What is it?
NIST SP 800-53 Rev 5 is the US National Institute of Standards and Technology's catalogue of security & privacy controls for federal information systems and their suppliers. It is the canonical source for FedRAMP, FISMA, StateRAMP, CJIS, and the privacy clauses in the federal acquisition rules.
How it is organised
20 control families (AC, AT, AU, CA, CM, CP, IA, IR, MA, MP, PE, PL, PM, PS, PT, RA, SA, SC, SI, SR) plus a separate Privacy family. Each control has discussion, related controls, references and a set of control enhancements.
Baselines
NIST SP 800-53B defines three baselines — Low, Moderate, High — that pick a subset of controls based on the system's FIPS-199 impact level. FedRAMP adds a fourth ("Tailored") for SaaS handling low-impact data.
How to read a control ID
AC-2 (3) = Family AC (Access Control), control 2 (Account Management), enhancement 3 (Disable Accounts when no longer required).
Linking to your auditor's world
For FedRAMP/FISMA your auditor is a Third-Party Assessment Organisation (3PAO); the deliverable is the System Security Plan (SSP) using NIST SP 800-18 templates plus a Continuous Monitoring plan.
Cross-walks
NIST publishes downloadable mappings to ISO/IEC 27001 Annex A, CIS Controls and the NIST Cybersecurity Framework subcategories — useful when an organisation must operate against multiple regulators.
How iCompaas helps
iCompaas ships the FedRAMP Moderate baseline pre-mapped to cloud evidence sources, an SSP generator that pulls control implementation statements from the live posture data, and a POA&M tracker (Plan of Action & Milestones) for findings that are not yet remediated.