Attestation

NIST SP 800-53

Q: Which baseline do we need?

It follows your FIPS 199 categorization: the highest impact level for confidentiality, integrity and availability selects Low, Moderate or High. Complyanz suggests that baseline and refuses a lower one. Add the Privacy baseline when the system processes personally identifiable information.

Q: Can we tailor the baseline?

Yes. You can scope a control out with a scoping consideration and a written justification, name compensating controls, or supplement the baseline. Any change clears the approval of the tailored baseline until your authorizing official approves it again.

Q: How does it relate to ISO 27001 and the CSF?

Complyanz uses NIST's own mappings from SP 800-53 to ISO/IEC 27001:2022 and from CSF 2.0 to SP 800-53. The ISO mapping links related controls without claiming they are equivalent.

NIST SP 800-53 Rev. 5 is the catalog of security and privacy controls that US federal systems, and many of the organizations that serve them, select their controls from, and Release 5.2.0 is the current one. Complyanz helps you select, tailor, implement and document your controls: it proposes the Low, Moderate or High baseline from your FIPS 199 categorization, adds the Privacy baseline when you need it, records every tailoring decision with its rationale, and keeps your parameter values, implementation statements and plan of action and milestones (POA&M) in one place.

Choose your baseline Book a demo

What you get

One catalog, from baseline to POA&M

1014active controls and control enhancements of Release 5.2.0 across 20 families, in NIST's own words

3security baselines, Low (149), Moderate (287) and High (370), plus the Privacy baseline (96) as an overlay

12document templates, from the security and privacy policy to the contingency and incident response plans

4languages for the interface and the control titles: English, Brazilian Portuguese, European Portuguese and Spanish

The baselines

Which baseline applies, and what it holds

FIPS 200 selects the baseline from the highest impact level for confidentiality, integrity and availability across your system and its information types. Complyanz suggests it, you confirm it, and every control is marked applicable or not with the reason written next to it. A decision you made by hand is never overwritten.

Baseline	When it applies	Items
Low	Systems where a loss of confidentiality, integrity or availability would have a limited adverse effect	149
Moderate	Systems where such a loss would have a serious adverse effect	287
High	Systems where such a loss would have a severe or catastrophic adverse effect	370
Privacy	Added on top of any security baseline when the system processes personally identifiable information	96

The baselines nest: everything in Low is in Moderate, and everything in Moderate is in High. Membership is per item, so an enhancement is never implied by its parent. Program Management controls sit in no security baseline because they are deployed organization-wide; turn them on in your profile to include them. The 591 items in no baseline remain available to add through tailoring.

In the platform

Select, tailor, implement and document

Categorization and baselineRecord the system, its authorization boundary and the FIPS 199 impact for each security objective and information type. Complyanz applies the high-water mark, suggests the baseline and refuses one below your categorization. Your authorizing official approves the tailored baseline, and any later change clears that approval.

Tailoring with rationaleScope a control out with its scoping consideration and a justification, and its enhancements follow it. Supplement the baseline with any item in the catalog, including the Release 5.2.0 additions SA-15(13), SA-24 and SI-2(7). Decisions that no longer fit the baseline are flagged as stale.

Parameter values and implementation statementsSet each organization-defined parameter once and see the statement with your values in place. Record whether a control is system-specific, common or hybrid, who provides it, the responsible role, the implementation statement, an owner and evidence.

POA&M register and exportTrack each weakness with the controls it affects, its milestones, scheduled completion and point of contact. Overdue items and missed milestones are flagged, only an approver can accept the risk, with a written rationale, and the register exports to a spreadsheet.

SP 800-53A assessment resultsRecord SP 800-53A assessment results per objective and link findings to the POA&M. The objectives and methods appear in NIST's official English, and each result keeps the determination, the methods, the assessor and the date.

SSP-style reportGenerate a control implementation report from your records: the system description, categorization, baseline and overlays, the approval, every tailoring decision with its rationale, manual overrides, and each applicable control with its status and its statement rendered with your parameter values.

Crosswalks, documents and risksNIST's own mapping to ISO/IEC 27001:2022 relates 582 control pairs, shown with NIST's caution not to assume equivalency, and each control lists its NIST CSF 2.0 references. 12 document templates and 25 risk scenarios come in English, Portuguese and Spanish.

Scope

What is included, and what is not

Release 5.2.0 onlyThe catalog follows Release 5.2.0 of Rev. 5, published in August 2025, with the baselines of SP 800-53B. The 182 withdrawn items are not in it, and searching for one shows where NIST moved it.

NIST's English, four languagesInterface and control titles in four languages; control statements in NIST's official English. Control statements are shown in the official English text of NIST SP 800-53 Rev. 5 (Release 5.2.0). NIST publishes no Portuguese or Spanish translation. Translated titles are marked as unofficial.

Out of scopeOther overlays and their parameter values, OSCAL exports and more than one system per organization. CSF 2.0 appears as references on each control, not as a separate framework.

Not affiliated with NISTComplyanz is not affiliated with or endorsed by NIST. It helps you prepare your controls and their documentation; it does not assess them, and accepting the risk of operating the system remains the decision of your authorizing official.

Source: NIST SP 800-53 Rev. 5 (Release 5.2.0), https://doi.org/10.6028/NIST.SP.800-53r5

Going further

Start with any framework, add the others later

SP 800-53 shares ground with ISO/IEC 27001 on access control, logging, incident response and supplier risk. NIST's own mapping shows which ISO controls relate to each 800-53 control, so the work you record once is visible in both programs.

Add ISO 27001NIST maps 800-53 controls to ISO/IEC 27001:2022 Annex A and to the main clauses, so an information security management system builds on the same work. Add SOC 2Organizations that sell to government and commercial customers often need a SOC 2 report as well. Assets, risks and evidence are shared across both programs in one workspace.

Pricing

Included in Complete, or as an add-on

The NIST SP 800-53 module is included in the Complete plan and can be added to any other plan, priced by the number of people in scope like the plans themselves.

See pricing

Questions

NIST SP 800-53 FAQ

Which baseline do we need?

It follows your FIPS 199 categorization. You rate the impact of a loss of confidentiality, integrity and availability for the system and for each type of information it handles, and the highest rating selects Low, Moderate or High. Complyanz suggests that baseline and refuses a lower one; you may choose a higher one. Add the Privacy baseline when the system processes personally identifiable information.

Is this FedRAMP?

No. The module covers NIST's own Low, Moderate, High and Privacy baselines from SP 800-53B. FedRAMP baselines, FedRAMP parameter values and FedRAMP templates are not included, and the SSP-style report and the POA&M export are not FedRAMP documents.

Does Complyanz grant an authorization to operate?

No. Only your authorizing official can authorize a system to operate (ATO), after its controls have been assessed. Complyanz records the official's approval of your tailored baseline and their acceptance of risk on POA&M items. It does not assess controls and does not predict that decision.

Are the control statements translated?

No. Control statements are shown in the official English text of NIST SP 800-53 Rev. 5 (Release 5.2.0). NIST publishes no Portuguese or Spanish translation. The interface, the control titles, the documents and the risk scenarios are translated, and translated titles are marked as unofficial.

Can we tailor the baseline?

Yes. You can scope a control out, with a scoping consideration such as technology or public access and a written justification, name compensating controls, or supplement the baseline with any other control. Each decision is kept with its rationale for the SSP-style report, and any change clears the approval of the tailored baseline until your authorizing official approves it again.

How does it relate to ISO 27001 and the CSF?

NIST publishes a mapping from SP 800-53 to ISO/IEC 27001:2022 and one from CSF 2.0 to SP 800-53. Complyanz uses both as NIST publishes them: the ISO mapping links related controls without claiming they are equivalent, and seven items added in later releases have no ISO mapping yet. CSF 2.0 shows as references on each control and as coverage per function on the hub.

Choose your NIST SP 800-53 baseline

Create an organization, record your system's FIPS 199 categorization, and see which controls apply to you, and why.

Get started free Book a demo