Cybersecurity Database

Guideline / framework / standard

Security and Privacy Controls for Information Systems and Organizations (NIST SP 800-53 Rev. 5)

In force since September 2020Record checked against the official source on 29 October 2026 · Methodology

Official source: https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final

Official sourceDownload PDF (official source)
Official number
NIST SP 800-53 Rev. 5
Date adopted

Summary

SP 800-53 is NIST's catalogue of security and privacy controls, mandatory for US federal information systems under FISMA and used worldwide as a reference for security programmes. It organises more than a thousand controls and enhancements into 20 families, from access control to incident response, supply chain and privacy. Revision 5 makes the controls independent of the type of organisation and merges privacy and security into a single catalogue. The baselines for low, moderate and high impact systems are in SP 800-53B and the assessment procedures in SP 800-53A.

Key dates

  1. Update with errata (Release 5.1)
  2. Release 5.2.0, with new controls on software updates and patches

Information

Jurisdiction
United States
Issuing body
National Institute of Standards and Technology (NIST)
Type
Guideline / framework / standard
Available languages
English
Topics
Notes
Supersedes Revision 4 of 2013. Release 5.2.0 of 27 August 2025, issued under Executive Order 14306, adds controls SA-15(13), SA-24 and SI-02(07) without changing the baselines; the updated catalogue is also available in OSCAL format. The linked PDF is the Release 5.1 edition.

Record details

Original title
Security and Privacy Controls for Information Systems and Organizations (NIST SP 800-53 Rev. 5)
Title in other languages
  • Controlli di sicurezza e privacy per i sistemi informativi e le organizzazioni (NIST SP 800-53 Rev. 5)
  • Mesures de sécurité et de protection de la vie privée pour les systèmes d'information et les organisations (NIST SP 800-53 Rev. 5)
  • Controles de seguridad y privacidad para sistemas de información y organizaciones (NIST SP 800-53 Rev. 5)
  • Sicherheits- und Datenschutzkontrollen für Informationssysteme und Organisationen (NIST SP 800-53 Rev. 5)
Licence / terms of use
Public domain / official act – US federal government publication, not subject to copyright in the United States.
Collected from
manual entry
Last verified
(verified via web)

How to cite

APA

National Institute of Standards and Technology (NIST). (2020). Security and Privacy Controls for Information Systems and Organizations (NIST SP 800-53 Rev. 5) (NIST SP 800-53 Rev. 5). https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final

Chicago

National Institute of Standards and Technology (NIST). "Security and Privacy Controls for Information Systems and Organizations (NIST SP 800-53 Rev. 5)." September 2020. https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final.

BibTeX

@misc{us_nist_sp_800_53r5_2020,
  author       = {{National Institute of Standards and Technology (NIST)}},
  title        = {{Security and Privacy Controls for Information Systems and Organizations (NIST SP 800-53 Rev. 5)}},
  year         = {2020},
  note         = {NIST SP 800-53 Rev. 5},
  url          = {https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final},
  urldate      = {2026-10-29}
}

Metadata and summary: CC BY 4.0 · JSON