NIST Special Publication 800-53

NIST Special Publication 800-53 was initially released in February 2005 as "Recommended Security Controls for Federal Information Systems."

NIST Special Publication 800-53 Revision 1 was initially released in December 2006 as "Recommended Security Controls for Federal Information Systems."

NIST Special Publication 800-53 Revision 2 was initially released in December 2007 as "Recommended Security Controls for Federal Information Systems."

The third version of NIST's Special Publication 800-53, "Recommended Security Controls for Federal Information Systems and Organizations," incorporates several recommendations from people who commented on previously published versions, who recommended a reduction in the number of security controls for low-impact systems, a new set of application-level controls and greater discretionary powers for organizations to downgrade controls. Also included in the final draft is language that allows federal agencies to keep their existing security measures if they can demonstrate that the level of security is equivalent to the standards being proposed by NIST.[5] The third version also represents an effort to harmonize security requirements across government communities and between government and non-government systems. In the past, NIST guidance has not applied to government information systems identified as national security systems. The management, operational, and technical controls in SP 800-53 Revision 3 provide a common information security language for all government information systems. The revised security control catalog also includes state-of-the-practice safeguards and countermeasures to address advanced cyber threats and exploits. Significant changes in this revision of the document include

• A simplified, six-step risk management framework;
• Additional security controls and enhancements for advanced cyber threats;
• Recommendations for prioritizing security controls during implementation or deployment;
• Revised security control structure with a new references section;
• Elimination of security requirements from supplemental guidance sections;
• Guidance on using the risk management framework for legacy information systems and for external information system services providers;
• Updates to security control baselines based on current threat information and cyber attacks;
• Organization-level security controls for managing information security programs;
• Guidance on the management of common controls within organizations; and
• Strategy for harmonizing FISMA security standards and guidelines with international security standard ISO/IEC 27001.[6]

As part of the ongoing cyber security partnership among the United States Department of Defense, the intelligence community, and the federal civil agencies, NIST has launched its biennial update to Special Publication 800‐53, "Security and Privacy Controls for Federal Information Systems and Organizations," with an initial public draft released on February 28, 2012. The 2011–12 initiative will include an update of current security controls, control enhancements, supplemental guidance and an update on tailoring and supplementation guidance that form key elements of the control selection process. Key focus areas include, but are not limited to:

• Insider threats;
• Software application security (including web applications);
• Social networking, mobiles devices, and cloud computing;
• Cross domain solutions;
• Advanced persistent threats;
• Supply chain security;

• Privacy.

Revision 4 is broken up into 18 control families,[7] including:

• AC - Access Control
• AU - Audit and Accountability
• AT - Awareness and Training
• CM - Configuration Management
• CP - Contingency Planning
• IA - Identification and Authentication
• IR - Incident Response
• MA - Maintenance
• MP - Media Protection
• PS - Personnel Security
• PE - Physical and Environmental Protection
• PL - Planning
• PM - Program Management
• RA - Risk Assessment
• CA - Security Assessment and Authorization
• SC - System and Communications Protection
• SI - System and Information Integrity
• SA - System and Services Acquisition

Information on these control families and the controls contained within can be found on the NIST website at the following link: https://nvd.nist.gov/800-53/Rev4

NIST SP 800-53 Revision 5 removes the word "federal" to indicate that these regulations may be applied to all organizations, not just federal organizations. The first public draft was published on August 15, 2017. A final draft release was set for publication in December 2018, with the final publication date set for March 2019."[8] Per the NIST Computer Security Resource Center (CSRC),[9] major changes to the publication include:

• Making the security and privacy controls more outcome-based by changing the structure of the controls;
• Fully integrating the privacy controls into the security control catalog creating a consolidated and unified set of controls for systems and organizations;
• Separating the control selection process from the actual controls, thus allowing the controls to be used by different communities of interest including systems engineers, software developers, enterprise architects; and mission/business owners;
• Eliminating the term information system and replacing it with the term system so the controls can be applied to any type of system including, for example, general-purpose systems, cyber-physical systems, industrial/process control systems, and IoT devices;
• De-emphasizing the federal focus of the publication to encourage greater use by nonfederal organizations;
• Promoting integration with different risk management and cyber security approaches and lexicons, including the Cybersecurity Framework;
• Clarifying the relationship between security and privacy to improve the selection of controls necessary to address the full scope of security and privacy risks; and
• Incorporating new, state of the practice controls based on threat intelligence and empirical attack data, including controls to strengthen cybersecurity and privacy governance and accountability.

As of September 2019, Revision 5 is delayed due to a potential disagreement among the Office of Information and Regulatory Affairs (OIRA) and other U.S. agencies.[10]

The final version of Revision 5 was released on September 23, 2020[11] and is available on the NIST website at the following link: https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final

NIST Special Publication 800-53A provides a set of procedures for conducting assessments of security controls and privacy controls employed within federal information systems and organizations. The procedures are customizable and can be easily tailored to provide organizations with the needed flexibility to conduct security control assessments and privacy control assessments that support organizational risk management processes and that are aligned with the stated risk tolerance of the organization. Information on building effective security assessment plans and privacy assessment plans is also provided along with guidance on analyzing assessment results.[12]

NIST Special Publication 800-53A is titled “Guide for Assessing Security Controls in Federal Information Systems and Organizations." This version will describe testing and evaluation procedures for the 17 required control families.[4] These assessment guidelines are designed to enable periodic testing and are used by federal agencies to determine what security controls are necessary to protect organizational operations and assets, individuals, other organizations, and the nation.[3] According to Ron Ross, senior computer scientist and information security researcher at NIST, these guidelines will also allow federal agencies to assess "if mandated controls have been implemented correctly, are operating as intended, and are... meeting the organization's security requirements."

To do this, version A describes assessment methods and procedures for each of the security controls mandated in Special Publication 800-53. These methods and procedures are to be used as guidelines for federal agencies. These guidelines are meant to limit confusion and ensure that agencies interpret and implement the security controls in the same way.[4]

NIST SP 800-53A Revision 4 is Assessing Security and Privacy Controls in Federal Information Systems and Organizations. The Revision number went from Revision 1 to Revision 4 in order to better reflect the NIST Special Publication 800-53 it is meant to be used with.