NIST SP 800-53 Rev 5

There is no legal requirement for private sector organizations to adopt 800-53 unless you process federal data, operate federal systems, or pursue FedRAMP authorization. Many private companies adopt it voluntarily as a control baseline because it is the most comprehensive publicly available catalog. Defense contractors subject to DFARS/CMMC will encounter 800-53 controls through NIST SP 800-171, which derives its requirements from 800-53. If you sell to the U.S. government or handle Controlled Unclassified Information (CUI), you will likely need to demonstrate alignment.

Several structural changes. Privacy controls (previously in Appendix J) were integrated into the main catalog as the PT (Personally Identifiable Information Processing and Transparency) family. Supply chain risk management controls previously scattered across SA and related families were consolidated into the new SR family. Control baselines were moved to a separate publication, SP 800-53B. The language shifted from 'federal information systems' to 'systems and organizations' to encourage broader adoption. Rev 5 also introduced outcome-based control language and removed the numbering distinction between security and privacy controls.

Start with SP 800-53B, which defines Low, Moderate, and High baselines. Your system's FIPS 199 categorization determines the starting baseline; for federal systems, this categorization is mandatory. From there, tailor by scoping, compensating, or supplementing controls based on your risk assessment (per SP 800-37 and SP 800-30). Most AWS workloads in federal environments land at Moderate, which has 287 controls and enhancements in SP 800-53B (FedRAMP Moderate adds more). The controls mapped in compliance.tf cover a subset of the automatable technical controls.

No. Compliance.tf enforces the mapped technical controls in the Terraform modules it serves. NIST 800-53 contains over 1,000 controls across 20 families, many of which are procedural, organizational, or require human judgment (for example, PE physical security controls, PS personnel security, AT awareness training). Use compliance.tf for the technical controls it enforces and feed that into your broader POA&M and assessment process. You still need an SSP, risk assessment documentation, and (for federal systems) assessor-led evaluations.

FedRAMP selects controls from 800-53 and adds FedRAMP-specific parameters, requirements, and testing procedures. FedRAMP baselines (Low, Moderate, High) are subsets of the corresponding SP 800-53B baselines with additional controls and stricter parameter values. If you are pursuing FedRAMP authorization, you implement 800-53 controls as specified in the FedRAMP baseline, not the raw SP 800-53B baseline. Beyond control selection, FedRAMP adds continuous monitoring cadences (ConMon), specific POA&M remediation timelines, and mandatory use of FedRAMP-provided templates.