NIST SP 800-53

1. 2026-09-22 Medium
   GovRAMP releases guidance on phishing-resistant MFA compliance requirements

   GovRAMP has released comprehensive guidance to help Service Providers understand and implement phishing-resistant MFA requirements under GovRAMP Rev. 5. The guidance clarifies which authentication methods meet …

   Guidance Action required

2. 2026-09-15 Medium
   CISA and NIST release guidelines to protect federal cloud identity systems from token theft, forgery…

   CISA and NIST released Interagency Report (IR) 8587 providing comprehensive guidelines for federal agencies and cloud service providers to defend identity tokens and assertions used in …

   New document Action required

1. 2025-09-02 Executive Order 14306 deadline for NIST to update SP 800-53 with guidance on securely and reliably deploying patches and updates (met by Release 5.2.0)
2. 2025-08-27 Release 5.2.0 of SP 800-53 and SP 800-53A published; SP 800-53B re-released unchanged
3. 2025-08-14 NIST concept paper on SP 800-53 control overlays for securing AI systems (COSAiS) opened for comment
4. 2023-11-07 Release 5.1.1 (first patch release, one new control and three enhancements) published

1. 2025-08-27
   SP 800-53 Rev. 5, Release 5.2.0 AmendmentCurrent text

   Minor release issued in response to Executive Order 14306, focused on secure and reliable software updates and patches. source

   More

   • New controls and enhancements SA-15(13), SA-24 and SI-02(07); revised SI-07(12); updated discussion in SA-04, SA-05, SA-08, SA-08(14), SI-02 and SI-02(05).
   • SP 800-53A got matching assessment procedures; the SP 800-53B baselines did not change but were re-released for consistency.
2. 2025-07-22
   SP 800-53 Release 5.2.0 (draft controls) Draft

   Proposed controls on secure and reliable patches and updates released for an expedited public comment period that ran through 5 August 2025. source

3. 2023-11-07
   SP 800-53 Rev. 5, Release 5.1.1 Amendment

   First "patch release", issued through NIST's online reference tool (CPRT). source

   More

   • Added one new control with three enhancements on identity providers and authorization servers, introduced leading zeros in control identifiers (AC-1 became AC-01) and made minor editorial clarifications.
   • The new items are not in any SP 800-53B baseline, and organizations may defer them until Release 6.0.0.
4. 2020-12-10
   SP 800-53 Rev. 5 (errata update) Errata source

   Not confirmed by an official source yet.

5. 2020-09-23
   SP 800-53 Rev. 5 Major version

   Controls made outcome-based (no longer naming who satisfies them), security and privacy controls merged into one catalog, a new supply chain risk management (SR) family added, and the baselines and tailoring guidance moved out to SP 800-53B. source

   More

   • New controls cover cyber resiliency, secure design and governance.
   • "Federal" was dropped from the title.

FIPS 200 requires federal agencies to use the security controls in SP 800-53; nongovernmental organizations may use SP 800-53 voluntarily.

Federal agencies

FIPS 200, a mandatory federal standard, requires federal agencies to meet minimum security requirements by using the security controls in SP 800-53. source

Scope

It covers all federal information and systems except classified information and national security systems. source

Time to comply

When NIST revises the controls or baselines, agencies get up to one year from final publication to comply. source

Risk Management Framework

OMB Circular A-130 requires agencies to run the Risk Management Framework that selects these controls. source

Other organizations

Nongovernmental organizations may use SP 800-53 voluntarily. source

Federal systems are assessed with the SP 800-53A procedures; an agency authorizing official then grants an authorization to operate, followed by continuous monitoring.

Certification

NIST does not offer or endorse any program or tool for compliance with its risk management guidance. source

Assessment

Federal systems implement a baseline from SP 800-53B and are assessed with the SP 800-53A procedures. source source

Authorization

An agency authorizing official then grants an authorization to operate under the Risk Management Framework (SP 800-37), followed by continuous monitoring. source

Cloud services

Cloud services reach agencies through FedRAMP, whose baselines are built on SP 800-53 Rev. 5. source

NIST is not a regulatory agency. Federal agencies report under FISMA, and their security programs must also cover systems that contractors provide or manage.

Not a regulator

NIST is not a regulatory agency. source

Federal agencies

Federal agencies provide FISMA reports in accordance with processes established by OMB and DHS. source

Waivers

FIPS 200 allows no waivers to FIPS made mandatory by the Secretary of Commerce. source

Contractors

FISMA requires each agency's information security program to cover systems provided or managed by another agency, a contractor or another source. source

1. Standard NIST SP 800-53 Rev. 5 (PDF, includes updates as of 10 December 2020)
2. Standard SP 800-53 Rev. 5 publication page (Release 5.2.0 PDF and summary of changes, mappings, OSCAL)
3. Standard NIST SP 800-53A Rev. 5 – Assessing Security and Privacy Controls
4. Standard NIST SP 800-53B – Control Baselines for Information Systems and Organizations
5. FAQ SP 800-53 Release 5.1.1 FAQ (patch releases, Release 6.0.0)

1. NIST SP 800-37

   SP 800-37 is the Risk Management Framework process (categorize, select, implement, assess, authorize, monitor); SP 800-53 is the catalog of controls that process selects from.

2. NIST SP 800-171

   SP 800-171 is a smaller set of requirements for CUI on nonfederal (contractor) systems, derived from the SP 800-53 moderate baseline.

3. FedRAMP

   FedRAMP is the government-wide authorization program for cloud services; its baselines are SP 800-53 Rev. 5 with cloud-specific additions.

4. NIST CSF

   The CSF describes high-level cybersecurity outcomes for any organization; SP 800-53 is a detailed control catalog that the CSF cites as a reference.

5. ISO 27001

   ISO/IEC 27001 is a certifiable management-system standard; NIST publishes a crosswalk from SP 800-53 Rev. 5 to ISO/IEC 27001:2022.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 7 September 2026. Subscribe to NIST SP 800-53 (RSS)