Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Projects NIST Risk Management Framework SP 800-53 Controls SCOR Overview

NIST Risk Management Framework RMF

Overlay Archive

The following overlays are maintained for archival purposes only. They are either not based on the current security and privacy controls in NIST SP 800-53 or the overlay contact information is no longer accurate.

Overlay Name:  NIST SP 800-177, Rev. 1, Email Messaging Systems 

Overlay Publication Date: February 19, 2019

Technology or System: Email Messaging Systems 

Overlay Author: Scott Rose, NIST

Overview: Overlay for email messaging systems using the SP 800-53, Revision 4 controls. Email system is taken to mean any system (as defined by FIPS 199), that is said to generate, send, or store email messages for an enterprise. Refer to Appendix C for the Email Messaging Systems Overlay.

Overlay Point of Contact: Scott Rose

Overlay Name: Closed Isolated Network 

Overlay Publication Date: October 2020

Technology or System: Closed Isolated Network

Overlay Author: US Army Europe

Overview: A Closed Isolated Network is defined as a data communications enclave that operates in a single security domain, implements a security policy administered by a single authority, does not connect to any other network and has a single, common, continuous security perimeter.

Overlay Point of Contact: n/a

Overlay Name: Electronic Physical Access Control System

Overlay Publication Date: April 2021

Technology or System: Electronic Physical Access Control System (ePACS)

Overlay Author: PACS Modernization Working Group (PACSmod WG)

Overview: Electronic Physical Access Control Systems (ePACS) use a combination of IT components and physical security elements (e.g., card readers, doors/locks) to enable access to real-world resources such as secured facilities or controlled areas within facilities. This overlay provides a standardized template for Chief Security Officers (CSOs) and other ePACS professionals working to secure Federal facilities in a secure and interoperable fashion. Additionally, it should help to inform those Authorizing Officials (AOs) asked to evaluate the cyber specific risks posed to the IT infrastructure comprising its ePACS.

Overlay Point of Contact: n/a

Overlay Name: Federal Public Key Infrastructure (PKI) Systems

Overlay Publication Date: April 2021

Technology or System: Federal PKI Systems

Overlay Author: Federal PKI Policy Authority

Overview: The Federal Public Key Infrastructure (FPKI) provides the U.S. Government with a common baseline to administer digital certificates and public-private key pairs used to support trust of some government devices and persons. This overlay was developed by the Federal Public Key Infrastructure Policy Authority (FPKIPA) to provide additional specifications and protections for PKIs participating in the FPKI.

Overlay Point of Contact: n/a

Return to Control Overlay Repository Overview

Disclaimer Statement
The National Institute of Standards and Technology (NIST) has established the Security Overlay Repository as a public service. Security control overlays are made available by NIST on an “AS IS” basis with NO WARRANTIES   Some submitted overlays may be available for free while others may be made available for a fee.  It is the responsibility of the User to comply with the Terms of Use of any given overlay. Overlay users are solely responsible for determining the appropriateness of using and distributing the security control overlays.  User assumes all risks associated with their use, including but not limited to compliance with applicable laws; damage to or loss of data, programs or equipment; and the unavailability or interruption of operation. NIST MAKES NO WARRANTY OF ANY KIND, EXPRESS, IMPLIED OR STATUTORY, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT AND DATA ACCURACY

Contacts

NIST Risk Management Framework Team
[email protected]

Created November 30, 2016, Updated September 23, 2026