SP 800-53A Rev. 5Final2022

Assessing Security and Privacy Controls in Information Systems and Organizations

At a glanceAssessment procedures for every SP 800-53 control, with three methods: examine documents, interview people and test mechanisms. Useful for anyone reviewing evidence, including district teams preparing for an independent review. Read chapter 3 and the method descriptions, not the whole catalog.

Reading level: Technical
Length: 733 pages · about 45 min for the key parts
Best for: IT staff and service partners, Technology directors
CSF 2.0: Identify, Govern

Read it on NIST DOI 10.6028/NIST.SP.800-53Ar5 ↗

Browse the full library. 70 NIST publications summarized for school districts.

Key concepts

The publication explains how to plan, conduct and report control assessments, scaled up or down, for one-time or continuous assessment. Release 5.2.0 procedures are published online.

How it is organized

Fundamentals
The process: prepare, develop plans, conduct, analyze results
Assessment procedures by control family
Appendices: assessment methods (examine, interview, test), penetration testing, reports, ongoing assessment

What a school district should take from it

Good evidence shows a practice works (tested), not only that it is written down (examined).
Interviewing the people who do the work is a legitimate assessment method.

How to use it in your district

Use 'examine, interview, test' to decide what evidence to keep for each rubric category.
Prefer evidence that shows operation over time, such as restore tests and access reviews.
Share the method with whoever reviews district evidence.

Common misconceptions

A policy document proves a control is in place.: Assessment also checks that the control operates as intended.

Rubric categories and K12 Cyber Forward tools

Cybersecurity Rubric 2.0 categories

ID.IMImprovement
GV.OVOversight

Tools in the program portal

Evidence LockerKeep the artifact that shows a practice is in place
Evidence collection kitsCollect configuration evidence from Microsoft 365, Google and more
Cybersecurity Rubric 2.0 assessmentRate the 22 categories and record why

Related publications

SP 800-53 Rev. 5Security and privacy control catalog
SP 800-115Security testing and assessment

Citation and source

SP 800-53A Rev. 5, Assessing Security and Privacy Controls in Information Systems and Organizations. National Institute of Standards and Technology. 2022. https://doi.org/10.6028/NIST.SP.800-53Ar5.

Replaces: SP 800-53A Rev. 4 (2014).

Topics: Control catalogs and assessment. This summary was written by the K12 Cyber Forward program team in its own words. NIST is not affiliated with the program and has not reviewed it. The official publication on csrc.nist.gov controls.