Privacy baseline
The SP 800-53B privacy baseline in SP 800-53 release 5.2.0 has 96 controls and enhancements: 75 controls and 21 enhancements, in 16 families. Start from it in the Select step, then tailor it to the system.
Access Control (AC)
Section titled “Access Control (AC)”2 in this baseline.
| Control | Title |
|---|---|
| AC-1 | Policy and Procedures |
| AC-3(14) | Individual Access |
Awareness and Training (AT)
Section titled “Awareness and Training (AT)”5 in this baseline.
| Control | Title |
|---|---|
| AT-1 | Policy and Procedures |
| AT-2 | Literacy Training and Awareness |
| AT-3 | Role-based Training |
| AT-3(5) | Processing Personally Identifiable Information |
| AT-4 | Training Records |
Audit and Accountability (AU)
Section titled “Audit and Accountability (AU)”4 in this baseline.
| Control | Title |
|---|---|
| AU-1 | Policy and Procedures |
| AU-2 | Event Logging |
| AU-3(3) | Limit Personally Identifiable Information Elements |
| AU-11 | Audit Record Retention |
Assessment, Authorization, and Monitoring (CA)
Section titled “Assessment, Authorization, and Monitoring (CA)”6 in this baseline.
| Control | Title |
|---|---|
| CA-1 | Policy and Procedures |
| CA-2 | Control Assessments |
| CA-5 | Plan of Action and Milestones |
| CA-6 | Authorization |
| CA-7 | Continuous Monitoring |
| CA-7(4) | Risk Monitoring |
Configuration Management (CM)
Section titled “Configuration Management (CM)”2 in this baseline.
| Control | Title |
|---|---|
| CM-1 | Policy and Procedures |
| CM-4 | Impact Analyses |
Incident Response (IR)
Section titled “Incident Response (IR)”10 in this baseline.
| Control | Title |
|---|---|
| IR-1 | Policy and Procedures |
| IR-2 | Incident Response Training |
| IR-2(3) | Breach |
| IR-3 | Incident Response Testing |
| IR-4 | Incident Handling |
| IR-5 | Incident Monitoring |
| IR-6 | Incident Reporting |
| IR-7 | Incident Response Assistance |
| IR-8 | Incident Response Plan |
| IR-8(1) | Breaches |
Media Protection (MP)
Section titled “Media Protection (MP)”2 in this baseline.
| Control | Title |
|---|---|
| MP-1 | Policy and Procedures |
| MP-6 | Media Sanitization |
Physical and Environmental Protection (PE)
Section titled “Physical and Environmental Protection (PE)”1 in this baseline.
| Control | Title |
|---|---|
| PE-8(3) | Limit Personally Identifiable Information Elements |
Planning (PL)
Section titled “Planning (PL)”6 in this baseline.
| Control | Title |
|---|---|
| PL-1 | Policy and Procedures |
| PL-2 | System Security and Privacy Plans |
| PL-4 | Rules of Behavior |
| PL-4(1) | Social Media and External Site/Application Usage Restrictions |
| PL-8 | Security and Privacy Architectures |
| PL-9 | Central Management |
Program Management (PM)
Section titled “Program Management (PM)”24 in this baseline.
| Control | Title |
|---|---|
| PM-3 | Information Security and Privacy Resources |
| PM-4 | Plan of Action and Milestones Process |
| PM-5(1) | Inventory of Personally Identifiable Information |
| PM-6 | Measures of Performance |
| PM-7 | Enterprise Architecture |
| PM-8 | Critical Infrastructure Plan |
| PM-9 | Risk Management Strategy |
| PM-10 | Authorization Process |
| PM-11 | Mission and Business Process Definition |
| PM-13 | Security and Privacy Workforce |
| PM-14 | Testing, Training, and Monitoring |
| PM-17 | Protecting Controlled Unclassified Information on External Systems |
| PM-18 | Privacy Program Plan |
| PM-19 | Privacy Program Leadership Role |
| PM-20 | Dissemination of Privacy Program Information |
| PM-20(1) | Privacy Policies on Websites, Applications, and Digital Services |
| PM-21 | Accounting of Disclosures |
| PM-22 | Personally Identifiable Information Quality Management |
| PM-24 | Data Integrity Board |
| PM-25 | Minimization of Personally Identifiable Information Used in Testing, Training, and Research |
| PM-26 | Complaint Management |
| PM-27 | Privacy Reporting |
| PM-28 | Risk Framing |
| PM-31 | Continuous Monitoring Strategy |
Personnel Security (PS)
Section titled “Personnel Security (PS)”1 in this baseline.
| Control | Title |
|---|---|
| PS-6 | Access Agreements |
Personally Identifiable Information Processing and Transparency (PT)
Section titled “Personally Identifiable Information Processing and Transparency (PT)”13 in this baseline.
| Control | Title |
|---|---|
| PT-1 | Policy and Procedures |
| PT-2 | Authority to Process Personally Identifiable Information |
| PT-3 | Personally Identifiable Information Processing Purposes |
| PT-4 | Consent |
| PT-5 | Privacy Notice |
| PT-5(2) | Privacy Act Statements |
| PT-6 | System of Records Notice |
| PT-6(1) | Routine Uses |
| PT-6(2) | Exemption Rules |
| PT-7 | Specific Categories of Personally Identifiable Information |
| PT-7(1) | Social Security Numbers |
| PT-7(2) | First Amendment Information |
| PT-8 | Computer Matching Requirements |
Risk Assessment (RA)
Section titled “Risk Assessment (RA)”4 in this baseline.
| Control | Title |
|---|---|
| RA-1 | Policy and Procedures |
| RA-3 | Risk Assessment |
| RA-7 | Risk Response |
| RA-8 | Privacy Impact Assessments |
System and Services Acquisition (SA)
Section titled “System and Services Acquisition (SA)”7 in this baseline.
| Control | Title |
|---|---|
| SA-1 | Policy and Procedures |
| SA-2 | Allocation of Resources |
| SA-3 | System Development Life Cycle |
| SA-4 | Acquisition Process |
| SA-8(33) | Minimization |
| SA-9 | External System Services |
| SA-11 | Developer Testing and Evaluation |
System and Communications Protection (SC)
Section titled “System and Communications Protection (SC)”1 in this baseline.
| Control | Title |
|---|---|
| SC-7(24) | Personally Identifiable Information |
System and Information Integrity (SI)
Section titled “System and Information Integrity (SI)”8 in this baseline.
| Control | Title |
|---|---|
| SI-1 | Policy and Procedures |
| SI-12 | Information Management and Retention |
| SI-12(1) | Limit Personally Identifiable Information Elements |
| SI-12(2) | Minimize Personally Identifiable Information in Testing, Training, and Research |
| SI-12(3) | Information Disposal |
| SI-18 | Personally Identifiable Information Quality Operations |
| SI-18(4) | Individual Requests |
| SI-19 | De-identification |
Independent guidance, not an official NIST publication. Control text is from NIST SP 800-53 Rev. 5 and SP 800-53A (public domain). Original content is licensed CC BY 4.0; program templates and the downloadable kit are dedicated to the public domain under CC0 1.0.