Industry guides
Each industry guide explains how the RMF and SP 800-53 controls fit alongside that sector’s own rules: which frameworks overlap, which controls carry extra weight, and what regulators and auditors expect to see. Guides are added over time; the table shows what is planned.
| Industry | Main rules alongside 800-53 | Status |
|---|---|---|
| Federal civilian | FISMA, OMB A-130, FedRAMP | Covered by the RMF section |
| Defense and defense industrial base | DoDI 8510.01, CNSSI 1253, CMMC, SP 800-171 | Planned |
| Healthcare | HIPAA Security Rule, HHS 405(d) practices | Planned |
| Financial services | FFIEC guidance, GLBA Safeguards Rule, PCI DSS | Planned |
| Energy and utilities | NERC CIP, DOE C2M2 | Planned |
| State and local government | StateRAMP (GovRAMP), CJIS Security Policy, IRS Publication 1075 | Planned |
To write a new guide, copy the industry template from Page templates into this folder.
Independent guidance, not an official NIST publication. Control text is from NIST SP 800-53 Rev. 5 and SP 800-53A (public domain). Original content is licensed CC BY 4.0; program templates and the downloadable kit are dedicated to the public domain under CC0 1.0.