Control Baselines for Information Systems and Organizations

Joint Task Force

doi:https://doi.org/10.6028/NIST.SP.800-53B

SP 800-53B

Control Baselines for Information Systems and Organizations

Documentation Topics

Date Published: September 2020 (includes updates as of Dec. 10, 2020)

Supersedes: SP 800-53B (10/29/2020)

Planning Note (1/7/2022):

The Control Baselines Spreadsheet has been updated:

Note: For a spreadsheet of the entire security and privacy control catalog, see the 800-53 Rev. 5 details.

Author(s)

Joint Task Force

Abstract

This publication provides security and privacy control baselines for the Federal Government. There are three security control baselines (one for each system impact level—low-impact, moderate-impact, and high-impact), as well as a privacy baseline that is applied to systems irrespective of impact level. In addition to the control baselines, this publication provides tailoring guidance and a set of working assumptions that help guide and inform the control selection process. Finally, this publication provides guidance on the development of overlays to facilitate control baseline customization for specific communities of interest, technologies, and environments of operation.

Keywords

assurance; impact level; privacy control; privacy control baseline; security control; security control baseline; tailoring; control selection; control overlays

Control Families

None selected

Documentation

Publication:
SP 800-53B (DOI)
Local Download

Supplemental Material:
Control Baselines spreadsheet (xls)
Security Control Overlay Repository (SCOR) (web)
OSCAL [an OSCAL version of 800-53B is in development] (web)
NIST news article (web)

Other Parts of this Publication:
SP 800-53 Rev. 5

Document History:
12/10/20: SP 800-53B (Final)

Topics

Security and Privacy
cybersecurity supply chain risk management; general security & privacy; privacy; privacy controls; security controls; security programs & operations