What category of publication this is
NIST Special Publication 800-53 Revision 5 is the subject. The official title is Security and Privacy Controls for Information Systems and Organizations. It is a catalog of security and privacy controls. Organizations select controls from it and tailor them to the system, the mission, and the risk. It is a vocabulary to choose from. Not every control applies to every system.
Federal agencies use the catalog inside their risk management programs. Many contracts and programs point to it. A private company is not automatically obligated to use it. It is not a single mandatory list for every private company. Whether a real organization has an obligation depends on law, contract, or program terms. Counsel and the program owner decide that question.
Edition covered
SP 800-53 Revision 5, current minor release Release 5.2.0, issued 27 August 2025. DOI 10.6028/NIST.SP.800-53r5. The CSRC Final page is csrc.nist.gov/pubs/sp/800/53/r5/upd1/final. NIST announced the release in the CSRC news item NIST Releases Revision to SP 800-53 Controls. The short form of Revision 5, Release 5.2.0 (27 August 2025) is SP 800-53 Rev.5 Rel 5.2.0.
NIST issued Release 5.2.0 in response to Executive Order 14306, with updates focused on software update and patch reliability. If a newer release or revision appears, this pin must change. The older claim is then UNKNOWN.
Catalog, baseline, and assessment are three documents
Three documents have three jobs. SP 800-53 is the catalog of controls to choose from. SP 800-53B holds the control baselines, which are initial selections that an organization then tailors. SP 800-53A holds the assessment procedures. Those procedures show how someone checks whether selected controls are in place and work as intended. Catalog is not baseline, and baseline is not assessment.
In the Risk Management Framework (NIST SP 800-37: the Risk Management Framework), selection and assessment are the Select and Assess steps.
Obligation or borrowed language
The claim "we use 800-53" can have two different senses. The first sense is obligation. A law, contract, or program requires the organization to select, implement, and assess controls from the catalog. An owner decides how to tailor them. The second sense is borrowed language. The team uses 800-53 control language as a vocabulary to describe its own practices, with no external obligation behind it. Both are legitimate, but they are not the same claim.
In either case, the exact revision and release go into every control map, for example Revision 5, Release 5.2.0. That way, nobody cites an older set by accident. A map to a vendor feature list is a first note, not a finished selection. The work is to select, tailor, and show evidence.
Why the controls stay in the official catalog
The controls are in the official catalog. NIST publishes SP 800-53 Release 5.2.0 through the CSRC publication page and the Cybersecurity and Privacy Reference Tool (CPRT). The habit is to read the controls there, from the source, at the pinned release.
Control identifiers are not a worksheet to implement every policy.
Rewrite the one-line claim
The claim "we are NIST, FedRAMP, CMMC, and 171 compliant" mixes four objects. Separate sentences replace it. One example sentence is "We borrow SP 800-53 Revision 5, Release 5.2.0 control language to describe our practices." A second is "Our cloud offering has, or does not have, a FedRAMP Authorization." A third is "Our contract does, or does not, require SP 800-171 for CUI and a CMMC assessment." Each clause has its own owner and evidence.
At work, the team privately asks which revision and release appear in the control maps of the team. The team also asks whether it has an obligation or uses borrowed language.
The catalog is not a sticker, not FedRAMP, not FISMA done, and not SP 800-171 or CMMC
| Phrase people use | Literacy correction |
|---|---|
| We implemented NIST, or 800-53, so we are NIST compliant | SP 800-53 is a catalog to select and tailor from. A "NIST compliant" sticker is folklore. What matters is whether there is an obligation, and how controls were tailored. Reference card: /reference/frameworks/nist-sp-800-53-r5/. |
| 800-53 equals FedRAMP | FedRAMP is the federal cloud product and service Authorization program. It draws on the catalog, and it is a different object. Explainer: /learn/explainers/fedramp/. |
| 800-53 means FISMA is done | FISMA is the statutory and program backdrop for federal agency information security management. A review of the catalog is not an Authorization and not a finished program. Explainers: /learn/explainers/fisma/ and /learn/explainers/sp-800-37/. |
| 800-53 equals SP 800-171 equals CMMC | SP 800-171 protects CUI on nonfederal systems. CMMC is the DoD/DoW contractor assessment program for the Defense Industrial Base. These are different publications and programs. Explainers: /learn/explainers/sp-800-171/ and /learn/explainers/cmmc/. |
| Map every control ID to a vendor feature and the work is done | Selection, tailored controls, and evidence beat feature bingo. A map is a first note, and it must cite the exact revision and release. |
Common misconceptions
We implemented NIST, or 800-53, so we are NIST certified or NIST compliant.
There is no "NIST compliant" sticker from the catalog itself. Obligation, tailored controls, and evidence decide what a claim means.
800-53, FedRAMP, FISMA, SP 800-171, and CMMC are interchangeable badges.
The catalog is a publication. FedRAMP is a cloud Authorization program. FISMA is the statutory and program backdrop for federal agencies. SP 800-171 covers CUI on nonfederal systems. CMMC is a contractor assessment program. The vocabulary is related, but the objects are different.
The baselines and the assessment procedures are in the same document as the catalog.
Baselines are in SP 800-53B. Assessment procedures are in SP 800-53A. The catalog is SP 800-53. These are three companion documents with three jobs.
A map of every control ID to a vendor feature finishes control selection.
A feature list is not a selection. The owner decides how to select and tailor controls for the system and its risk. A claim still needs evidence.
Every control in the catalog applies to every system.
Controls are selected and tailored to the system, the mission, and the risk, so the set differs from system to system.
CHECK THE CATEGORY
Which sentence matches SP 800-53 Revision 5?
Glossary and nearby pages
- NIST SP 800-53 Reference card (framework summary)
- SP 800-37 explainer (RMF Select and Assess steps)
- SP 800-30 explainer (risk assessment literacy, not a catalog dump)
- SP 800-137 explainer (ISCM strategy and program, not a catalog dump)
- FISMA explainer (statutory backdrop, not FISMA done)
- FedRAMP explainer (cloud Authorization, different lane)
- SP 800-171 explainer (CUI on nonfederal systems, different publication)
- CMMC explainer (contractor assessment program, different lane)
- SP 800-82 explainer (OT guidance with an SP 800-53 overlay, related)
- CIS Implementation Groups explainer (IG1 is not an 800-53B baseline)
- Privacy is not a CIA checkbox
Use the agency page in the sources for the authoritative text.