# NIST SP 800-53 Rev 5 — overview

- Source: https://support.icompaas.com/support/solutions/articles/a_gen_overview_nist80053-nist-sp-800-53-rev-5-overview
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [NIST](https://support.icompaas.com/support/solutions/62000112528) › [Overview](https://support.icompaas.com/support/solutions/folders/f_gen_62000112528_overview)
- Last updated: 2026-05-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

NIST SP 800-53 Rev 5 · 1,100+ controls across 20 families

### What is it?

**NIST SP 800-53 Rev 5** is the US National Institute of Standards and Technology's **catalogue of security & privacy controls** for federal information systems and their suppliers. It is the canonical source for **FedRAMP**, **FISMA**, **StateRAMP**, **CJIS**, and the privacy clauses in the federal acquisition rules.

### How it is organised

20 control _families_ (AC, AT, AU, CA, CM, CP, IA, IR, MA, MP, PE, PL, PM, PS, PT, RA, SA, SC, SI, SR) plus a separate **Privacy** family. Each control has _discussion_, _related controls_, _references_ and a set of _control enhancements_.

### Baselines

NIST SP 800-53B defines three baselines — **Low, Moderate, High** — that pick a subset of controls based on the system's FIPS-199 impact level. FedRAMP adds a fourth ("Tailored") for SaaS handling low-impact data.

### How to read a control ID

`AC-2 (3)` = Family **AC** (Access Control), control **2** (Account Management), enhancement **3** (Disable Accounts when no longer required).

### Linking to your auditor's world

For FedRAMP/FISMA your auditor is a **Third-Party Assessment Organisation (3PAO)**; the deliverable is the **System Security Plan (SSP)** using NIST SP 800-18 templates plus a **Continuous Monitoring** plan.

### Cross-walks

NIST publishes [downloadable mappings](https://csrc.nist.gov/projects/risk-management/sp800-53-controls/release-search) to ISO/IEC 27001 Annex A, CIS Controls and the NIST Cybersecurity Framework subcategories — useful when an organisation must operate against multiple regulators.

### How iCompaas helps

iCompaas ships the FedRAMP Moderate baseline pre-mapped to cloud evidence sources, an SSP generator that pulls control implementation statements from the live posture data, and a POA&M tracker (Plan of Action & Milestones) for findings that are not yet remediated.

## Related compliance guidance

- [NIST SP 800-53 Rev. 5: a practical implementation guide for cloud teams](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5): How the 800-53 catalogue, baselines and the Risk Management Framework fit together, and which controls take the most work in the cloud.
- [NIST SP 800-171 and CMMC: a practical guide to protecting CUI in the cloud](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3): If the driver is a DoD or federal contract handling CUI, 800-171 (and CMMC) is the scope you actually need.