Using the control pages

Every active SP 800-53 Rev. 5 control has its own page, generated from NIST’s official machine-readable (OSCAL) catalog so the requirement text always matches the current release. Each page shows the same parts in the same order.

• Summary. Which SP 800-53B baselines include the control (Low, Moderate, High, Privacy), whether it is usually implemented at the organization or system level, and how many enhancements it has.
• Control statement. The requirement itself. Text in brackets, such as [Assignment: organization-defined time period], is an organization-defined parameter you must fill in (see Select).
• NIST discussion. NIST’s explanation of intent, collapsed by default.
• Control enhancements. Each enhancement with its own baselines, statement, discussion and assessment objectives.
• Assessment objectives. The SP 800-53A “determine if” statements and the examine, interview and test objects an assessor will use (see Assess).
• How to apply it. Practical guidance from this guide: common implementations, evidence, inheritance and findings. This section is being written control by control, starting with the most-assessed controls; AC-2 shows the format.

Badges near each title show whether the page has guidance and a policy clause yet, and whether each is a draft or reviewed; Guidance coverage totals them. To see every control in one baseline, use the baseline lists: Low, Moderate, High and Privacy.

Families

Family	Name	Active controls
AC	Access Control	23
AT	Awareness and Training	5
AU	Audit and Accountability	15
CA	Assessment, Authorization, and Monitoring	8
CM	Configuration Management	14
CP	Contingency Planning	12
IA	Identification and Authentication	13
IR	Incident Response	9
MA	Maintenance	7
MP	Media Protection	8
PE	Physical and Environmental Protection	22
PL	Planning	8
PM	Program Management	32
PS	Personnel Security	9
PT	Personally Identifiable Information Processing and Transparency	8
RA	Risk Assessment	9
SA	System and Services Acquisition	17
SC	System and Communications Protection	47
SI	System and Information Integrity	22
SR	Supply Chain Risk Management	12

Control text is reproduced from NIST SP 800-53 Rev. 5 and SP 800-53A Rev. 5, which are U.S. government works in the public domain.