What is NIST SP 800-53?
NIST SP 800-53 is the catalogue of security and privacy controls published by the US NIST (National Institute of Standards and Technology), from which organisations select a risk-appropriate set of measures to protect information and control systems. The current version is Revision 5, Security and Privacy Controls for Information Systems and Organizations, published on 23 September 2020. The catalogue contains 20 control families with more than 1,000 controls and control enhancements, ranging from access control to supplier risk.
Although originally developed for US federal government IT, NIST SP 800-53 is increasingly applied in OT environments for structured risk management and compliance, usually through the OT overlay in NIST SP 800-82.
🧠 How is NIST SP 800-53 structured?
The catalogue is divided into 20 control families, each with a two-letter code. Every control has a number within its family (for example AC-2 Account Management), and strengthening additions are called control enhancements, such as AC-2(1) for automated account management.
| Code | Family | Example control |
|---|---|---|
| AC | Access Control | AC-2 account management, AC-17 remote access |
| AT | Awareness and Training | AT-2 awareness training |
| AU | Audit and Accountability | AU-2 event logging, AU-6 review of logs |
| CA | Assessment, Authorization, and Monitoring | CA-7 continuous monitoring |
| CM | Configuration Management | CM-7 least functionality, CM-8 system component inventory |
| CP | Contingency Planning | CP-9 system backup |
| IA | Identification and Authentication | IA-2 user identification, with MFA as an enhancement |
| IR | Incident Response | IR-4 incident handling |
| MA | Maintenance | MA-4 nonlocal maintenance |
| MP | Media Protection | MP-7 use of removable media |
| PE | Physical and Environmental Protection | PE-3 physical access control |
| PL | Planning | PL-2 security and privacy plans |
| PM | Program Management | PM-5 organisation-wide system inventory |
| PS | Personnel Security | PS-3 personnel screening |
| PT | PII Processing and Transparency | PT-2 authority to process personal data |
| RA | Risk Assessment | RA-3 risk assessment, RA-5 vulnerability scanning |
| SA | System and Services Acquisition | SA-8 security and privacy engineering principles |
| SC | System and Communications Protection | SC-7 boundary protection, SC-8 transmission encryption |
| SI | System and Information Integrity | SI-2 flaw remediation, SI-4 system monitoring |
| SR | Supply Chain Risk Management | SR-3 supply chain controls and processes |
A control in Revision 5 consists of fixed parts:
- Control statement - the actual requirement, often with organization-defined parameters such as “[Assignment: organization-defined frequency]” that you fill in yourself
- Discussion - explanation of purpose and application
- Related controls - references to associated controls
- Control enhancements - optional strengthening for higher risks
- References - underlying laws, standards and guidelines
In release 5.2.0 the catalogue contains 300 active base controls and 714 active enhancements; 182 older controls have been withdrawn and point to their successors.
🕰️ How has NIST SP 800-53 evolved?
| Version | Date | Main change |
|---|---|---|
| Original | February 2005 | First catalogue for federal systems under FISMA |
| Rev. 1 | December 2006 | Updated controls and baselines |
| Rev. 2 | December 2007 | Appendix with supplemental guidance for industrial control systems |
| Rev. 3 | August 2009 | One unified catalogue for civil, defence and intelligence systems |
| Rev. 4 | April 2013 | Privacy controls added as a separate appendix; withdrawn on 23 September 2021 |
| Rev. 5 | September 2020 | Integrated security and privacy catalogue, new PT and SR families, baselines moved to SP 800-53B |
| Release 5.2.0 | August 2025 | New controls and enhancements for secure software updates, such as SA-24 and SI-2(7) |
Revision 5 made the controls outcome-based: the control statement no longer names “the information system” as the actor, so the same requirement applies to an organisation, a cloud environment or a PLC. The word Federal was dropped from the title to make clear that the catalogue is usable by any organisation. Release 5.2.0 of 27 August 2025 added, among others, SA-15(13) (Logging Syntax), SA-24 (Design for Cyber Resiliency) and SI-2(7) (Root Cause Analysis), aimed at reliable software updating and patching. The SP 800-53B baselines were left unchanged.
🧱 What are the baselines in SP 800-53B?
Nobody implements all 1,000+ controls. You start with a baseline: a predefined set of controls matching the impact level of your system. Since Revision 5 the baselines have been in a separate publication, NIST SP 800-53B (October 2020). The impact level (low, moderate or high) follows from categorisation under FIPS 199: what is the impact on confidentiality, integrity and availability if the system fails?
| Baseline | Number of controls + enhancements | Use |
|---|---|---|
| Low | 149 | Limited impact from an outage or breach |
| Moderate | 287 | Serious impact on operations, assets or individuals |
| High | 370 | Severe or catastrophic impact, as in critical infrastructure |
| Privacy | 96 | Systems that process personal data, regardless of impact level |
After selection comes tailoring: you remove controls that do not apply, add measures for specific threats and replace controls that are technically infeasible with compensating controls. An overlay is a ready-made tailoring for a particular domain. The best-known one for OT is the overlay in Appendix F of NIST SP 800-82 Rev. 3.
🏭 How do you apply NIST SP 800-53 in OT networks?
In OT, some IT controls clash with the availability and safety of the process. Locking an account after an organisation-defined number of failed logon attempts (AC-7), for example three, makes sense on an office laptop, but is dangerous on an operator station during an upset. Antivirus software (SI-3) cannot be installed on many controllers. The OT overlay therefore states for each control whether and how it applies in OT. Typical applications:
- AC and IA - access control for SCADA, PLCs and engineering stations, with least privilege and MFA for remote access
- AU - Audit logging on OT switches, firewalls and HMIs, collected centrally in a SIEM
- CM and SI - patch management and vulnerability management for legacy OT assets, with tested roll-out during maintenance windows
- IR - Incident Response in line with established procedures, optionally supported by SOAR
- PE - physical access control to server rooms, field cabinets and I/O cabinets
- SC - protection of communication channels with network segmentation, firewalls, encryption and a data diode
Step-by-step approach for an OT installation
- Inventory the OT systems and their functions (CM-8, PM-5).
- Categorise each system by impact on process, safety and environment; select the baseline.
- Tailor with the OT overlay from NIST SP 800-82 and document compensating controls.
- Implement the controls in phases, starting with segmentation, access and backups.
- Assess effectiveness with the procedures in NIST SP 800-53A Rev. 5 (January 2022).
- Monitor continuously (CA-7) and repeat the risk assessment after changes.
In practice the tailored set of controls also serves as a checklist for OT audits: for each control you record whether it is implemented, compensated or deliberately not applicable. These steps follow the Risk Management Framework from NIST SP 800-37; the risk assessment itself is described in NIST SP 800-30.
🔍 What is the difference between SP 800-53, NIST CSF and IEC 62443?
| Characteristic | SP 800-53 | NIST CSF | IEC 62443 |
|---|---|---|---|
| Type | Catalogue of controls | High-level framework | Series of standards for OT security |
| Applicability | IT + OT (OT via overlay) | IT + OT | OT-specific |
| Mandatory for | US federal systems (FISMA) | Nobody; voluntary | Nobody; often required by contract |
| Level of detail | Highly detailed | Strategic, six functions | Requirements per role, zone and security level |
| Certifiable | No; assessable via SP 800-53A | No | Yes, including for components and processes |
The NIST CSF points to SP 800-53 through its informative references, and NIST also publishes a mapping between SP 800-53 and ISO 27001. In practice you use the CSF for the what, IEC 62443 for OT-specific requirements and SP 800-53 as a detailed library of controls.
🔐 When is NIST SP 800-53 mandatory and how do you use it in Europe?
- Mandatory for US federal information systems under FISMA, via FIPS 200
- Derived: cloud providers serving the US government (FedRAMP) use its baselines; NIST SP 800-171, for non-federal organisations such as defence contractors that handle controlled unclassified information (CUI), is derived from SP 800-53
- Voluntary in Europe: NIS2 and the Dutch Cybersecurity Act (Cyberbeveiligingswet, in force since 15 August 2026) do not prescribe SP 800-53, but the catalogue helps make the duty of care concrete
- Complementary to ISO 27001, ISO 27002 and the BIO: SP 800-53 goes into more detail on topics such as the supply chain (SR) and system development (SA)
- Combinable with SIEM, SOAR, MFA and Zero Trust architectures, and with the OT guidance in NIST SP 800-82 for ICS
NIST also provides the catalogue as machine-readable OSCAL files (JSON, XML and YAML). This lets you load controls into GRC tools automatically or track compliance continuously.
❓ Frequently asked questions
How many controls does NIST SP 800-53 have?
NIST SP 800-53 Rev. 5 (release 5.2.0) contains 300 active base controls and 714 active control enhancements, spread across 20 families. No organisation implements all of them; through the baselines in SP 800-53B you select 149 (low), 287 (moderate) or 370 (high) controls and enhancements.
Is NIST SP 800-53 mandatory in the Netherlands or the EU?
No, NIST SP 800-53 is not legally required in the Netherlands or the EU. NIS2 and the Dutch Cyberbeveiligingswet require appropriate measures without prescribing a specific catalogue, and NIST SP 800-53 is a useful source for making those measures concrete.
What is the difference between NIST SP 800-53 and ISO 27001?
ISO 27001 describes a certifiable management system for information security with a concise list of controls in Annex A. NIST SP 800-53 is a far more detailed, non-certifiable catalogue of more than 1,000 controls and enhancements, with baselines per impact level.
What is the difference between NIST SP 800-53 and NIST SP 800-82?
NIST SP 800-53 is the general catalogue of security and privacy controls. NIST SP 800-82 is NIST’s OT security guide, and its Appendix F contains an overlay that explains how to adapt the NIST SP 800-53 baselines for industrial and other OT systems.
What is a control enhancement in NIST SP 800-53?
A control enhancement in NIST SP 800-53 is an optional strengthening of a base control, written in parentheses, such as IA-2(1) for multi-factor authentication on privileged accounts. Higher baselines include more enhancements, because systems with a higher impact need stronger measures.
What is OSCAL in relation to NIST SP 800-53?
OSCAL (Open Security Controls Assessment Language) is the machine-readable format in which NIST publishes the NIST SP 800-53 catalogue and its baselines. With OSCAL you can exchange controls, system security plans and assessment results automatically between tools.
📌 In summary
NIST SP 800-53 is NIST’s detailed, risk-based catalogue of more than 1,000 security and privacy controls, from which you select an appropriate set of measures through baselines and tailoring. Revision 5 (2020) made the catalogue outcome-based and usable by any organisation. In OT you apply it through the overlay in NIST SP 800-82, and in Europe it supports the implementation of NIS2 and cybersecurity policy alongside ISO 27001 and IEC 62443.