Control Baselines for Information Systems and Organizations

Joint Task Force

doi:https://doi.org/10.6028/NIST.SP.800-53B

NIST SP 800-53B

Control Baselines for Information Systems and Organizations

Documentation Topics

Date Published: September 2020 (includes updates as of Dec. 10, 2020)

Supersedes: SP 800-53B (10/29/2020)

Planning Note (08/27/2025):

On August 27, 2025, NIST issued a minor release of SP 800-53B (Release 5.2.0) that includes no changes to the baselines. The SP 800-53B version number was updated for consistency with SP 800-53 and SP 800-53A.

Author(s)

Joint Task Force

Abstract

This publication provides security and privacy control baselines for the Federal Government. There are three security control baselines (one for each system impact level—low-impact, moderate-impact, and high-impact), as well as a privacy baseline that is applied to systems irrespective of impact level. In addition to the control baselines, this publication provides tailoring guidance and a set of working assumptions that help guide and inform the control selection process. Finally, this publication provides guidance on the development of overlays to facilitate control baseline customization for specific communities of interest, technologies, and environments of operation.

Keywords

assurance; impact level; privacy control; privacy control baseline; security control; security control baseline; tailoring; control selection; control overlays

Control Families

None selected

Documentation

Publication:
https://doi.org/10.6028/NIST.SP.800-53B
Download URL

Supplemental Material:
SP 800-53B Release 5.2.0
Control Baselines spreadsheet (xlsx)
Security Control Overlay Repository (SCOR)
OSCAL GitHub
NIST news article

Publication Parts:
SP 800-53A Rev. 5
SP 800-53 Rev. 5

Document History:
12/10/20: SP 800-53B (Final)

Topics

Security and Privacy

cybersecurity supply chain risk management, general security & privacy, privacy, privacy controls, security controls, security programs & operations