inherited from a cloud provider still need documenting, including what the provider covers and what remains the customer's responsibility. Assuming the provider handles it, without the shared responsibility boundary written down, produces findings at assessment.

How we run it

NIST 800-53, delivered in sprints

  • 01System categorisation done properly against FIPS 199, because every downstream cost follows from it.
  • 02Baseline tailored deliberately with each addition and removal justified in writing, rather than applied wholesale.
  • 03The System Security Plan written to describe real implementations, which is what determines how the assessment goes.
  • 04The shared responsibility boundary with your cloud provider documented explicitly, so inherited controls are evidenced.
  • 05Gaps delivered as a prioritised backlog with owners, not as a control matrix with red cells.
  • 06Mapped against ISO 27001 where you hold it, so existing evidence is reused instead of regenerated.

Choosing between them

NIST 800-53 or ISO 27001?

NIST 800-53 is a control catalogue of over a thousand controls, applied through impact-based baselines and tailored to the system. ISO 27001 is a management system standard with 93 Annex A controls selected on the basis of risk assessment. NIST 800-53 is far more granular and is mandatory in US federal contexts; ISO 27001 is certifiable, internationally recognised, and what commercial buyers actually ask for. For a UK organisation with no US federal exposure, ISO 27001 is almost always the right choice. Where both are needed, ISO 27001 provides the management system and NIST 800-53 provides the control depth, and the evidence overlaps substantially.

ISO 27001

FAQ

NIST 800-53: questions people actually ask

What is the difference between NIST 800-53 and the NIST Cybersecurity Framework?

The NIST Cybersecurity Framework is a high-level set of outcomes organised into six functions - Govern, Identify, Protect, Detect, Respond and Recover - designed for assessing and communicating security posture. NIST SP 800-53 is the detailed control catalogue, with over a thousand controls across twenty families. CSF outcomes map to specific 800-53 controls. CSF is for the board conversation; 800-53 is for the implementation.

Can you be certified against NIST 800-53?

Not in the sense of an accredited certificate. US federal systems go through assessment and authorisation, resulting in an Authority to Operate granted by an authorising official, and cloud services can achieve FedRAMP authorisation which is built on 800-53 baselines. Neither is a certification available to a commercial organisation the way ISO 27001 is. Outside those contexts, organisations demonstrate alignment rather than certification.

Does a UK organisation need NIST 800-53?

Usually not. It is mandatory for US federal information systems and reaches contractors through FedRAMP and contract clauses. A UK organisation with no US federal exposure will find ISO 27001 more appropriate, more recognised by its buyers, and considerably less work. The exception is defence and aerospace supply chains, where NIST alignment appears in contracts regularly.

What are the NIST 800-53 baselines?

Three baselines - low, moderate and high - correspond to the potential impact of a loss of confidentiality, integrity or availability, categorised under FIPS 199. Low applies where impact would be limited, moderate where it would be serious, high where it would be severe or catastrophic. The baseline determines which controls apply before tailoring, and moderate is by far the most common in practice.

Related

ISO 27001ISO 42001SOC 2NIST AI RMFCyber EssentialsPCI DSSGDPR

Start

Three ways in, depending on how close the deadline is.

Or just email a human: hello@cloudgap.ai

We reply within24 hours