NIST Special Publication 800-53 Revision 5.2.0

This page contains an overview of the controls provided by NIST to protect organization personnel and assets. NIST includes baselines for various security levels. The “Low” security level is applicable to all assets.

The additional OT baseline information is provided by NIST Special Publication 800-82.

NIST Special Publication 800-53 Revision 5.2.0
IDNameBaselinesThreats
LowModerateHighPrivacyOT Low (SP 800-82r3)OT Moderate (SP 800-82r3)OT High (SP 800-82r3)
AT-2(3)Social Engineering and Mining ••  ••STRIDE-LM
AT-3(2)Physical Security Controls       STRIDE-LM
(5)Processing Personally Identifiable Information   •   STRIDE-LM
AU-3(3)Limit Personally Identifiable Information Elements   •   STRIDE-LM
AU-9Protection of Audit Information••• •••STRIDE-LM
AU-13Monitoring for Information Disclosure       STRIDE-LM
(3)Unauthorized Replication of Information       STRIDE-LM
CA-3(7)Transitive Information Exchanges       STRIDE-LM
CA-6Authorization•••••••STRIDE-LM
CA-8Penetration Testing  •   •STRIDE-LM
CM-3(6)Cryptography Management  •   •STRIDE-LM
CM-7(9)Prohibiting The Use of Unauthorized Hardware       STRIDE-LM
CP-9(8)Cryptographic Protection ••  ••STRIDE-LM
IA-4(1)Prohibit Account Identifiers as Public Identifiers       STRIDE-LM
(8)Pairwise Pseudonymous Identifiers       STRIDE-LM
IA-5(6)Protection of Authenticators ••  ••STRIDE-LM
(7)No Embedded Unencrypted Static Authenticators       STRIDE-LM
IA-13(1)Protection of Cryptographic Keys       STRIDE-LM
IR-2(3)Breach   •   STRIDE-LM
IR-4(6)Insider Threats       STRIDE-LM
IR-8(1)Breaches   •   STRIDE-LM
IR-9Information Spillage Response       STRIDE-LM
(3)Post-spill Operations       STRIDE-LM
(4)Exposure to Unauthorized Personnel       STRIDE-LM
MA-3(3)Prevent Unauthorized Removal ••  ••STRIDE-LM
MA-4(3)Comparable Security and Sanitization  •   •STRIDE-LM
(6)Cryptographic Protection       STRIDE-LM
MA-5(2)Security Clearances for Classified Systems       STRIDE-LM
MP-2Media Access••• •••STRIDE-LM
MP-4Media Storage ••  ••STRIDE-LM
(2)Automated Restricted Access       STRIDE-LM
MP-5Media Transport ••  ••STRIDE-LM
MP-6Media Sanitization•••••••STRIDE-LM
(8)Remote Purging or Wiping of Information       STRIDE-LM
MP-7Media Use••• •••STRIDE-LM
(2)Prohibit Use of Sanitization-resistant Media       STRIDE-LM
MP-8Media Downgrading       STRIDE-LM
(3)Controlled Unclassified Information       STRIDE-LM
(4)Classified Information       STRIDE-LM
PE-2(1)Access by Position or Role       STRIDE-LM
(3)Restrict Unescorted Access       STRIDE-LM
PE-4Access Control for Transmission ••  ••STRIDE-LM
PE-5Access Control for Output Devices ••  ••STRIDE-LM
PE-8(3)Limit Personally Identifiable Information Elements   •   STRIDE-LM
PE-19Information Leakage       STRIDE-LM
PL-4(1)Social Media and External Site/Application Usage Restrictions•••••••STRIDE-LM
PL-8(1)Defense in Depth       STRIDE-LM
PM-12Insider Threat Program       STRIDE-LM
PM-17Protecting Controlled Unclassified Information on External Systems   •   STRIDE-LM
PM-18Privacy Program Plan   •   STRIDE-LM