We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

Artifact GuideGLOBALNIST SP 800-53 Rev. 5

NIST SP 800-53 Rev. 5 Overlays and Common Controls Guide

Use overlays to customize a baseline and common controls to provide protection that multiple systems can inherit.

Keep the records separate: an overlay changes the starting control set, while inheritance depends on a provider's actual implementation, assessment, authorization, and operating conditions.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
Jul 24, 2026
Sections
5

Structured answer sets in this page tree.

Primary sources
9

Cited legal and guidance references.

Publication metadata
Sorena AI
Published May 9, 2026
Updated Jul 24, 2026
Overview

An customizes a control baseline for a defined community, technology, mission, environment, or threat. A is an implemented capability that multiple systems or programs can inherit. A is primarily the responsibility of the system owner and authorizing official. A splits responsibility between a common-control provider and a system owner. Apply overlays during selection and tailoring; accept only after checking the provider's implementation, parameters, assessment, authorization or risk status, dependencies, consumer duties, and change process.

Section 1

1. Decide whether you need an overlay, a common control, or both

Use an when several systems share a protection need that changes how a baseline should be selected or tailored. Use a when one provider implements and manages protection for multiple consumers. A system can use an overlay to select controls and then inherit some of those controls from common providers.

Do not describe an as an implementation service or treat a provider's control catalog as an approved overlay. Maintain one overlay decision record and separate provider-consumer records.

  • question: does a defined group need repeatable additions, removals, parameter guidance, specialization, or implementation guidance beyond the baseline?
  • Common-control question: can one provider deliver, assess, and monitor a protection capability that multiple systems can use under stated conditions?
  • Hybrid question: which parts are delivered by the provider, and which parts remain with each system owner?
Sources for this answer
NIST SP 800-53B - Control Baselines
NIST source for overlays as baseline-customization specifications for communities of interest, technologies, and environments.
NIST SP 800-53 Rev. 5 - Security and Privacy Controls
NIST source for common, system-specific, hybrid, and organization-level implementation approaches.
Section 2

2. Validate an overlay before applying it

Confirm who developed and approved the , the baseline and catalog release it modifies, the intended community and protection problem, assumptions, dependencies, version, and change history. A repository listing shows availability; it does not make every submitted overlay mandatory or suitable for every system.

Apply the to the stated starting baseline, preserve every addition, removal, parameter value, specialization, and rationale, then perform system-specific tailoring. Resolve conflicts with laws, policies, contracts, agency instructions, and other overlays through the authorized governance process.

  • Applicability: community, technology, mission, environment, threat, information, privacy processing, and excluded cases.
  • Authority: issuer, approval status, adopting instrument, baseline release, version, and effective conditions.
  • Delta: every control and enhancement added, removed, specialized, parameterized, or supplemented, with rationale.
  • System fit: conflicts, remaining tailoring, common-control dependencies, residual gaps, approval, and review trigger.
Sources for this answer
NIST SP 800-53B - Control Baselines
Appendix C explains overlay purpose, content, assumptions, applicability, tailoring changes, and documentation.
NIST Security and Privacy Control Overlay Repository
Official NIST repository for voluntarily shared government-wide, public, and NIST-developed overlays. Repository category and provenance should be checked before adoption.
Section 3

3. Establish the common-control provider record

The provider record should describe the implemented control and enhancements, parameters, service boundary, common and hybrid portions, consumers, dependencies, evidence, assessment scope and results, authorization or risk status, open findings, monitoring, and notification commitments.

For each , assign the common portion to the provider and the system-specific portion to the consumer. Avoid labels such as "shared" without a control-statement-level division, because both parties may assume the other owns the same requirement.

  • Provider identity and authority: organization, service, owner, authorization boundary, approving official, and version.
  • Control scope: control and enhancement IDs, completed parameters, implementation narrative, common portion, hybrid split, and excluded conditions.
  • Assurance: assessment plan and date, methods and coverage, findings, report, authorization or risk decision, POA&M, and expiration or review conditions.
  • Operations: monitoring, service dependencies, incident and failure handling, material-change criteria, notification timing, and evidence access for consumers.
Sources for this answer
NIST SP 800-53 Rev. 5 - Security and Privacy Controls
NIST source for common and hybrid implementation and the provider and system-owner responsibilities for each portion.
NIST SP 800-53A Rev. 5 - Assessment Procedures
NIST source for assessing common controls and inherited portions and reporting determination-level findings.
Section 4

4. Decide whether the consumer can inherit the protection

The consumer compares its final control requirement with the provider record. Confirm that the provider covers the same control version, enhancement, parameter, protection objective, environment, population, and dependency. Identify consumer configuration, integration, monitoring, and evidence duties before accepting .

If the provider covers only part of the control, document a . If the evidence is stale, the assessment scope excludes the consumer's use, a parameter conflicts, or an open finding affects the required protection, record the gap and implement, assess, or accept the remaining risk through the authorized process.

  • Requirement match: control text, enhancement, parameter, boundary, outcome, applicable , and assurance need.
  • Provider match: current implementation version, service scope, assessment coverage, finding status, authorization conditions, and dependencies.
  • Consumer duties: configuration, connection, local procedure, monitoring, incident reporting, evidence retention, and system-specific assessment.
  • Decision: fully inherited, hybrid, not inherited, or temporarily accepted with stated owner, action, due date, and decision authority.
Sources for this answer
NIST SP 800-37 Rev. 2 - Risk Management Framework
NIST source for system and common-control authorization, inheritance, accountability, and continuous monitoring.
NIST SP 800-53A Rev. 5 - Assessment Procedures
NIST source for using provider evidence to assess inherited controls and portions of hybrid controls.
Section 5

5. Overlay and inheritance workflow

Apply each approved to the matching baseline and record its complete delta. Finish system-specific tailoring and approve the final controls. Then compare each proposed inherited control with the provider record, document the common and system-specific portions, resolve gaps, and establish monitoring and notification.

Reassess when the provider or consumer boundary, control text, parameter, implementation, dependency, evidence, finding, authorization status, , requirement, or threat materially changes.

  • Step 1 | fit | Verify authority, scope, assumptions, baseline release, version, and every tailoring change.
  • Step 2 | Final controls | Apply the , complete system tailoring and parameters, and approve the final set.
  • Step 3 | Provider evidence | Obtain current implementation, assessment, authorization or risk status, findings, dependencies, and change terms.
  • Step 4 | decision | Compare requirements, split hybrid duties, resolve gaps, and record consumer conditions and approval.
  • Step 5 | Monitor | Track provider and consumer changes, findings, evidence age, incidents, service failures, and authorization conditions.
Sources for this answer
NIST SP 800-53B - Current Publication Page
Current NIST baseline source and link to the Security and Privacy Control Overlay Repository.
NIST SP 800-37 Rev. 2 - Risk Management Framework
NIST source for common-control selection, authorization, inheritance, and ongoing monitoring.
Recommended next step

Keep overlay changes separate from inheritance evidence

Record the overlay's baseline delta, then document each provider's implementation, assessment, authorization or risk status, consumer duties, gaps, and change triggers.

Assessment workflow
Open Assessment Autopilot for NIST SP 800-53 Rev. 5

Create cited tasks, evidence requests, and review checkpoints for this NIST SP 800-53 Rev. 5 scope.

Explore next step
Talk to Sorena
Review this NIST SP 800-53 Rev. 5 scope with Sorena

Check source coverage, ownership, evidence gaps, and next steps before publishing or operationalizing the work.

Explore next step
Primary sources

References and citations

Related guides

Explore more topics

How do NIST SP 800-53A assessment methods work?
Use SP 800-53A examine, interview, and test methods against specific determination statements, with documented objects, depth, coverage, and findings.
How do teams select and tailor NIST SP 800-53B baselines?
Start with the applicable SP 800-53B security and privacy baselines, then document categorization, tailoring, parameters, overlays, responsibility, and additions.
How should teams complete NIST control parameters?
Complete every SP 800-53 assignment and selection operation with an approved, scoped, implementable value, then assess the completed control statement.
How should teams document NIST common controls?
Document the common-control provider, inherited capability, parameters, consumer boundary, assessment results, dependencies, and system-specific work.
How should teams document NIST control inheritance?
Verify actual control inheritance by comparing provider scope, completed parameters, assessment results, dependencies, and remaining system-specific work.
NIST SP 800-53 Rev. 5 Applicability Guide
Decide whether NIST SP 800-53 applies, identify the adopting authority and boundary, and document the control, assessment, and authorization path.
NIST SP 800-53 Rev. 5 Baseline Selection Guide
Choose the NIST SP 800-53B security and privacy starting baselines, document the basis, and preserve the tailoring decisions that produce the final control set.
NIST SP 800-53 Rev. 5 Control Assessment Evidence Workflow
Plan and document SP 800-53A assessments by mapping determination statements to examine, interview, and test evidence, coverage, findings, and risk decisions.
NIST SP 800-53 Rev. 5 Control Families Explained
Understand all 20 NIST SP 800-53 Rev. 5 control families, how base controls and enhancements work, and how to assign ownership and assessment evidence.
NIST SP 800-53 Rev. 5 Control Tailoring Method
Tailor an NIST SP 800-53B baseline with scoping, common controls, parameters, compensating controls, additions, implementation detail, and documented approvals.
NIST SP 800-53 Rev. 5 Evidence and Audit Readiness Guide
Prepare assessment evidence for NIST SP 800-53A by linking each determination statement to scoped, current, reproducible examine, interview, or test records.
NIST SP 800-53 Rev. 5 FAQ: practical implementation questions
Answers to NIST SP 800-53 Rev. 5 questions on applicability, baselines, tailoring, parameters, enhancements, inheritance, assessments, evidence, and POA&Ms.
NIST SP 800-53 Rev. 5 POA&M Evidence Guide
Document POA&M source findings, planned remediation, milestones, status evidence, governance decisions, and reassessment-backed closure under NIST SP 800-53 CA-5.
NIST SP 800-53 Rev. 5 POA&M Evidence Workflow
Turn assessed control deficiencies into governed POA&M records with risk, corrective actions, resources, milestones, status evidence, and validated closure.
NIST SP 800-53 Rev. 5 SP 800-53A Assessment Procedures Guide
NIST SP 800-53A gives assessors a methodology and set of procedures for checking whether security and privacy controls are implemented correctly, operating as intended, and producing the desired outcome.
NIST SP 800-53 Rev. 5 vs CIS Controls Decision Guide
Decide when to use NIST SP 800-53 Rev. 5 or CIS Controls v8.1, how selection differs, and when control evidence can be reused.
NIST SP 800-53 Rev. 5 vs CIS Controls: practical side-by-side comparison
Compare NIST SP 800-53 Rev. 5 and CIS Controls v8.1 by scope, selection method, safeguards, assessment evidence, and assurance.
NIST SP 800-53 Rev. 5 vs ISO/IEC 27001: practical side-by-side comparison
Compare NIST SP 800-53 Rev. 5 with ISO/IEC 27001:2022 by scope, controls, ISMS requirements, evidence, and certification.
NIST SP 800-53 Rev. 5 vs NIST CSF 2.0: practical side-by-side comparison
Compare NIST SP 800-53 Rev. 5 and CSF 2.0 by scope, controls, outcomes, Profiles, Tiers, evidence, and assurance.
NIST SP 800-53 Rev. 5 vs NIST CSF Decision Guide
Decide when to use NIST SP 800-53 Rev. 5 or CSF 2.0, how controls relate to outcomes, and when evidence can support both.
NIST SP 800-53 Rev. 5 vs NIST SP 800-171 Decision Guide
Decide when to use NIST SP 800-53 Rev. 5 or SP 800-171 Rev. 3, how their scopes differ, and when control evidence can be reused.
NIST SP 800-53 Rev. 5 vs NIST SP 800-171 Rev. 3: practical side-by-side comparison
Compare NIST SP 800-53 Rev. 5 with SP 800-171 Rev. 3 by scope, adopting authority, CUI boundary, requirements, evidence, and assessment.
What evidence should teams collect for NIST SP 800-53A control assessments?
Collect evidence for each SP 800-53A determination statement, using the selected examine, interview, and test methods at the planned depth and coverage.
What should a POA&M item include for NIST SP 800-53 Rev. 5 control gaps?
A useful POA&M item identifies the finding, affected control and system, risk response, owner, milestones, status evidence, dependencies, and closure criteria.
When should teams select NIST control enhancements?
Select a control enhancement only with its base control, document the selection trigger and parameters, implement its added requirement, and assess it separately.