SY0-701 Study Notes

NIST SP 800-53

2 min read

ELI5: What is NIST SP 800-53?

Think of it as a giant catalog of every safety rule a government building could use — from door locks to alarm systems to visitor sign-in sheets. Agencies pick the controls they need from this catalog to protect their computers and data.

Definition

NIST Special Publication 800-53 is a comprehensive catalog of security and privacy controls for federal information systems and organizations, maintained by the National Institute of Standards and Technology. It is the primary control framework for US federal agencies implementing the Federal Information Security Management Act (FISMA) and forms the basis for FedRAMP cloud security requirements. SP 800-53 Rev 5 organizes controls into 20 control families covering areas from access control to supply chain risk management.

Key Details

  • Required for US federal systems under FISMA; also used voluntarily by many private sector organizations
  • Control families include: AC (Access Control), IA (Identification & Authentication), IR (Incident Response), SI (System Integrity), SC (System & Communications Protection), and 15 more
  • Controls are categorized by impact level: Low, Moderate, High — organizations select a control baseline based on system impact level
  • FedRAMP uses SP 800-53 controls as the baseline for authorizing cloud services used by federal agencies
  • Exam tip: NIST SP 800-53 is for federal systems (FISMA compliance); NIST CSF is the broader risk management framework for all organizations

Connections

Graph View

Backlinks