Use the 20 families to navigate the Rev. 5 catalog, then make selection, parameters, ownership, implementation, and assessment decisions at control level.
Family membership groups related controls. It does not set priority, make every control applicable, or prove that a family is implemented.
Revision 5 organizes base controls and their enhancements into 20 families: Access Control (AC), Awareness and Training (AT), Audit and Accountability (AU), Assessment, Authorization, and Monitoring (CA), Configuration Management (CM), Contingency Planning (CP), Identification and Authentication (IA), Incident Response (IR), Maintenance (MA), Media Protection (MP), Physical and Environmental Protection (PE), Planning (PL), Program Management (PM), Personnel Security (PS), PII Processing and Transparency (PT, covering personally identifiable information), Risk Assessment (RA), System and Services Acquisition (SA), System and Communications Protection (SC), System and Information Integrity (SI), and Supply Chain Risk Management (SR). Seventeen align with FIPS 200 minimum-security-requirement areas; PM, PT, and SR add enterprise, privacy, and supply-chain groupings. A is an organizing label, not a ready-made scope or proof that every control in the family applies.
Each control has a family code and number, a title, a control statement, discussion, related controls, references, and where applicable enhancements and . The control statement is the requirement to implement when selected; the discussion explains intent and possible approaches but does not replace the statement.
A augments its base control and cannot stand alone. Family, control, and enhancement numbering does not create a maturity scale or implementation order. Start from the approved and tailored control set, not from an assumption that every family or control applies.
Sources (2)
Chapter 2 explains the 20-family structure, base controls, enhancements, parameters, discussion text, related controls, and implementation approaches.
NIST source for tracing assessment objectives and determination statements back to selected control text and completed parameters.
The summaries below are navigation aids, not substitutes for the current control statements. A selected control may address security, privacy, or both, and related controls can cross family boundaries.
Sources (2)
Current NIST catalog page listing all 20 families and the Release 5.2.0 control data.
Primary source for the controls and enhancements summarized by family.
A single family can contain organization-level, common, hybrid, and system-specific implementations owned by different roles. For example, enterprise identity services may implement parts of IA controls as common controls while the system owner configures and monitors the system-specific portions.
For a hybrid control, state the exact division. NIST assigns the common-control provider responsibility for the common part and the system owner responsibility for the system-specific part. Unclear ownership creates a gap even when both teams report the same control as covered.
Sources (2)
Section 2.3 explains common, system-specific, hybrid, and organization-level implementation and the responsibilities for hybrid controls.
NIST source for responsibility and accountability for controls implemented within or inherited by systems.
SP 800-53A decomposes control text into assessment objectives and determination statements. Assessors apply selected examine, interview, and test methods to the necessary objects, with depth and coverage set by assurance needs and risk. Record each determination as satisfied or other than satisfied.
A family total can help prioritize work, but it can also hide a failed enhancement, undefined parameter, stale inherited assessment, or untested part of a hybrid control. Keep the underlying determination-level record and surface material exceptions.
Sources (1)
NIST source for objectives, determination statements, methods, depth, coverage, evidence, and satisfied or other-than-satisfied findings.
Start with the final selected and tailored set. Group controls by family for navigation, then complete control-specific parameters, ownership, implementation narratives, inheritance, evidence, and assessment objectives. Aggregate only after the detailed records are current.
Use the current Rev. 5 data. NIST Release 5.2.0, issued August 27, 2025, added SA-15(13), SA-24, and SI-02(07), revised SI-07(12), and updated selected discussions and related-control references. It did not create new families.
Sources (2)
Current NIST page for Release 5.2.0 changes and machine-readable control data.
Current NIST page for matching Release 5.2.0 assessment procedures.
Track each selected control, enhancement, parameter, owner, inherited dependency, evidence item, determination, and remediation before rolling results up by family.
Create cited tasks, evidence requests, and review checkpoints for this NIST SP 800-53 Rev. 5 scope.
Check source coverage, ownership, evidence gaps, and next steps before publishing or operationalizing the work.
Decide whether NIST SP 800-53 applies, identify the adopting authority and boundary, and document the control, assessment, and authorization path.
Choose the NIST SP 800-53B security and privacy starting baselines, document the basis, and preserve the tailoring decisions that produce the final control set.
Plan and document SP 800-53A assessments by mapping determination statements to examine, interview, and test evidence, coverage, findings, and risk decisions.
Tailor an NIST SP 800-53B baseline with scoping, common controls, parameters, compensating controls, additions, implementation detail, and documented approvals.
Prepare assessment evidence for NIST SP 800-53A by linking each determination statement to scoped, current, reproducible examine, interview, or test records.
Answers to NIST SP 800-53 Rev. 5 questions on applicability, baselines, tailoring, parameters, enhancements, inheritance, assessments, evidence, and POA&Ms.
Apply NIST SP 800-53 overlays and document common, hybrid, and inherited controls with clear provider, consumer, assessment, and change responsibilities.
Document POA&M source findings, planned remediation, milestones, status evidence, governance decisions, and reassessment-backed closure under NIST SP 800-53 CA-5.
Turn assessed control deficiencies into governed POA&M records with risk, corrective actions, resources, milestones, status evidence, and validated closure.
NIST SP 800-53A gives assessors a methodology and set of procedures for checking whether security and privacy controls are implemented correctly, operating as intended, and producing the desired outcome.
Decide when to use NIST SP 800-53 Rev. 5 or CIS Controls v8.1, how selection differs, and when control evidence can be reused.
Compare NIST SP 800-53 Rev. 5 and CIS Controls v8.1 by scope, selection method, safeguards, assessment evidence, and assurance.
Compare NIST SP 800-53 Rev. 5 with ISO/IEC 27001:2022 by scope, controls, ISMS requirements, evidence, and certification.
Compare NIST SP 800-53 Rev. 5 and CSF 2.0 by scope, controls, outcomes, Profiles, Tiers, evidence, and assurance.
Decide when to use NIST SP 800-53 Rev. 5 or CSF 2.0, how controls relate to outcomes, and when evidence can support both.
Decide when to use NIST SP 800-53 Rev. 5 or SP 800-171 Rev. 3, how their scopes differ, and when control evidence can be reused.
Compare NIST SP 800-53 Rev. 5 with SP 800-171 Rev. 3 by scope, adopting authority, CUI boundary, requirements, evidence, and assessment.
Use SP 800-53A examine, interview, and test methods against specific determination statements, with documented objects, depth, coverage, and findings.
Start with the applicable SP 800-53B security and privacy baselines, then document categorization, tailoring, parameters, overlays, responsibility, and additions.
Complete every SP 800-53 assignment and selection operation with an approved, scoped, implementable value, then assess the completed control statement.
Document the common-control provider, inherited capability, parameters, consumer boundary, assessment results, dependencies, and system-specific work.
Verify actual control inheritance by comparing provider scope, completed parameters, assessment results, dependencies, and remaining system-specific work.
Collect evidence for each SP 800-53A determination statement, using the selected examine, interview, and test methods at the planned depth and coverage.
A useful POA&M item identifies the finding, affected control and system, risk response, owner, milestones, status evidence, dependencies, and closure criteria.
Select a control enhancement only with its base control, document the selection trigger and parameters, implement its added requirement, and assess it separately.