NIST 800-53,explained

What NIST 800-53 is

NIST SP 800-53, now at Revision 5, is a catalogue of hundreds of security and privacy controls maintained by the US National Institute of Standards and Technology. It is used across US federal information systems and by many organisations that want a comprehensive control reference.

It is a control catalogue, not a pass-or-fail certification. The point is to select and implement the right controls for a system, then assess and authorise that system to operate.

Control families

The controls are grouped into families, each covering a domain of security or privacy, such as:

• Access control and identification and authentication.
• Audit and accountability, and system and information integrity.
• Configuration management and risk assessment.
• Contingency planning and incident response.
• System and communications protection.

Baselines and the RMF

A companion publication, 800-53B, defines baselines of controls for low, moderate, and high impact systems. A system is categorised by impact, the matching baseline is selected and tailored, and the system is then assessed and authorised under the NIST Risk Management Framework (RMF).

How it relates to other frameworks

FedRAMP baselines for cloud services are drawn directly from 800-53. The controls also overlap heavily with ISO 27001 and SOC 2, so much of the work is shared. NIST 800-171, used for protecting Controlled Unclassified Information outside federal systems, is a focused derivative.

How to approach it

1. 1Categorise the system by impact level to choose a baseline.
2. 2Tailor the baseline to the system and document the selection.
3. 3Implement the controls and gather evidence.
4. 4Assess the controls and track weaknesses on a plan of action and milestones.
5. 5Reuse overlapping ISO 27001 and SOC 2 work rather than starting again.