NIST SP 800-53 Rev 5: the evidence behind each requirement

1014 controls and enhancements. For each, the artefacts auditors commonly ask for, which ones a system already holds, and the first move to stop evidencing it by periodic review.

Base controls and their enhancements. Which apply follows the baseline you are assessed against (for example FedRAMP Moderate or High, or the low, moderate and high baselines of SP 800-53B). Text in square brackets is a parameter your organisation sets.

AC - Access Control

AT - Awareness and Training

AT-1Policy and Procedures hard AT-2Literacy Training and Awareness hard AT-2(1)Literacy Training and Awareness | Practical Exercises hard AT-2(2)Literacy Training and Awareness | Insider Threat hard AT-2(3)Literacy Training and Awareness | Social Engineering and Mining hard AT-2(4)Literacy Training and Awareness | Suspicious Communications and Anomalous System Behavior hard AT-2(5)Literacy Training and Awareness | Advanced Persistent Threat hard AT-2(6)Literacy Training and Awareness | Cyber Threat Environment hard AT-3Role-based Training hard AT-3(1)Role-based Training | Environmental Controls hard AT-3(2)Role-based Training | Physical Security Controls hard AT-3(3)Role-based Training | Practical Exercises hard AT-3(5)Role-based Training | Processing Personally Identifiable Information hard AT-4Training Records hard AT-6Training Feedback hard

AU - Audit and Accountability

CA - Assessment, Authorization, and Monitoring

CA-1Policy and Procedures hard CA-2Control Assessments hard CA-2(1)Control Assessments | Independent Assessors hard CA-2(2)Control Assessments | Specialized Assessments hard CA-2(3)Control Assessments | Leveraging Results from External Organizations hard CA-3Information Exchange hard CA-3(6)Information Exchange | Transfer Authorizations hard CA-3(7)Information Exchange | Transitive Information Exchanges hard CA-5Plan of Action and Milestones hard CA-5(1)Plan of Action and Milestones | Automation Support for Accuracy and Currency hard CA-6Authorization hard CA-6(1)Authorization | Joint Authorization: Intra-organization hard CA-6(2)Authorization | Joint Authorization: Inter-organization hard CA-7Continuous Monitoring moderate CA-7(1)Continuous Monitoring | Independent Assessment hard CA-7(3)Continuous Monitoring | Trend Analyses hard CA-7(4)Continuous Monitoring | Risk Monitoring moderate CA-7(5)Continuous Monitoring | Consistency Analysis hard CA-7(6)Continuous Monitoring | Automation Support for Monitoring moderate CA-8Penetration Testing hard CA-8(1)Penetration Testing | Independent Penetration Testing Agent or Team hard CA-8(2)Penetration Testing | Red Team Exercises hard CA-8(3)Penetration Testing | Facility Penetration Testing hard CA-9Internal System Connections hard CA-9(1)Internal System Connections | Compliance Checks hard

CM - Configuration Management

CP - Contingency Planning

CP-1Policy and Procedures hard CP-2Contingency Plan hard CP-2(1)Contingency Plan | Coordinate with Related Plans hard CP-2(2)Contingency Plan | Capacity Planning hard CP-2(3)Contingency Plan | Resume Mission and Business Functions hard CP-2(5)Contingency Plan | Continue Mission and Business Functions hard CP-2(6)Contingency Plan | Alternate Processing and Storage Sites hard CP-2(7)Contingency Plan | Coordinate with External Service Providers hard CP-2(8)Contingency Plan | Identify Critical Assets hard CP-3Contingency Training hard CP-3(1)Contingency Training | Simulated Events hard CP-3(2)Contingency Training | Mechanisms Used in Training Environments hard CP-4Contingency Plan Testing hard CP-4(1)Contingency Plan Testing | Coordinate with Related Plans hard CP-4(2)Contingency Plan Testing | Alternate Processing Site hard CP-4(3)Contingency Plan Testing | Automated Testing hard CP-4(4)Contingency Plan Testing | Full Recovery and Reconstitution hard CP-4(5)Contingency Plan Testing | Self-challenge hard CP-6Alternate Storage Site hard CP-6(1)Alternate Storage Site | Separation from Primary Site hard CP-6(2)Alternate Storage Site | Recovery Time and Recovery Point Objectives hard CP-6(3)Alternate Storage Site | Accessibility hard CP-7Alternate Processing Site hard CP-7(1)Alternate Processing Site | Separation from Primary Site hard CP-7(2)Alternate Processing Site | Accessibility hard CP-7(3)Alternate Processing Site | Priority of Service hard CP-7(4)Alternate Processing Site | Preparation for Use hard CP-7(6)Alternate Processing Site | Inability to Return to Primary Site hard CP-8Telecommunications Services hard CP-8(1)Telecommunications Services | Priority of Service Provisions hard CP-8(2)Telecommunications Services | Single Points of Failure hard CP-8(3)Telecommunications Services | Separation of Primary and Alternate Providers hard CP-8(4)Telecommunications Services | Provider Contingency Plan hard CP-8(5)Telecommunications Services | Alternate Telecommunication Service Testing hard CP-9System Backup hard CP-9(1)System Backup | Testing for Reliability and Integrity hard CP-9(2)System Backup | Test Restoration Using Sampling hard CP-9(3)System Backup | Separate Storage for Critical Information hard CP-9(5)System Backup | Transfer to Alternate Storage Site moderate CP-9(6)System Backup | Redundant Secondary System hard CP-9(7)System Backup | Dual Authorization for Deletion or Destruction hard CP-9(8)System Backup | Cryptographic Protection hard CP-10System Recovery and Reconstitution hard CP-10(2)System Recovery and Reconstitution | Transaction Recovery hard CP-10(4)System Recovery and Reconstitution | Restore Within Time Period hard CP-10(6)System Recovery and Reconstitution | Component Protection hard CP-11Alternate Communications Protocols hard CP-12Safe Mode hard CP-13Alternative Security Mechanisms hard

IA - Identification and Authentication

IR - Incident Response

MA - Maintenance

MA-1Policy and Procedures hard MA-2Controlled Maintenance hard MA-2(2)Controlled Maintenance | Automated Maintenance Activities hard MA-3Maintenance Tools hard MA-3(1)Maintenance Tools | Inspect Tools hard MA-3(2)Maintenance Tools | Inspect Media hard MA-3(3)Maintenance Tools | Prevent Unauthorized Removal hard MA-3(4)Maintenance Tools | Restricted Tool Use hard MA-3(5)Maintenance Tools | Execution with Privilege hard MA-3(6)Maintenance Tools | Software Updates and Patches hard MA-4Nonlocal Maintenance hard MA-4(1)Nonlocal Maintenance | Logging and Review hard MA-4(3)Nonlocal Maintenance | Comparable Security and Sanitization hard MA-4(4)Nonlocal Maintenance | Authentication and Separation of Maintenance Sessions hard MA-4(5)Nonlocal Maintenance | Approvals and Notifications hard MA-4(6)Nonlocal Maintenance | Cryptographic Protection hard MA-4(7)Nonlocal Maintenance | Disconnect Verification hard MA-5Maintenance Personnel hard MA-5(1)Maintenance Personnel | Individuals Without Appropriate Access hard MA-5(2)Maintenance Personnel | Security Clearances for Classified Systems hard MA-5(3)Maintenance Personnel | Citizenship Requirements for Classified Systems hard MA-5(4)Maintenance Personnel | Foreign Nationals hard MA-5(5)Maintenance Personnel | Non-system Maintenance hard MA-6Timely Maintenance hard MA-6(1)Timely Maintenance | Preventive Maintenance hard MA-6(2)Timely Maintenance | Predictive Maintenance hard MA-6(3)Timely Maintenance | Automated Support for Predictive Maintenance hard MA-7Field Maintenance hard

MP - Media Protection

MP-1Policy and Procedures hard MP-2Media Access hard MP-3Media Marking hard MP-4Media Storage hard MP-4(2)Media Storage | Automated Restricted Access hard MP-5Media Transport hard MP-5(3)Media Transport | Custodians hard MP-6Media Sanitization hard MP-6(1)Media Sanitization | Review, Approve, Track, Document, and Verify hard MP-6(2)Media Sanitization | Equipment Testing hard MP-6(3)Media Sanitization | Nondestructive Techniques hard MP-6(7)Media Sanitization | Dual Authorization hard MP-6(8)Media Sanitization | Remote Purging or Wiping of Information hard MP-7Media Use hard MP-7(2)Media Use | Prohibit Use of Sanitization-resistant Media hard MP-8Media Downgrading hard MP-8(1)Media Downgrading | Documentation of Process hard MP-8(2)Media Downgrading | Equipment Testing hard MP-8(3)Media Downgrading | Controlled Unclassified Information hard MP-8(4)Media Downgrading | Classified Information hard

PE - Physical and Environmental Protection

PE-1Policy and Procedures hard PE-2Physical Access Authorizations hard PE-2(1)Physical Access Authorizations | Access by Position or Role hard PE-2(2)Physical Access Authorizations | Two Forms of Identification hard PE-2(3)Physical Access Authorizations | Restrict Unescorted Access hard PE-3Physical Access Control hard PE-3(1)Physical Access Control | System Access hard PE-3(2)Physical Access Control | Facility and Systems hard PE-3(3)Physical Access Control | Continuous Guards hard PE-3(4)Physical Access Control | Lockable Casings hard PE-3(5)Physical Access Control | Tamper Protection hard PE-3(7)Physical Access Control | Physical Barriers hard PE-3(8)Physical Access Control | Access Control Vestibules hard PE-4Access Control for Transmission hard PE-5Access Control for Output Devices hard PE-5(2)Access Control for Output Devices | Link to Individual Identity hard PE-6Monitoring Physical Access moderate PE-6(1)Monitoring Physical Access | Intrusion Alarms and Surveillance Equipment hard PE-6(2)Monitoring Physical Access | Automated Intrusion Recognition and Responses hard PE-6(3)Monitoring Physical Access | Video Surveillance hard PE-6(4)Monitoring Physical Access | Monitoring Physical Access to Systems hard PE-8Visitor Access Records hard PE-8(1)Visitor Access Records | Automated Records Maintenance and Review moderate PE-8(3)Visitor Access Records | Limit Personally Identifiable Information Elements hard PE-9Power Equipment and Cabling hard PE-9(1)Power Equipment and Cabling | Redundant Cabling hard PE-9(2)Power Equipment and Cabling | Automatic Voltage Controls moderate PE-10Emergency Shutoff hard PE-11Emergency Power hard PE-11(1)Emergency Power | Alternate Power Supply: Minimal Operational Capability hard PE-11(2)Emergency Power | Alternate Power Supply: Self-contained hard PE-12Emergency Lighting hard PE-12(1)Emergency Lighting | Essential Mission and Business Functions hard PE-13Fire Protection hard PE-13(1)Fire Protection | Detection Systems: Automatic Activation and Notification hard PE-13(2)Fire Protection | Suppression Systems: Automatic Activation and Notification hard PE-13(4)Fire Protection | Inspections hard PE-14Environmental Controls hard PE-14(1)Environmental Controls | Automatic Controls hard PE-14(2)Environmental Controls | Monitoring with Alarms and Notifications moderate PE-15Water Damage Protection hard PE-15(1)Water Damage Protection | Automation Support moderate PE-16Delivery and Removal hard PE-17Alternate Work Site hard PE-18Location of System Components hard PE-19Information Leakage hard PE-19(1)Information Leakage | National Emissions Policies and Procedures hard PE-20Asset Monitoring and Tracking hard PE-21Electromagnetic Pulse Protection hard PE-22Component Marking hard PE-23Facility Location hard

PL - Planning

PL-1Policy and Procedures hard PL-2System Security and Privacy Plans hard PL-4Rules of Behavior moderate PL-4(1)Rules of Behavior | Social Media and External Site/Application Usage Restrictions moderate PL-7Concept of Operations hard PL-8Security and Privacy Architectures hard PL-8(1)Security and Privacy Architectures | Defense in Depth hard PL-8(2)Security and Privacy Architectures | Supplier Diversity hard PL-9Central Management hard PL-10Baseline Selection hard PL-11Baseline Tailoring hard

PM - Program Management

PM-1Information Security Program Plan hard PM-2Information Security Program Leadership Role hard PM-3Information Security and Privacy Resources hard PM-4Plan of Action and Milestones Process hard PM-5System Inventory hard PM-5(1)System Inventory | Inventory of Personally Identifiable Information hard PM-6Measures of Performance hard PM-7Enterprise Architecture hard PM-7(1)Enterprise Architecture | Offloading hard PM-8Critical Infrastructure Plan hard PM-9Risk Management Strategy hard PM-10Authorization Process hard PM-11Mission and Business Process Definition hard PM-12Insider Threat Program hard PM-13Security and Privacy Workforce hard PM-14Testing, Training, and Monitoring hard PM-15Security and Privacy Groups and Associations hard PM-16Threat Awareness Program hard PM-16(1)Threat Awareness Program | Automated Means for Sharing Threat Intelligence hard PM-17Protecting Controlled Unclassified Information on External Systems hard PM-18Privacy Program Plan hard PM-19Privacy Program Leadership Role hard PM-20Dissemination of Privacy Program Information hard PM-20(1)Dissemination of Privacy Program Information | Privacy Policies on Websites, Applications, and Digital… hard PM-21Accounting of Disclosures moderate PM-22Personally Identifiable Information Quality Management hard PM-23Data Governance Body hard PM-24Data Integrity Board hard PM-25Minimization of Personally Identifiable Information Used in Testing, Training, and Research hard PM-26Complaint Management hard PM-27Privacy Reporting hard PM-28Risk Framing hard PM-29Risk Management Program Leadership Roles hard PM-30Supply Chain Risk Management Strategy hard PM-30(1)Supply Chain Risk Management Strategy | Suppliers of Critical or Mission-essential Items hard PM-31Continuous Monitoring Strategy hard PM-32Purposing hard

PS - Personnel Security

PS-1Policy and Procedures hard PS-2Position Risk Designation hard PS-3Personnel Screening hard PS-3(1)Personnel Screening | Classified Information hard PS-3(2)Personnel Screening | Formal Indoctrination hard PS-3(3)Personnel Screening | Information Requiring Special Protective Measures hard PS-3(4)Personnel Screening | Citizenship Requirements hard PS-4Personnel Termination moderate PS-4(1)Personnel Termination | Post-employment Requirements hard PS-4(2)Personnel Termination | Automated Actions hard PS-5Personnel Transfer hard PS-6Access Agreements hard PS-6(2)Access Agreements | Classified Information Requiring Special Protection hard PS-6(3)Access Agreements | Post-employment Requirements hard PS-7External Personnel Security hard PS-8Personnel Sanctions hard PS-9Position Descriptions hard

PT - PII Processing and Transparency

RA - Risk Assessment

SA - System and Services Acquisition

SC - System and Communications Protection

SI - System and Information Integrity

SR - Supply Chain Risk Management

SR-1Policy and Procedures hard SR-2Supply Chain Risk Management Plan hard SR-2(1)Supply Chain Risk Management Plan | Establish SCRM Team hard SR-3Supply Chain Controls and Processes hard SR-3(1)Supply Chain Controls and Processes | Diverse Supply Base hard SR-3(2)Supply Chain Controls and Processes | Limitation of Harm hard SR-3(3)Supply Chain Controls and Processes | Sub-tier Flow Down hard SR-4Provenance hard SR-4(1)Provenance | Identity hard SR-4(2)Provenance | Track and Trace hard SR-4(3)Provenance | Validate as Genuine and Not Altered hard SR-4(4)Provenance | Supply Chain Integrity: Pedigree hard SR-5Acquisition Strategies, Tools, and Methods hard SR-5(1)Acquisition Strategies, Tools, and Methods | Adequate Supply hard SR-5(2)Acquisition Strategies, Tools, and Methods | Assessments Prior to Selection, Acceptance, Modification, or… hard SR-6Supplier Assessments and Reviews hard SR-6(1)Supplier Assessments and Reviews | Testing and Analysis hard SR-7Supply Chain Operations Security hard SR-8Notification Agreements hard SR-9Tamper Resistance and Detection hard SR-9(1)Tamper Resistance and Detection | Multiple Stages of System Development Life Cycle hard SR-10Inspection of Systems or Components hard SR-11Component Authenticity hard SR-11(1)Component Authenticity | Anti-counterfeit Training hard SR-11(2)Component Authenticity | Configuration Control for Component Service and Repair hard SR-11(3)Component Authenticity | Anti-counterfeit Scanning hard SR-12Component Disposal hard