NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations

Overview

Rev. 5 places security and privacy controls for all computing platforms, from general-purpose systems to cloud, mobile, IoT, industrial control and environmental control systems, in one catalogue. The objectives are to make systems more penetration-resistant, limit damage from attacks, make them cyber-resilient and survivable, and protect individuals' privacy. The most significant changes: controls are more outcome-based, with the responsible entity removed from the control statement; security and privacy controls are integrated; a new Supply Chain Risk Management family is added; control selection is separated from the controls; baselines and tailoring guidance move to SP 800-53B; and new state-of-the-practice controls, for example for cyber resiliency and secure design, are added.

Chapter 2 explains the structure. Controls fall into 20 families, each with a two-character identifier: AC, AT, AU, CA, CM, CP, IA, IR, MA, MP, PE, PL, PM, PS, PT, RA, SA, SC, SI and SR. Families hold base controls and control enhancements that add functionality or strength; 17 of the 20 families align with the FIPS 200 minimum security requirements, while PM, PT and SR address later federal mandates. Controls are tailored by organization-defined parameters ('Assignment' and 'Selection' values). The chapter also covers implementation approaches, the relation between security and privacy controls, and trustworthiness and assurance.

Chapter 3 gives control text, discussion and related controls for the families. The most directly relevant to data-centre design are in PE: PE-9 power equipment and cabling (physically separated redundant cabling paths, automatic voltage controls), PE-10 emergency shutoff, PE-11 emergency power (a UPS for orderly shutdown or transition to long-term alternate power), PE-13 fire protection, PE-14 environmental controls (maintaining and monitoring temperature, humidity, pressure and radiation levels), PE-15 water damage protection and PE-23 facility location (considering floods, fires, tornadoes, earthquakes and other hazards).

The CP family covers the contingency plan, testing, alternate storage site (CP-6), alternate processing site (CP-7), telecommunications services (CP-8), system backup (CP-9), recovery and reconstitution (CP-10) and safe mode (CP-12). CP-7 requires the alternate processing site to be geographically distinct from the primary, to allow resumption within a time consistent with recovery time and recovery point objectives, and to have controls equivalent to the primary site. Appendix C provides control summaries.

Key points

1. Controls are organised in 20 families, and security and privacy controls share one catalogue.
2. A new Supply Chain Risk Management (SR) family is added.
3. Baselines and tailoring guidance moved to SP 800-53B.
4. Control statements are outcome-based, with the responsible entity removed.
5. 17 of the 20 families align with FIPS 200 minimum security requirements; PM, PT and SR address later federal mandates.
6. Each family has a two-character identifier, with base controls and control enhancements.
7. PE-9 protects power equipment and cabling; its enhancements are physically separated redundant cabling paths and automatic voltage controls.
8. PE-11: a UPS enables orderly shutdown or transition to long-term alternate power; unlike a generator it gives near-instantaneous protection.
9. PE-14 maintains and monitors temperature, humidity, pressure and radiation levels; PE-23 plans facility location around physical and environmental hazards.
10. CP-7: the alternate processing site must be geographically distinct and have controls equivalent to the primary site.

Using it in design

• In data-centre power design, set PE-9 requirements for physically separated redundant cabling paths and automatic voltage control on critical components, and define the separation distance as an organisational parameter.
• Size the UPS and alternate power to PE-11, with either an orderly shutdown time or a long-term alternate power transition scenario.
• In site selection, record floods, fires, tornadoes and earthquakes in the risk strategy under PE-23 and identify a geographically distinct secondary site for CP-7.
• Define acceptable temperature and humidity levels and the monitoring frequency as parameters for PE-14.
• Place emergency shutoff (PE-10) devices where authorised personnel can reach them, protected against unauthorised activation.
• Use SP 800-53B for baseline selection together with the OT overlay for systems such as BMS and SCADA.

Who should read it

Information security and privacy engineers, system architects, risk managers, auditors and engineers who design physical infrastructure.

Document contents

1. Executive Summary
2. Chapter One: Introduction
3. 1.1 Purpose and Applicability
4. 1.3 Organizational Responsibilities
5. Chapter Two: The Fundamentals
6. 2.1 Requirements and Controls
7. 2.2 Control Structure and Organization
8. 2.3 Control Implementation Approaches
9. 2.4 Security and Privacy Controls
10. 2.5 Trustworthiness and Assurance
11. Chapter Three: The Controls
12. 3.1 Access Control (AC)
13. 3.3 Audit and Accountability (AU)
14. 3.5 Configuration Management (CM)
15. 3.6 Contingency Planning (CP)
16. 3.8 Incident Response (IR)
17. 3.11 Physical and Environmental Protection (PE)
18. 3.18 System and Communications Protection (SC)
19. 3.20 Supply Chain Risk Management (SR)
20. Appendix C. Control Summaries

Related standards

• NIST SP 800-53B
• FedRAMP
• NIST CSF 2.0

Read the document

Publication details

Authors

Joint Task Force

Publisher

National Institute of Standards and Technology

Year

2020

Document number

NIST SP 800-53 Rev. 5

Document language

English

Source type

Expert / community

Access

Open licence — downloadable

DOI

10.6028/NIST.SP.800-53r5

Licence

U.S. public domain — U.S. Government work; free to reuse

Licence evidence

www.copyright.gov

Citation