How many controls are in NIST 800-53?

Release 5.2.0 of Revision 5 has 1,014 active controls and enhancements: 300 base controls and 714 enhancements in 20 families. The catalog lists 1,196 entries, but 182 of them are withdrawn.

What are the 20 NIST 800-53 control families?

AC Access Control, AT Awareness and Training, AU Audit and Accountability, CA Assessment, Authorization, and Monitoring, CM Configuration Management, CP Contingency Planning, IA Identification and Authentication, IR Incident Response, MA Maintenance, MP Media Protection, PE Physical and Environmental Protection, PL Planning, PM Program Management, PS Personnel Security, PT PII Processing and Transparency, RA Risk Assessment, SA System and Services Acquisition, SC System and Communications Protection, SI System and Information Integrity, and SR Supply Chain Risk Management.

How many controls are in the NIST 800-53 Moderate baseline?

287 controls and enhancements in SP 800-53B release 5.2.0. The Low baseline has 149, the High baseline 370 and the Privacy baseline 96.

What is the latest version of NIST 800-53?

Revision 5, release 5.2.0, published August 27, 2025. It added SA-15(13), SA-24 and SI-02(07). None of the three is in a baseline.

Is NIST 800-53 mandatory?

For federal information systems, yes, under FISMA and FIPS 200, and for contractors and cloud providers whose contracts require it. For other organizations it's voluntary.

Is there a NIST 800-53 certification?

No. NIST doesn't certify organizations. A federal system receives an authorization to operate (ATO), and cloud services receive a FedRAMP authorization based on 800-53.

What is the difference between NIST 800-53 and 800-171?

800-53 is the full control catalog for federal systems. 800-171 is a smaller set of requirements, derived from 800-53, for protecting CUI on contractor systems: 110 requirements in Revision 2, which DoD contracts use today.

Is there a NIST 800-53 controls list in Excel?

Yes. The free workbook on this page lists every active control and enhancement with its NIST text and baselines, and lets you track status, owner and evidence.

NIST 800-53 Controls List and Checklist (Free Excel)

NIST SP 800-53 is the catalog of security and privacy controls behind federal systems, FedRAMP and many corporate security programs. Revision 5 has 20 control families and, in the current release 5.2.0, 1,014 active controls and enhancements. Nobody implements all of them: you pick a baseline, tailor it, and prove each control works.

This page gives you the NIST 800-53 controls list in a form you can use. You get the 20 families with their counts, the Low, Moderate and High baselines, a checklist that follows the Risk Management Framework, and the controls that live on laptops and phones.

Download the full list as an Excel workbook: every control and enhancement with its NIST text, the baselines it belongs to, a baseline picker, and columns for status, owner and evidence. A short PDF guide comes with it.

In short

SP 800-53 Rev. 5 is at release 5.2.0 (August 2025): 20 families, 300 controls and 714 enhancements in force.
You don't implement the whole catalog. SP 800-53B baselines select 149 (Low), 287 (Moderate) or 370 (High) controls and enhancements.
It's required for federal systems and the contractors and cloud providers that run them. Everyone else can use it voluntarily.
There is no 800-53 certification. Federal systems get an authorization to operate (ATO).
Device controls such as CM-08 inventory, SI-02 patching and SC-28 encryption at rest are a practical place to start.

What is NIST 800-53?

NIST Special Publication 800-53, "Security and Privacy Controls for Information Systems and Organizations", is a catalog of safeguards. Each control says what to do, such as "Develop and document an inventory of system components". It leaves the how to you, with organization-defined values you fill in, like how many minutes of inactivity before a screen locks.

Revision 5 came out in September 2020. It dropped "Federal" from the title, made the controls outcome-based, merged privacy controls into the catalog, and added the Supply Chain Risk Management (SR) and PII Processing and Transparency (PT) families. NIST has updated it since, most recently with release 5.1.1 in November 2023 and release 5.2.0 in August 2025, which is current.

Who has to follow it

Federal agencies. FISMA and FIPS 200 require agencies to use SP 800-53 controls on their information systems.
Contractors and cloud providers that run federal systems. The agency's contract carries the requirement. FedRAMP authorizations for cloud services are based on 800-53.
Everyone else, voluntarily. Other organizations can use 800-53 as a detailed control catalog, for example behind the NIST Cybersecurity Framework.

If you handle Controlled Unclassified Information (CUI) under a DoD contract, the document you need is SP 800-171, which is derived from 800-53. See our NIST 800-171 compliance checklist.

There is no 800-53 certification. NIST does not certify organizations. A federal system gets an authorization to operate (ATO) from the agency, and a cloud service gets a FedRAMP authorization. Our guide to NIST compliance explains how the three NIST documents fit together.

The 20 NIST 800-53 control families

Every control ID starts with its family's two-letter code: AC-02 is Account Management in the Access Control family, and AC-02(01) is its first enhancement. Release 5.1.1 added the leading zero, so you'll see AC-2 and AC-02 for the same control.

ID	Family and what it covers	Controls	Enhancements	In Moderate
AC	Access Control Accounts, least privilege, remote access, session and device lock, mobile devices	23	108	39
AT	Awareness and Training Security and privacy awareness training, role-based training	5	10	6
AU	Audit and Accountability What gets logged, how long logs are kept, who reviews them	15	41	16
CA	Assessment, Authorization, and Monitoring Control assessments, the ATO, the POA&M, continuous monitoring	8	17	10
CM	Configuration Management Baseline configurations, settings, change control, inventory, allowed software	14	42	24
CP	Contingency Planning Contingency plans, backups, alternate sites, recovery	12	37	23
IA	Identification and Authentication Identifying and authenticating users and devices, MFA, passwords	13	46	24
IR	Incident Response Incident response plans, handling, reporting and testing	9	31	13
MA	Maintenance Controlled maintenance, tools and maintenance staff	7	21	9
MP	Media Protection Protecting, transporting and sanitizing media, including USB storage	8	12	7
PE	Physical and Environmental Protection Physical access, visitors, power, fire and environmental protection	22	29	18
PL	Planning Security and privacy plans, rules of behavior, architecture	8	3	7
PM	Program Management The organization-wide program; not in the security baselines	32	5	0
PS	Personnel Security Screening, transfers and terminations, access agreements	9	8	9
PT	Personally Identifiable Information Processing and Transparency How personal data is processed: authority, purpose, consent, notices	8	13	0
RA	Risk Assessment Categorization, risk assessments, vulnerability scanning	9	13	10
SA	System and Services Acquisition Buying and building systems securely, developer testing	17	91	17
SC	System and Communications Protection Boundary protection, encryption in transit and at rest	47	92	25
SI	System and Information Integrity Patching, malware protection, system monitoring, integrity	22	80	18
SR	Supply Chain Risk Management Supply chain risk plans, supplier assessments, provenance	12	15	12
	Total	300	714	287

The 20 SP 800-53 control families, with active controls and enhancements and how many the Moderate baseline selects

The catalog has 1,196 entries in total, but 182 of them are withdrawn: moved or folded into other controls. That's why you'll see "1,196 controls" on some sites. The number in force is 1,014. The Excel workbook has a tab listing every withdrawn item and where it went.

NIST 800-53 baselines: Low, Moderate, High and Privacy

SP 800-53B gives you a starting set of controls for each impact level. You find your level with FIPS 199: rate the harm if the system's confidentiality, integrity or availability were lost as Low, Moderate or High. The highest of the three sets the baseline.

The SP 800-53B baselines: Low 149, Moderate 287 and High 370 controls and enhancements, plus a Privacy baseline of 96

Baseline	Controls plus enhancements	When it applies
Low	149	A loss would have a limited adverse effect.
Moderate	287	A loss would have a serious adverse effect.
High	370	A loss would have a severe or catastrophic effect.
Privacy	96	The system processes personal data. Used alongside a security baseline.

Two things often trip people up. First, controls aren't labeled Low, Moderate or High: the baselines select them, and the same control can appear in all three with more enhancements at the higher levels. Second, the Program Management (PM) family isn't in the Low, Moderate or High baselines (the Privacy baseline selects some PM controls). You implement it once for the whole organization.

Tailoring the baseline

Remove controls that don't apply to the system, and record why.
Add controls your risk calls for. 591 active controls and enhancements are in no baseline at all.
Fill in every organization-defined value. The Excel workbook shows them in the control text as [Assignment: ...] and [Selection: ...].
Mark common controls you inherit from the organization or a cloud provider, so you don't test them twice.

NIST 800-53 compliance checklist: 23 steps

800-53 is used through the Risk Management Framework (SP 800-37). The checklist below follows its seven steps. The control IDs are the main 800-53 controls behind each step.

Prepare

	What to do	800-53
☐	Name the authorizing official, the system owner and the security owner.	PM-02, PM-10
☐	Define the system boundary: what's in it, and what's inherited.	PL-02
☐	Write the risk management strategy and the risk tolerance.	PM-09

Categorize

	What to do	800-53
☐	List the information types the system handles.	RA-02
☐	Rate confidentiality, integrity and availability with FIPS 199, and get the result approved.	RA-02

Select

	What to do	800-53
☐	Start from the matching baseline.	PL-10
☐	Tailor it, and fill in the organization-defined values.	PL-11
☐	Add the Privacy baseline if the system processes personal data.	PL-10, PT-01
☐	Write the continuous monitoring strategy.	CA-07

Implement

	What to do	800-53
☐	Keep a complete inventory of hardware and software.	CM-08
☐	Set baseline configurations and enforce them on every device.	CM-02, CM-06
☐	Turn on MFA for privileged and non-privileged accounts.	IA-02(01), IA-02(02)
☐	Encrypt data at rest on laptops and mobile devices.	SC-28, AC-19(05)
☐	Patch on a schedule and scan for vulnerabilities.	SI-02, RA-05
☐	Log security events and review them.	AU-02, AU-06
☐	Back up, and test a restore.	CP-09, CP-04
☐	Describe each control in the system security plan (SSP).	PL-02

Assess

	What to do	800-53
☐	Test each control and record the results in a security assessment report (SAR).	CA-02
☐	Open a POA&M item for every weakness, with an owner and a date.	CA-05

Authorize

	What to do	800-53
☐	Give the SSP, SAR and POA&M to the authorizing official for a decision.	CA-06

Monitor

	What to do	800-53
☐	Assess a share of the controls every year.	CA-07
☐	Check changes for security impact before they go live.	CM-04
☐	Keep the SSP, SAR and POA&M current.	CA-07, PL-02

The Implement step is where the bulk of the work sits, so the Excel workbook lists every control in your baseline with a status, an owner and an evidence column. The PDF has this same checklist on two printable pages.

What changed in NIST 800-53 release 5.2.0

Release 5.2.0 came out on August 27, 2025. It is a minor release that responds to Executive Order 14306 on software update and patch security. It added three items:

ID	Name	What it asks for
SA-15(13)	Logging Syntax	Developers use a consistent, documented logging syntax.
SA-24	Design for Cyber Resiliency	Design systems to meet defined cyber resiliency goals and objectives.
SI-02(07)	Root Cause Analysis	Find the root cause of flaws, act on it and check the fix works.

None of the three is in a baseline, so a baseline-driven program doesn't have to add them unless tailoring calls for it. The release also widened SI-07(12) integrity verification to all organization-defined software and updated the discussion text of several patching controls. SP 800-53B had no content changes.

The 800-53 controls that live on laptops and phones

Many 800-53 controls are policies and plans. A smaller set is enforced on each device, and assessors can often test those with a report. Most of them are in the Moderate baseline; CM-07(04) is in no baseline, so you add it when tailoring.

SP 800-53 controls a device management tool can support, such as CM-08 inventory, SI-02 OS updates and SC-28 encryption at rest

CM-08 System Component Inventory. Every device, with owner and location. Every other device control depends on it.
CM-02 and CM-06. A documented baseline configuration and the settings that enforce it, such as passcode, encryption, USB and firewall.
CM-07(04) and CM-07(05). Block unauthorized software (deny-by-exception) or allow only approved software (allow-by-exception).
SI-02 Flaw Remediation. Install security updates within the time you set, and keep the record.
RA-05 Vulnerability Monitoring and Scanning. Scan, rank the findings, fix them.
AC-11 Device Lock and IA-05 Authenticator Management. Screen lock after inactivity and passcode rules.
SC-28(01) and AC-19(05). Encrypt data at rest, including full-device or container encryption on mobile devices. If you need FIPS-validated cryptography (SC-13), confirm how the operating system's encryption is configured.
MP-07 Media Use. Restrict USB storage.
IR-04 and MP-06. Lock or wipe a lost device as part of incident handling (IR-04), and wipe devices before reuse (MP-06).

Some controls are not device-management work: malware protection (SI-03) comes from your EDR or antivirus, system monitoring (SI-04) from your detection tools, and device authentication to the network (IA-03) from network access control.

The evidence assessors ask for

An assessor tests controls by examining documents, interviewing people and testing systems. Keep these current and dated:

Evidence	Controls	Suggested refresh
System security plan (SSP), with the boundary and how each control is implemented	PL-02	On every significant change
Security categorization, approved	RA-02	On every significant change
Hardware and software inventory export	CM-08	Monthly
Configuration baseline and a compliance report against it	CM-02, CM-06	Monthly
Patch status and vulnerability scan results	SI-02, RA-05	Monthly
Encryption status per device	SC-28	Monthly
Access reviews and MFA enrollment	AC-02, IA-02	Quarterly
Incident response plan and test results	IR-08, IR-03	Yearly
Backup restore test	CP-09, CP-04	Yearly
Security assessment report (SAR) and the POA&M	CA-02, CA-05	Yearly, POA&M monthly

The frequencies are suggestions. Your organization-defined values and your assessor set the real ones.

NIST 800-53 vs 800-171 vs the CSF

	SP 800-53 Rev. 5	SP 800-171	CSF 2.0
What it is	Catalog of controls	Requirements for protecting CUI	Outcomes to aim for
Size	1,014 controls and enhancements, 20 families	110 requirements (Rev. 2); 97 in Rev. 3	6 functions, 106 subcategories
Who must use it	Federal systems	Contractors with CUI	Voluntary for most
Proof	Authorization to operate	SPRS score, CMMC	Self-assessment

They are built to work together: the CSF says what outcomes you need, 800-53 supplies the controls, and 800-171 is derived from 800-53 for contractors. Our NIST compliance checklist maps one set of tasks to all three, and NIST vs ISO 27001 compares 800-53 with ISO.

Download the NIST 800-53 controls list (Excel and PDF)

Preview of the NIST 800-53 controls list PDF guide

Controls tab: all 1,014 active controls and enhancements with the NIST control text, baselines, a device flag, and status, owner, evidence and due-date columns. Filters are on.
Dashboard: pick Low, Moderate, High or Privacy, and see how many controls each family needs and how far along you are.
Families, Device controls, POA&M, Withdrawn and What changed in 5.2.0 tabs.
PDF guide: the families, the baselines, the checklist on two printable pages, and the device controls.

More NIST guides for IT teams

How trio.so helps with the device controls

Your 800-53 program, its documents and its authorization stay with your organization. trio.so supports the device controls from one console:

Inventory (CM-08): every enrolled Windows, Mac, iOS and Android device.
Configuration (CM-02, CM-06, AC-11, IA-05): passcode, screen lock, USB and firewall settings enforced as policy, with USB and firewall on Mac and Windows.
Encryption (SC-28, AC-19(05)): enforce BitLocker and FileVault on laptops and encryption on phones, and see encryption status per device.
Patching and vulnerabilities (SI-02, RA-05): OS update enforcement on Windows, macOS, iOS and Android, and vulnerability findings ranked by CVSS, EPSS and CISA KEV.
Software (CM-07): app allow and block lists.
Incidents (IR-04, MP-06): lock lost Macs, iPhones and Android devices, and wipe company-owned devices.
Evidence (AU-02, CA-07): an admin event log of console actions with export, and compliance evidence you can export for your assessor.

Start free trial Book a demo

14-day free trial. No credit card required.

Sources. Last reviewed October 2026. Counts are taken from NIST's OSCAL catalog and baseline profiles, release 5.2.0. The device mapping is ours, not NIST's. This article is guidance, not legal advice.