NIST SP 800-53 Rev 5
ActiveCore framework
The National Institute of Standards and Technology (NIST) Special Publication 800-53 Revision 5 provides a comprehensive catalog of security and privacy controls for information systems and organizations. Published by the U.S. Department of Commerce in September 2020, this framework supports risk management processes and compliance with federal legislation including FISMA. It is used by U.S. federal agencies and organizations globally seeking a risk-based approach to security and privacy controls.
| Mandatory? | Mandatory for U.S. federal agencies; voluntary for private sector |
|---|---|
| Who validates? | Authorizing Official; 3PAO for FedRAMP overlays. No self-assessment. |
| Renewal | ATO reauthorization every 3 years (federal) |
| Scope | Federal information systems; also used as private-sector baseline |
| Governing body | The page lists the Joint Task Force as the author., NIST SP 800-53 Rev 5 (Sep 2020). Official source |
Controls by category
191 controls are Mapped to NIST SP 800-53 Rev 5.
AC-16 Security and Privacy Attributes
AC-17 Remote Access
AC-17(1) Monitoring and Control
AC-2 Account Management
AC-2(1) Automated System Account Management
AC-2(12) Account Monitoring for Atypical Usage
AC-2(7) Privileged User Accounts
AC-3 Access Enforcement
AC-3(7) Role-based Access Control
| Control | Status |
|---|---|
| Kubernetes clusters should use Role-Based Access Control (RBAC) | Mapped |
AC-4 Information Flow Enforcement
AC-4(3) Dynamic Information Flow Control
AC-5 Separation of Duties
| Control | Status |
|---|---|
| Azure subscriptions should have more than one owner | Mapped |
AC-6 Least Privilege
| Control | Status |
|---|---|
| Custom RBAC roles should not be used | Mapped |
| Azure subscriptions should limit owners to 3 | Mapped |
AC-6(7) Review of User Privileges
| Control | Status |
|---|---|
| Custom RBAC roles should not be used | Mapped |
| Azure subscriptions should limit owners to 3 | Mapped |
AU-11 Audit Record Retention
AU-12 Audit Record Generation
AU-12(1) System-wide and Time-correlated Audit Trail
AU-6 Audit Record Review, Analysis, and Reporting
AU-6(4) Central Review and Analysis
AU-6(5) Integrated Analysis of Audit Records
CM-6 Configuration Settings
CM-7 Least Functionality
| Control | Status |
|---|---|
| Azure subscriptions should have Microsoft Defender for Servers enabled | Mapped |
CP-6 Alternate Storage Site
CP-6(1) Separation from Primary Site
CP-7 Alternate Processing Site
| Control | Status |
|---|---|
| Virtual machines should have disaster recovery configured | Mapped |
CP-9 System Backup
IA-2 Identification and Authentication (organizational Users)
IA-4 Identifier Management
IA-5 Authenticator Management
IA-5(1) Password-based Authentication
IR-4 Incident Handling
IR-5 Incident Monitoring
IR-6(2) Vulnerabilities Related to Incidents
RA-5 Vulnerability Monitoring and Scanning
SC-12 Cryptographic Key Establishment and Management
SC-28 Protection of Information at Rest
SC-28(1) Cryptographic Protection
SC-3 Security Function Isolation
SC-5 Denial-of-service Protection
SC-7 Boundary Protection
SC-7(3) Access Points
SC-8 Transmission Confidentiality and Integrity
SC-8(1) Cryptographic Protection
SI-16 Memory Protection
SI-2 Flaw Remediation
SI-2(6) Removal of Previous Versions of Software and Firmware
SI-3 Malicious Code Protection
SI-4 System Monitoring
SI-4(12) Automated Organization-generated Alerts
Related frameworks
| Framework | Control overlap | Note |
|---|---|---|
| NIST SP 800-171 Rev 2 | High 93% | |
| FedRAMP High | High 92% | |
| FedRAMP Moderate Baseline Rev 4 | High 68% |
Frequently asked questions
What is NIST SP 800-53 Revision 5?
It is a catalog of security and privacy controls for information systems and organizations. The controls protect organizational operations and assets, individuals, other organizations, and the Nation from threats and risks, and are implemented as part of an organization-wide process to manage risk.
When was SP 800-53 Revision 5 published and what changed recently?
It was published in September 2020, with updates as of December 10, 2020. On August 27, 2025, NIST issued a minor release (Release 5.2.0) that added `SA-15(13)`, `SA-24` and `SI-02(07)` and revised `SI-07(12)`.
How does FedRAMP relate to NIST SP 800-53?
FedRAMP was established to provide a standardized approach for assessing, monitoring, and authorizing cloud computing products and services. It is based on the NIST SP 800-53 standard, augmented by FedRAMP controls and control enhancements.
Which revision of NIST SP 800-53 replaced Revision 4?
Revision 4 of NIST SP 800-53 was withdrawn on 23 September 2021 and superseded by Revision 5.
How does Azure Policy relate to NIST SP 800-53 compliance?
Each control is associated with one or more Azure Policy definitions that may help assess compliance. Compliance in Azure Policy is only a partial view of overall compliance status.