NIST SP 800-53 Rev 4
Deprecated
Best for: U.S. federal agencies and contractors that haven't migrated to NIST 800-53 Rev 5. If your ATO still references Rev 4 control baselines, you need to maintain compliance until renewal. FedRAMP packages authorized before the Rev 5 transition may also reference Rev 4 controls. Defense industrial base companies with legacy DFARS 252.204-7012 references sometimes still encounter Rev 4 language in older contract vehicles.
| Mandatory? | Mandatory for U.S. federal agencies (superseded by Rev 5) |
|---|---|
| Who validates? | Authorizing Official; 3PAO for FedRAMP overlays. No self-assessment. |
| Renewal | ATO reauthorization every 3 years (federal) |
| Scope | Federal information systems |
| Governing body | National Institute of Standards and Technology (NIST), U.S. Department of Commerce, NIST SP 800-53 Rev 4 (superseded by Rev 5). Official source |
Get started
Point the module source at the NIST SP 800-53 Rev 4 endpoint and pin a version range you reviewed:
module "..." {
source = "nist80053rev4.compliance.tf/terraform-aws-modules/<module>/aws"
version = "<version>"
}nist80053rev4.compliance.tf lists every NIST SP 800-53 Rev 4 module with its versions, inputs and outputs.
What compliance.tf covers and what you handle
| Area | Compliance.tf automates | You handle |
|---|---|---|
| Audit Trail Integrity and Coverage | Validates CloudTrail configuration: multi-region enablement, S3 data event logging for reads and writes, CloudWatch integration, log file validation, and KMS encryption of trail logs. Covers AU-2, AU-3, AU-6, AU-9, and AU-11 control requirements. | Defining the audit event baseline per AU-2, establishing log review procedures (AU-6 manual review cadence), and documenting incident escalation workflows when anomalous events are detected. |
| Encryption at Rest | Checks KMS CMK encryption on CloudTrail logs and API Gateway stage caches. Validates that ACM certificates are not within 30 days of expiration. | Selecting FIPS 140-2 validated modules where required, defining key rotation schedules, documenting key custodian roles, and maintaining a cryptographic key inventory per SC-12. |
| Network Boundary Protection | Validates that DMS replication instances are not publicly accessible, checking security group and subnet configurations that would expose data processing resources. | Documenting authorized information flow paths per AC-4, maintaining network architecture diagrams, configuring WAF rules, and performing periodic boundary device rule reviews. |
| Secure Configuration Baselines | Detects plaintext sensitive values in CodeBuild environment variables and verifies OAuth is used for source repository connections. Maps to CM-6 and SC-28. | Maintaining an approved configuration baseline document, running a change control board process for CM-3, and conducting periodic configuration deviation scans beyond what Terraform state captures. |
| Availability and Recovery | Confirms Auto Scaling groups attached to load balancers use ELB health checks and that DynamoDB tables have auto scaling enabled. Addresses CP-10 and SI-13. | Developing and testing the full contingency plan (CP-2), conducting annual tabletop exercises (CP-4), and defining Recovery Time Objectives and Recovery Point Objectives for each system. |
Controls by category
53 of 73 mapped controls are Enforced by compliance.tf modules at terraform plan. The other 20 are Mapped only: NIST SP 800-53 Rev 4 lists them, no compliance.tf module checks them.
Access Control (AC)
Publicly accessible DMS instances represent an unauthorized information flow path and will generate AC-4 findings immediately. Auditors examine VPC configurations, public IP assignments, and security group rules to confirm that data processing components aren't exposed without explicit authorization per AC-17 (Remote Access).
| Control | Status |
|---|---|
| DMS replication instances should not be publicly accessible | Enforced |
Audit and Accountability (AU)
CloudTrail must be active across all regions with both read and write event logging to satisfy AU-2 and AU-3. Assessors check for log file validation (AU-9), CloudWatch integration (AU-6), and a retention period that matches organizational policy (AU-11). Missing S3 data event logging is the most common finding in this category: without it, object-level access goes completely unaudited.
Incident Response and Continuous Monitoring (IR/CA)
The first thing an assessor checks here is whether CloudWatch alarms have actual response actions configured, not just thresholds. Alarms with no SNS or Lambda action attached fail CA-7 (Continuous Monitoring) and IR-4 (Incident Handling) outright.
| Control | Status |
|---|---|
| CloudWatch alarms should have an action configured | Enforced |
System and Communications Protection (SC)
SC-28 requires encryption of stored data using FIPS-validated cryptographic modules. Assessors want to see KMS CMK usage rather than default AWS-managed keys, since CMKs produce an auditable key management trail. Expired or expiring ACM certificates draw SC-12 (Cryptographic Key Establishment and Management) findings, and most teams don't catch them until the auditor does.
Additional controls (64)
AWS IAM (2)
AWS KMS (1)
| Control | Status |
|---|---|
| KMS CMK rotation should be enabled | Enforced |
AWS Lambda (2)
| Control | Status |
|---|---|
| Lambda functions should be in a VPC | Enforced |
| Lambda functions should restrict public URL | Enforced |
Amazon CloudWatch Logs (1)
| Control | Status |
|---|---|
| Log groups should have encryption at rest enabled | Enforced |
Amazon DynamoDB (3)
Amazon EBS (1)
| Control | Status |
|---|---|
| Attached EBS volumes should have encryption enabled | Enforced |
Amazon EC2 (4)
| Control | Status |
|---|---|
| EC2 instances should have detailed monitoring enabled | Enforced |
| EC2 instances should be in a VPC | Mapped |
| EC2 instances should not have a public IP address | Enforced |
| EC2 instances should use IMDSv2 | Enforced |
Amazon EFS (2)
| Control | Status |
|---|---|
| EFS file systems should have encryption at rest enabled | Enforced |
| EFS file systems should be encrypted with CMK | Enforced |
Amazon EMR (1)
| Control | Status |
|---|---|
| EMR cluster Kerberos should be enabled | Mapped |
Amazon ElastiCache (1)
Amazon OpenSearch Service (2)
Amazon RDS (14)
Amazon Redshift (4)
Amazon S3 (11)
Amazon SNS (1)
| Control | Status |
|---|---|
| SNS topics should be encrypted at rest | Enforced |
Amazon SageMaker (3)
Amazon VPC (2)
Elastic Load Balancing (6)
Other (3)
Related frameworks
| Framework | Control overlap | Note |
|---|---|---|
| HIPAA Omnibus Rule 2013 | High 97% | |
| NIST Cybersecurity Framework v1.1 | High 96% | |
| FedRAMP Moderate Baseline Rev 4 | High 95% |
Frequently asked questions
NIST 800-53 Rev 5 has been out since 2020. Should I still use Rev 4?
Only if you have an active ATO or contract that explicitly references Rev 4. OMB directed federal agencies to transition to Rev 5, and NIST archived Rev 4 in September 2021. If your ATO is up for renewal, your assessor will likely require Rev 5. For new system authorizations, Rev 4 should not be used. If you are maintaining a legacy ATO, continue using Rev 4 until your renewal date, but plan your migration now.
How do I map my existing Rev 4 controls to Rev 5 during migration?
NIST publishes a Rev 4 to Rev 5 comparison workbook at csrc.nist.gov. Most controls have a direct 1:1 mapping. The main structural changes: Rev 5 integrates privacy controls directly (removing the separate Appendix J), adds the SR (Supply Chain Risk Management) family, and moves the control baselines into SP 800-53B. Budget 2 to 4 months for a moderate-complexity system migration, including SSP rewriting and assessor review.
The controls mapped here cover only a fraction of 800-53. What about the rest?
NIST 800-53 Rev 4 contains over 900 controls and enhancements across 18 families. The controls mapped here focus on AWS infrastructure checks that can be automated through Terraform and Steampipe. Families like PS (Personnel Security), PE (Physical and Environmental Protection), and PL (Planning) require procedural and organizational evidence that infrastructure scanning cannot produce. You need a GRC platform or manual assessment process for those.
Does this framework apply to my organization if we are not a federal agency?
Directly, no. NIST 800-53 is mandatory for federal information systems under FISMA. It applies indirectly if you are a federal contractor processing federal data, a cloud service provider seeking FedRAMP authorization, or a defense contractor subject to DFARS/CMMC. Some private sector organizations voluntarily adopt 800-53 as a comprehensive control catalog even without a federal mandate. State governments occasionally reference it as well.
What is the difference between the low, moderate, and high baselines?
FIPS 199 system categorization determines which baseline applies. Low-impact systems use roughly 125 controls, moderate uses about 325, and high uses approximately 420. The selection depends on the potential impact of a security breach on confidentiality, integrity, and availability. Most federal systems are categorized as moderate. The controls in this compliance.tf mapping span all three baselines, since logging and encryption requirements appear at every impact level, though parameter values (like retention periods) differ.