Skip to Main Content
Main Menu
Search Opener
Search Close
Contact us
Standard

The National Institute of Standards and Technology (NIST) SP 800-53

The NIST SP 800-53 (Security and Privacy Controls for Information Systems and Organizations), is a set of security and privacy controls for federal information systems and organizations to help meet the Federal Information Security Management Act (FISMA) requirements.

Are you subject to NIST SP 800-53?

This framework is intended to serve a diverse audience, including:

  • Individuals with system, information security, privacy, or risk management and oversight responsibilities.

  • Individuals with system development responsibilities.

  • Individuals with logistical or disposition-related responsibilities, including program managers, procurement officials, system integrators, and property managers.

  • Individuals with security and privacy implementation and operations responsibilities.

  • Individuals with security and privacy assessment and monitoring responsibilities.

  • Commercial entities, including industry partners, producing component products and systems, creating security and privacy technologies, or providing services or capabilities that support information security or privacy.

Security and privacy controls under NIST SP 800-53

The NIST 800-53 framework provides a number of different controls and guidance across multiple security and access control families defined under a baseline of impact. These baselines are separated by high impact, medium impact, and low impact.

 

The controls in NIST 800-53 cover various aspects of cybersecurity including:

  • Access control: managing access to information systems and data.
  • Awareness and training: providing awareness and security training to employees, and elevated technical training for more privileged users.
  • Audit and accountability: auditing and maintaining accountability of system activities.
  • Configuration management: managing configuration changes to information systems.
  • Identification and authentication: verifying the identity of users and devices.
  • Individual participation: obtaining consent and authorizing privacy policies and practices.
  • Incident response: detect, respond to, and recover from cybersecurity incidents.
  • Maintenance: maintaining information systems and ensuring their integrity.
  • Media protection: securing and protecting media access, use, storage, and transportation.
  • Personnel security: screening internal and external personnel, setting up termination and transfer security policies.
  • Physical and environmental protection: securing physical access to information systems.
  • Planning: having strategies in place for comprehensive security architecture (such as defense in depth and third-party vendor security).
  • Program management: having defined strategies for risk management, insider threats, and scaling architecture.
  • Risk assessment: scanning vulnerabilities, having ongoing privacy impact, and risk assessments.
  • Security assessment and authorization: penetration testing, and monitoring connections to public networks and external systems.
  • System and services acquisition: implementing security across the system development lifecycle, new vendor contracts, and acquisitions.
  • System and communications protection: partitioning applications, implementing cryptographic key management, and securing passwords and other sensitive data.
  • System and information integrity: implementing system monitoring, alerting systems, and flaw remediation processes.
 
Webinar

Mitigating Third-Party Risk: Best Practices for CISOs

Join us for an insightful and informative webinar as we delve into mitigating third-party risks. This webinar will provide essential strategies and best practices to ensure robust security and privacy measures when collaborating with external entities.

Achieve compliance

FAQs

  • What data does NIST SP 800-53 protect?

    NIST SP 800-53 safeguards information systems against diverse threats, such as cybersecurity incidents, privacy breaches, and malicious attacks.

  • What does NIST SP 800-53 cover?

    NIST 800-53 is a set of guidelines that outlines the controls required to develop secure and resilient federal information systems. These controls comprise operational, technical, and management standards that are vital for maintaining information systems’ confidentiality, integrity, and availability.

  • How can NIST SP 800-53 bridge the gap between stakeholders?

    The NIST comes from a risk-based approach, which executives can relate to. This approach fosters better communication and decision-making throughout your organization, with security budgets better justified and allocated. Adopting this framework develops a common language for business and technical stakeholders, facilitating improved communication from practitioners to the Board and CEO.

  • What is the role of NIST SP 800-53 in compliance and regulation?

    NIST SP 800-53 plays a crucial role in compliance and regulation within various sectors, including government agencies and industries handling sensitive information. Its role includes establishing standards and compliance framework and providing a basis for assessing an organization’s cybersecurity posture during audits and compliance reviews.

Related resources

View all resources

The information provided does not, and is not intended to, constitute legal advice. Instead, all information, content, and materials presented are for general informational purposes only.

Back to Top