NIST SP 800-53 Revision 5: Security and Privacy Controls for Information Systems and Organizations
The authoritative federal control catalog organizing technical, operational, and management security and privacy controls into 20 control families.
Primary source
NIST SP 800-53 Revision 5 →https://csrc.nist.gov/pubs/sp/800/53/r5/final
Verified May 23, 2026 · This is the authoritative regulator URL. The summary below is a research aid; the linked source controls.
NIST SP 800-53 Revision 5 ("Security and Privacy Controls for Information Systems and Organizations", September 2020 with subsequent updates) is the authoritative federal control catalog. It is the controls source referenced by NIST CSF Subcategories and the Federal Information Security Modernization Act (FISMA) baselines.
Revision 5 changes from Revision 4:
- Privacy controls fully integrated rather than maintained as a separate appendix.
- Outcome-based language for each control.
- Supply-chain risk management family added (SR family).
- Personal Identifiable Information (PII) processing and transparency family added (PT family).
The catalog contains over 1,000 controls organized into 20 families: AC (Access Control), AT (Awareness and Training), AU (Audit and Accountability), CA (Assessment, Authorization, and Monitoring), CM (Configuration Management), CP (Contingency Planning), IA (Identification and Authentication), IR (Incident Response), MA (Maintenance), MP (Media Protection), PE (Physical and Environmental Protection), PL (Planning), PM (Program Management), PS (Personnel Security), PT, RA (Risk Assessment), SA (System and Services Acquisition), SC (System and Communications Protection), SI (System and Information Integrity), SR (Supply Chain Risk Management).
For HIPAA contexts, 800-53 r5 is most often used as the source-of-truth control catalog when implementing CSF or 800-66 r2 mappings — particularly for technical safeguards where the rule's text is intentionally sparse.
Use this in your workspace
D3rx assembles the documentation linked to this regulation, walks the practical decisions in plain English, and stores the artifacts against the .gov sources cited above. It is an administrative research aid, not a substitute for counsel.
Related regulations
D3rx is a healthcare-billing and compliance research aid maintained by D3rx Inc. Articles are drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and reviewed for restraint and source fidelity by the D3rx team.
Reviewer status: a named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged. Until that engagement is finalized, this page does not claim credentialed review.
Related across the archive
- RegulationNIST Cybersecurity Framework 2.0The 2024 update to the NIST CSF added the Govern function alongside Identify, Protect, Detect, Respond, and Recover — providing a common language for organizational cybersecurity risk management.
- RegulationNIST SP 800-63B: Digital Identity Guidelines (Authentication and Lifecycle Management)Federal authentication framework defining three Authenticator Assurance Levels (AAL1, AAL2, AAL3), authenticator types, and lifecycle requirements.
- RegulationNIST SP 800-66 Revision 2: HIPAA Security Rule Cybersecurity Resource GuideNIST's 2024 update to the implementation guide for the HIPAA Security Rule, mapping the rule's standards to NIST Cybersecurity Framework subcategories and current cybersecurity practices.
- RegulationNIST SP 800-88 Revision 1: Guidelines for Media SanitizationFederal reference for sanitizing electronic media — Clear, Purge, and Destroy categories — with method selection based on media type and confidentiality of the data.
Last reviewed May 23, 2026 · Citation verified May 23, 2026
Research aid, not legal advice. This summary is an administrative research aid prepared by D3rx. It does not certify compliance, provide legal advice, replace counsel, or guarantee an audit outcome. For authoritative regulatory text follow the primary source link at the top of this page. The practice remains responsible for reviewing, adopting, and maintaining its compliance program.