NIST SP 800-53 Rev 5: Security Controls Gap Assessment for FedRAMP & FISMA (2026)

What is NIST SP 800-53 Rev 5?

NIST Special Publication 800-53 Revision 5 — Security and Privacy Controls for Information Systems and Organizations — is the foundational security controls catalogue published by the National Institute of Standards and Technology. Released in September 2020 (with final baselines published December 2020), Rev 5 is the most comprehensive update since the standard was first published, introducing over 1,000 individual controls across 20 control families.

NIST 800-53 Rev 5 serves as the control catalogue for the Risk Management Framework (RMF) defined in NIST SP 800-37. It is mandatory for all US federal agencies under FISMA (Federal Information Security Modernization Act), forms the basis of FedRAMP (the federal cloud security authorization programme), and is referenced in DFARS/CMMC requirements for defence contractors. While originally designed for federal use, Rev 5 was explicitly positioned as applicable to any organization regardless of sector.

Key changes in Rev 5 vs Rev 4

NIST 800-53 Rev 5 introduced several significant changes from the previous Rev 4 (published in 2013):

• Privacy controls integrated: Privacy controls previously in SP 800-53A Appendix J are now fully integrated throughout the main control catalogue, with 18 new privacy-related controls and privacy overlays added to existing control families
• Supply Chain Risk Management (SR) family: A new control family (SR-1 through SR-12) specifically addressing supply chain risks — developer screening, provenance verification, criticality analysis, and malicious code controls
• Outcome-based language: Controls rewritten to describe desired outcomes rather than prescriptive actions, giving organizations more flexibility in implementation
• Sector-agnostic scope: Rev 5 explicitly states it is applicable to any organization, not just federal agencies — enabling broader adoption
• Program Management (PM) family expanded: Additional enterprise-level controls for security strategy, resource allocation, and SCRM programme governance
• Controls-as-a-service alignment: New controls for cloud-based implementations and shared service models

The 20 NIST 800-53 control families

NIST 800-53 Rev 5 organises controls into 20 families, each identified by a two-letter abbreviation:

• AC — Access Control (26 controls): Account management, access enforcement, least privilege, separation of duties, remote access, wireless access, mobile devices
• AT — Awareness and Training (6 controls): Security awareness, role-based training, insider threat awareness
• AU — Audit and Accountability (16 controls): Event logging, audit review, audit protection, retention, time stamps
• CA — Assessment, Authorization, and Monitoring (9 controls): Security assessments, authorization, POA&M, continuous monitoring, penetration testing
• CM — Configuration Management (14 controls): Baseline configurations, change control, allowlisting, least functionality
• CP — Contingency Planning (13 controls): Contingency plan, backup, recovery, alternate site, failover
• IA — Identification and Authentication (13 controls): Multi-factor authentication, authenticator management, device identity, service identity
• IR — Incident Response (10 controls): Incident handling, incident testing, incident monitoring, incident reporting
• MA — Maintenance (6 controls): Controlled maintenance, maintenance tools, remote maintenance
• MP — Media Protection (8 controls): Media access, media marking, media sanitisation, media transport
• PE — Physical and Environmental Protection (20 controls): Physical access, facility management, power, fire protection, temperature controls
• PL — Planning (10 controls): System security plan, privacy impact assessment, concept of operations
• PM — Program Management (32 controls): Enterprise security architecture, SCRM strategy, insider threat programme, risk management strategy
• PS — Personnel Security (9 controls): Personnel screening, personnel termination, personnel transfer, access agreements
• PT — PII Processing and Transparency (8 controls): Privacy notice, consent, individual access, correction, complaint management
• RA — Risk Assessment (10 controls): Risk assessment, vulnerability scanning, threat intelligence, criticality analysis
• SA — System and Services Acquisition (23 controls): Security in acquisition, developer security testing, supply chain risk in acquisition
• SC — System and Communications Protection (51 controls): Boundary protection, cryptographic key management, transmission protection, data at rest, DoS protection
• SI — System and Information Integrity (23 controls): Flaw remediation, malicious code protection, security alerts, integrity checking, spam protection
• SR — Supply Chain Risk Management (12 controls): Supply chain risk management plan, supply chain controls and plans, provenance, acquisition strategies, inspection, component authenticity, criticality analysis, supply chain incident response

Low, Moderate, and High baselines

NIST 800-53 organises its controls into three security baselines based on the system's FIPS 199 impact level:

• Low Baseline: ~125 controls. Applied where loss of confidentiality, integrity, or availability would have a limited adverse effect on operations, assets, or individuals. Appropriate for publicly available information systems with no sensitive data.
• Moderate Baseline: ~323 controls. Applied where loss would have a serious adverse effect. This is the most common baseline for SaaS applications and cloud services — FedRAMP Moderate is the most widely-held authorization level for cloud service providers.
• High Baseline: ~421 controls. Applied where loss would have a severe or catastrophic adverse effect. Used for national security systems, law enforcement systems, emergency response systems, and healthcare systems managing life-safety information.

The baseline differences are significant. For example, the AC (Access Control) family at Low requires basic account management and least privilege. At Moderate, it adds session lock, concurrent sessions limits, and dynamic account management. At High, it adds additional controls for account monitoring, dynamic access decisions, and advanced session management.

FedRAMP and NIST 800-53

FedRAMP (Federal Risk and Authorization Management Program) uses NIST 800-53 Rev 5 as its control catalogue. FedRAMP Moderate authorizes Cloud Service Providers (CSPs) to serve federal agencies at the Moderate impact level. The FedRAMP authorization process involves:

• System Security Plan (SSP): Comprehensive documentation of the system boundary, data flows, control implementations, interconnections, and roles and responsibilities — typically 200-500 pages for a Moderate system
• 3PAO Assessment: A FedRAMP-accredited Third-Party Assessment Organization (3PAO) independently tests all controls, documents findings in a Security Assessment Report (SAR), and identifies risks requiring remediation or acceptance
• Plan of Action and Milestones (POA&M): Tracks all open vulnerabilities and findings with remediation plans and scheduled completion dates; updated monthly for FedRAMP continuous monitoring
• ATO issuance: An Agency ATO is granted by an individual federal agency's Authorizing Official; a JAB P-ATO (from the FedRAMP Joint Authorization Board) provides a broader authorization accepted by all agencies

FedRAMP Rev 5 transition (2023-2024) required existing FedRAMP-authorized CSPs to update their SSPs and control implementations to align with Rev 5 changes — most significantly the supply chain risk management (SR) family additions and privacy control integrations.

Zero Trust Architecture alignment

Executive Order 14028 (Improving the Nation's Cybersecurity, May 2021) directed federal agencies to develop plans to implement Zero Trust Architecture (ZTA) as defined in NIST SP 800-207. NIST 800-53 Rev 5 controls map directly to the five ZTA pillars:

• Identity pillar: AC-2 (account management), AC-6 (least privilege), IA-2 (MFA), IA-5 (authenticator management), IA-8 (non-organizational users) — enforce strong authentication everywhere, eliminate implicit trust from network location
• Devices pillar: CM-2 (baseline configurations), CM-8 (information system component inventory), RA-5 (vulnerability scanning), SI-3 (malicious code protection) — only known, managed, compliant devices are trusted
• Networks pillar: SC-7 (boundary protection / micro-segmentation), SC-8 (transmission confidentiality), SC-28 (protection of information at rest) — encrypt all traffic, segment networks, eliminate implicit trust from network segments
• Applications pillar: SA-4 (security in acquisitions), SA-11 (developer security testing), SA-15 (development process/standards) — shift security left, verify application behaviour continuously
• Data pillar: SC-28 (data at rest encryption), MP-6 (media sanitization), AC-4 (information flow enforcement) — classify and protect data at the data layer regardless of network location

The CISA KEV catalogue and patch management

CISA's Known Exploited Vulnerabilities (KEV) catalogue — launched November 2021 — lists vulnerabilities that are actively being exploited in the wild. Binding Operational Directive (BOD) 22-01 requires all federal civilian executive branch agencies to remediate KEV catalogue vulnerabilities within mandated timeframes (typically 2 weeks for new additions). NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Scanning) control implementations should reference KEV monitoring as a priority input to the patch management process. CSPs and contractors should also track KEV for their control implementations even if not formally required to do so.

Assess your NIST 800-53 compliance

The NIST SP 800-53 Rev 5 Security Controls Gap Assessment covers 42 key controls across six domains: access control and authentication (AC-1, AC-2, AC-6, IA-2, AC-17, AC-11/12, AC-5), audit and configuration management (AU-2, AU-9, AU-6, CM-2, CM-3, CM-10/11, AU-11), incident response and contingency planning (IR-1/8, IR-4, IR-3, CP-2, CP-9, CP-4, CP-7), risk assessment and supply chain (RA-3, RA-5, CA-8, SR-1, SR-3/5, RA-9, RA-10), system and communications protection (SC-7, SC-12, SC-8, SC-28, SC-5, MP-2/6, MP-7/SC-43), and security programme governance (PL-2, CA-2/5, AT-2/3, SA-4, SI-2, SI-3, CA-7). Mark each control as compliant, partial, gap, or not applicable, and generate an AI-drafted gap assessment report with FedRAMP/FISMA authorization guidance and a prioritised remediation roadmap.

Related tools

See also: NIST Cybersecurity Framework 2.0 Gap Assessment, FedRAMP Authorization Roadmap, CMMC 2.0 Level 2 Gap Assessment, NIST AI RMF Gap Assessment, ISO 27001:2022 Gap Assessment.