O Oluma Cyber Security Framework Files · No. 05 Catalog · Security & Privacy Controls NIST SP 800-53 Not a framework — a library. The most comprehensive control catalog in security, and the federal government’s definitive answer to “which safeguards, exactly?” Rev 5 2020 · 5.x20 Families~1,196 Controls3 Baselines 853 20 FAM3 BASEREV5 How we’ll read this 01 The Problem02 Why It Exists03 The Story04 How It Works05 Example06 Who Uses It07 Career08 Strengths & Challenges09 Takeaway 01 The Problem “Protect access” isn’t specific enough High-level frameworks are great at direction and useless at precision. “Control access,” “monitor systems” — fine, but a federal agency authorizing a system needs to know exactly which safeguards, at what strength, and how to prove each one is in place. Without a shared, exhaustive catalog, every agency and contractor would invent its own list, and no one could compare, audit, or authorize consistently. What was needed was a definitive library of controls everyone could point to. 02 Why It Was Created The catalog behind federal security Under the Federal Information Security Modernization Act (FISMA), NIST was tasked with defining the controls that protect federal information systems. SP 800-53 is that catalog — the master list agencies, contractors, and FedRAMP cloud providers select from based on risk. The core ideaDon’t make everyone reinvent controls. Publish one rigorous, exhaustive catalog with precise, tailorable requirements — then let each system pull the subset its risk level demands. It’s deliberately a catalog, not a checklist: you never implement all of it — you select, tailor, and justify. 03 The Story Behind It Two decades of getting more precise 2002FISMA sets the mandateFederal law required standardized security for government information systems — and handed NIST the job of defining the controls. 2013 · Rev 4A mature catalogRevision 4 expanded coverage significantly and became the reference for FISMA and FedRAMP for years. 2020 · Rev 5Privacy comes insidePublished September 23, 2020. Privacy controls were integrated into the main catalog, every control was made outcome-based and technology-neutral, and two families — PT and SR — were added. 2025 · 5.xContinuous updatesNIST now maintains Rev 5 through incremental releases (e.g. 5.2) that address secure software development and evolving threats, rather than waiting years for a Rev 6. 04 How It Works 20 families, ~1,196 controls, 3 baselines The catalog is organized into 20 families, each a domain like Access Control or Incident Response. Inside are base controls and their enhancements — about 1,196 in total. You don’t face all of them: a companion document, 800-53B, defines three baselines by system impact. LowModerateHigh+ Privacy baseline Categorize your system’s impact, pull the matching baseline, then tailor — adjust organization-defined parameters and add enhancements where risk is higher. The full family set: AC Access Control AT Awareness & Training AU Audit & Accountability CA Assessment & Authorization CM Configuration Management CP Contingency Planning IA Identification & Auth IR Incident Response MA Maintenance MP Media Protection PE Physical & Environmental PL Planning PM Program Management PS Personnel Security PT PII Processing & Transparency RA Risk Assessment SA System & Services Acquisition SC System & Comms Protection SI System & Info Integrity SR Supply Chain Risk Mgmt How it stacks with the othersCSF says what outcomes to reach; the Risk Management Framework (800-37) is the process to authorize a system; 800-53 is the control catalog that process selects from. They’re layers, not rivals. 05 Real-World Example A contractor earns an authorization to operate A federal contractor is standing up a system that will hold government data. It can’t ship until it earns an Authorization to Operate — and 800-53 is the spine of that whole process. Their road to an ATOCategorize → select → tailor → document → authorize Categorize the system’s impact as Moderate Pull the Moderate baseline from 800-53B Tailor parameters and enhancements to the environment Document everything in a System Security Plan Get assessed (per 800-53A) and granted the ATO Every safeguard is now specific, documented, and testable — exactly what an authorizing official needs to sign. 06 Who Uses It Federal by law, rigorous by reputation 🏛️Federal agenciesMandatory under FISMA — the required control set for U.S. government information systems. ☁️FedRAMP & contractorsCloud providers and government contractors build their authorizations directly on 800-53 baselines. 🏢Private sectorIncreasingly adopted by non-government organizations that want the most rigorous available baseline. It also anchors other frameworks — much of the security world traces back to this catalog. underpins NIST 800-171CMMCFedRAMPmaps to CSFISO 27001 07 Career Relevance The deep end of GRC 800-53 is where GRC gets serious. The federal ecosystem — FISMA, FedRAMP, RMF — runs on it, and those skills command a premium, especially in government contracting. It’s dense, but mastering it means you can operate at the most rigorous end of the profession. ISSO / ISSMOwn the systemSelect, implement, and maintain the controls behind a system’s authorization to operate. Control assessorTest the evidenceUse 800-53A to assess whether each selected control is truly implemented and effective. GRC engineerAutomate the catalogMap baselines to real infrastructure and build the tooling that tracks 1,196 controls without drowning — exactly the Python/PowerShell automation that turns GRC theory into scale. Fluency here signals you can handle the most demanding compliance environments that exist. 08 Strengths & Challenges Honest trade-offs ✦ Strengths The most comprehensive control catalog available Precise, testable, and authoritative Baselines + tailoring keep it risk-appropriate Anchors 800-171, CMMC, FedRAMP, and more Privacy now built into the core catalog ⚠ Challenges Dense and genuinely overwhelming at first Federal in flavor — heavy for small private orgs Needs RMF or CSF to give it shape and order Documentation- and assessment-intensive 09 Final Takeaway When “be secure” has to become 1,196 specific, testable requirements, this is the catalog everything else points back to.It’s not where beginners start — it’s where the discipline bottoms out. CSF frames the outcomes, RMF runs the process, and 800-53 supplies the exact controls underneath them both. Learn to navigate it with baselines and tailoring, and no compliance environment is out of reach.