NIST SP 800-53 · Security and privacy controls
NIST SP 800-53 compliance and requirements, with controls an assessor can test and trust.
SP 800-53 is the control catalogue behind US federal systems, FedRAMP cloud authorisations and many government contracts. Sterling's expert and experienced consultants tailor the right baseline with you, put the controls into daily operation and assemble the evidence an independent assessor will test. There is no certificate, only controls that hold up. We help our clients put it into practice and prove it.
- Fixed scope, one proposal: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard, in one proposal
- A team of expert and experienced cybersecurity consultants, advising on security and privacy controls across sectors and countries since 2003
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling does not certify or authorise; an independent assessor tests the controls and the responsible authority decides
8,100+ client engagements in 60+ countries.
NIST SP 800-53 client experience
What it is
What is NIST SP 800-53 and what is it used for?
NIST Special Publication 800-53 is the security and privacy control catalogue published by the US National Institute of Standards and Technology. Each control states a safeguard, and optional enhancements add capability or strength. Organisation-defined parameters let the same control fit a small office or a national cloud platform.
The catalogue does not tell you which controls to use. That choice comes from SP 800-53B, which sets three security baselines for low, moderate and high impact systems and a privacy baseline that applies whatever the impact level. SP 800-53A supplies the assessment procedures. All three sit inside the NIST Risk Management Framework: Prepare, Categorize, Select, Implement, Assess, Authorize and Monitor.
Current edition. Revision 5, first published in September 2020. NIST issued Release 5.2.0 on 27 August 2025 on software updates, developer testing and resiliency by design, with no change to the baselines. Confirm the release your agency, programme or contract names before you plan.
Who it is for
Who needs NIST SP 800-53 compliance?
NIST states that the controls are mandatory for federal information systems under OMB Circular A-130 and the Federal Information Security Modernization Act, and it defines a federal system to include one operated by a contractor on an agency's behalf. Other organisations are encouraged to use them as appropriate. The request usually arrives in one of four ways:
- A US agency customer or prime contractor writes it into the contract. The clause usually names the baseline and who assesses.
- A cloud service is heading for FedRAMP. FedRAMP's Rev. 5 baselines correspond to SP 800-53 Revision 5, so the control work starts here.
- A regulator, insurer or enterprise buyer asks for a recognised control set.
- A parent company has standardised on NIST. Subsidiaries are asked to show the same controls.
Requirements
What are the main NIST SP 800-53 requirements?
Revision 5 organises its controls into 20 families, listed below at family level. Your real requirements are the controls in your tailored baseline; assessment is against SP 800-53 itself, not this summary.
- AC Access Control, IA Identification and Authentication: who and what may reach a system, and how identity is proven.
- AT Awareness and Training, PS Personnel Security: preparing and vetting the people who use the system.
- AU Audit and Accountability: the events logged, how records are protected and how they are reviewed.
- CA Assessment, Authorization, and Monitoring, PL Planning, PM Program Management, RA Risk Assessment: plans, risk decisions, assessments and the wider programme.
- CM Configuration Management, MA Maintenance, SA System and Services Acquisition: change control, upkeep and secure acquisition.
- CP Contingency Planning, IR Incident Response: keeping services running and handling incidents when they happen.
- MP Media Protection, PE Physical and Environmental Protection: protecting media, facilities and the equipment inside them.
- SC System and Communications Protection, SI System and Information Integrity: boundaries, encryption, flaw remediation and monitoring for malicious activity.
- PT PII Processing and Transparency: the privacy controls for processing personal information.
- SR Supply Chain Risk Management: risks arriving through suppliers, components and services.
What does useful NIST SP 800-53 evidence look like?
A system security and privacy plan that states how each selected control is implemented, with every parameter value filled in; the categorisation decision behind the baseline; policies and procedures per family; and operating records such as access reviews, log reviews, scan and patch reports, change tickets, contingency tests and incident records. Assessors test controls rather than read about them, so records must come from the systems themselves.
Compliance route
How do you achieve NIST SP 800-53 compliance?
No body certifies SP 800-53, so the route is compliance proven by assessment. You implement the controls, an independent assessor tests them and, for federal systems, the agency or programme decides on authorisation.
- 01Define the system boundary and categorise it.Agree what is in the system, which information it handles and its impact level, because the impact level fixes the baseline.
- 02Gap analysis: compare today's controls with the tailored baseline.We test each control as it runs now, set the parameters with your owners and agree actions, owners and dates for every gap.
- 03Implement the controls and write the plan.Technical and procedural controls go into service, and the system security and privacy plan records how each one works.
- 04Assess internally and fix what fails.We run a practice assessment using SP 800-53A procedures, raise the findings first and track remediation to closure.
- 05Support the independent assessment and continuous monitoring.The assessor tests the controls and reports; you remediate, the authority decides, and monitoring keeps the evidence current afterwards.
Check the route before you sign. A "NIST 800-53 certificate" does not exist. Ask who will assess your controls, whether your customer or programme accepts that assessor (FedRAMP, for example, works with third-party assessment organisations), and which release and baseline the assessment will use. The certification buyer's checklist
Cost
How much does NIST SP 800-53 compliance cost?
The single biggest cost driver is the baseline. A high baseline carries far more controls and enhancements than a low one, and the assessment grows with it.
| Cost component | What affects it |
|---|---|
| Consulting and implementation | The baseline, the system boundary, existing controls, and whether you choose Design™ or Drive™ |
| Independent assessment | The assessor chosen, the baseline, the number of components tested and any retesting, quoted by the assessor |
| Technology | Logging, vulnerability scanning, identity and encryption tools the controls require and you do not yet own |
| Your team's time | Control owners setting parameters, running procedures and producing records |
| Software and learning | Effivity and Sterling Academy access, itemised at no additional cost |
What moves the price
- Low, moderate or high baseline, plus the privacy baseline
- Inherited controls from a cloud or hosting provider
- How many environments sit inside the boundary
What a Sterling proposal always shows
- Deliverables, assumptions and exclusions in writing
- Milestones linked to deliverables
- One all-inclusive proposal for our work
Timeline
How long does NIST SP 800-53 compliance take?
Timing follows the baseline, the size of the boundary and how much tooling must be bought and deployed. As an estimate, most programmes take six to twelve months, and a high baseline can take longer.
| Phase | What sets the pace |
|---|---|
| Boundary, categorisation and gap analysis | Access to system owners, architecture diagrams and current configurations |
| Implementation and plan writing | Tool procurement, engineering capacity and parameter decisions |
| Operating period and internal assessment | Enough records for each control to show it works over time |
| Independent assessment | The assessor's calendar and the time to remediate findings |
Your engagement
What your NIST SP 800-53 engagement includes
Every engagement runs on Sterling OS™, and each phase has a clear SP 800-53 meaning. Sterling does not certify, attest or authorise: an independent assessor tests your controls, and any authorisation decision stays with the agency or programme concerned.
Design™: guided support
Your engineers and control owners do the work; a Sterling consultant sets the method, reviews every control narrative and coaches the team.
Drive™: managed support
The alternative to Design™ when capacity is short: Sterling drafts the plan, procedures and evidence packs with your owners and runs the programme up to the assessment.
Sustain™: after the assessment
Continuous monitoring support, periodic internal assessments, plan updates as the system changes and preparation for each reassessment.
Automate™: Effivity
Your control register, risks, findings and evidence run in Effivity, included with the engagement at no additional cost.
Training for your people
Internal auditor training, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.
Assessment findings and authorisation decisions remain with the independent assessor and the responsible authority.
Often combined with
Standards organisations pair with NIST SP 800-53
- ADHICS (Abu Dhabi)ADHICS compliance consulting for DoH-regulated healthcare entities in Abu Dhabi: patient information, systems and devices protected, with audit-ready evidence.
- CIS ControlsCIS Controls implementation and requirements: the 18 Controls and 153 Safeguards of v8.1, Implementation Groups, assessment with no certificate, cost and time.
- CMMC 2.0CMMC 2.0 certification consulting for defence contractors handling FCI and CUI: controls, SPRS score and evidence ready for self or C3PAO assessment.
- CSA STARCSA STAR certification consulting for cloud providers: CCM controls and evidence for a STAR Registry entry by self-assessment, certification or attestation.
- Cyber EssentialsCyber Essentials certification consulting: the five technical controls in place for your verified self-assessment, and Cyber Essentials Plus audit-ready.
- DESC ISR (Dubai)DESC ISR compliance consulting for Dubai government entities and suppliers: information security risks and incidents managed, with the evidence to show it.
Effivity · information security software, included in every engagement
How Effivity helps you fulfil, automate and simplify the requirements of NIST SP 800-53 Rev. 5.
Effivity is the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. For an SP 800-53 client, your consultant configures a security workspace within the agreed scope: the tailored control list with owners and parameter values, policies and procedures under version control, risks, assessment findings, remediation actions, incidents and training records. Sterling consulting clients get their Effivity subscription included with the engagement, at no additional cost.
Boundary, baseline and control ownership
The system boundary, impact level and tailored baseline recorded once, with an owner and parameter value against every control.
Risks, treatments and accepted exceptions
A register that links each risk to the controls treating it and records who accepted what remains.
Role-based training records
Who completed which training and when, linked to Sterling Academy, ready for the sample an assessor draws.
Documents, procedures and change records
Controlled policies and procedures for each family, with approvals and review dates that keep themselves visible.
Incidents from report to lessons learned
Each incident logged, handled and closed with the root cause and the follow-up actions on record.
Internal assessments and findings
Assessment schedules, test results and a findings list with owners and due dates, feeding straight into remediation.
Supplier and service provider reviews
Evaluations of suppliers and inherited services, with the controls each one is expected to carry.
Forms and workflows that match your operation
Fields, approvals and reports configured without code, so the workspace follows your engineering and operations teams.
What this means at the assessment
An assessor sampling SP 800-53 controls asks for the parameter you set, the procedure that applies it and the record proving it ran last month. With Effivity, those three items sit on the same control, dated and approved.
In your engagement
- Subscription included with the engagement, at no additional cost
- Configured by your Sterling consultant within the agreed scope
- Your documents, records and registers migrated, not retyped
- Admin and user training for your team
- Modules for QMS, EMS, OHSMS, FSMS and more when you integrate other standards
Sterling Academy · security and privacy e-learning
Make every control owner fluent in the controls they run.
Sterling Academy offers video lessons with practice checkpoints, a final exam and a numbered Certificate of Completion that can be verified online. Sterling consulting clients benefit from preferential Sterling Academy course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.
- Awareness training that gives every user the basics the AT family expects
- Internal auditor training, as applicable to your standard, as part of the engagement
- Completion reports by team, ready for an assessor's sample
- New joiners trained as they arrive, so the records never lag behind
Keep exploring
Explore more about NIST SP 800-53
NIST SP 800-53 resources
Services for NIST SP 800-53
Why Sterling
Want successful NIST SP 800-53 compliance? Come to Sterling.
Organisations serving US agencies often run teams in several countries. Sterling applies one control set across every location, with one engagement team accountable.
60+ countries since 2003
Security, privacy and risk programmes for technology firms, service providers and government suppliers, with offices in 21 countries.
All-inclusive proposal
Consulting, Effivity, training and Academy access in one proposal; the assessor's fee shown separately.
One control set, many frameworks
Controls built once and traced to ISO/IEC 27001, SOC 2 or the CSF where you need them, so nothing is done twice.
Expert and experienced consultants
Security specialists who understand your architecture before they open the catalogue.
The Sterling Promise
What our NIST SP 800-53 success guarantee means
We stay with you until your agreed NIST SP 800-53 outcome is achieved, through implementation, the internal assessment and the closure of the independent assessor's findings.
The engagement identifies the publication, system boundary, outcome and responsibilities. Your organisation supplies accurate information and puts the agreed controls into use. The independent assessor reports on the controls and the responsible authority retains any authorisation decision. Our commitment concerns the agreed compliance support, not a promise of every future contract award or flawless performance.
FAQs
Frequently asked questions about NIST SP 800-53
Is there a NIST SP 800-53 certification?
No. NIST runs no certification scheme; customers rely on an independent assessment report and, for federal systems, an authorisation decision.
Is NIST SP 800-53 mandatory for private companies?
Only when a contract or programme makes it so. It becomes binding when you operate a system for a federal agency or pursue FedRAMP; otherwise NIST encourages its use without requiring it.
What is the difference between NIST SP 800-53 and NIST SP 800-171?
SP 800-53 is the full catalogue for federal systems. SP 800-171 is a separate, narrower set of requirements for protecting controlled unclassified information in non-federal systems, usually imposed through federal contracts.
Which NIST SP 800-53 baseline applies to our system?
The baseline follows the system's impact level, which comes from categorising the information it handles. Your agency customer usually states it; otherwise we work it out with you first.
Does Release 5.2.0 mean we have to redo our controls?
No. Release 5.2.0 added a small number of controls and enhancements and left the baselines unchanged. Confirm your programme has adopted it, then update the affected controls.
Keep exploring
More on NIST SP 800-53 and related standards
More in Information security, cyber & cloud
Talk to a consultant
Plan your NIST SP 800-53 compliance around the baseline you actually need.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice