SP 800-53 Rev. 5Final2020

Security and Privacy Controls for Information Systems and Organizations

At a glanceNIST's comprehensive catalog of security and privacy controls, organized into 20 families from Access Control to Supply Chain Risk Management. Districts rarely implement it directly, but it is the detailed reference behind many frameworks, questionnaires and crosswalks. Look up specific controls rather than reading it cover to cover.

Reading level: Technical
Length: 492 pages · about 60 min for the key parts
Best for: Technology directors, IT staff and service partners
CSF 2.0: Govern, Identify, Protect, Detect, Respond, Recover

Read it on NIST DOI 10.6028/NIST.SP.800-53r5 ↗

Browse the full library. 70 NIST publications summarized for school districts.

Key concepts

The catalog describes outcome-based safeguards, not specific technologies, selected through an organization-wide risk process. The current online release is 5.2.0 (August 2025), which added controls on secure patch and update deployment; the PDF reflects the December 2020 text, so use NIST's online catalog for the latest control language.

How it is organized

AC Access Control
AT Awareness and Training
AU Audit and Accountability
CA Assessment, Authorization and Monitoring
CM Configuration Management
CP Contingency Planning
IA Identification and Authentication
IR Incident Response
MA Maintenance
MP Media Protection
PE Physical and Environmental Protection
PL Planning
PM Program Management
PS Personnel Security
PT PII Processing and Transparency
RA Risk Assessment
SA System and Services Acquisition
SC System and Communications Protection
SI System and Information Integrity
SR Supply Chain Risk Management

What a school district should take from it

Use it as a dictionary: when a questionnaire cites 'AC-2' or 'IA-5', look it up here.
Its control families are a good checklist for whether district policies cover the basics.

How to use it in your district

Look up controls cited by insurers, auditors or partners rather than reading the whole catalog.
Use SP 800-53B baselines only if a contract requires a federal baseline.
Use the CSF informative references to trace rubric categories to related controls.

Common misconceptions

Districts must implement all of SP 800-53.: It is required for federal systems; districts can use it voluntarily as a reference.

Rubric categories and K12 Cyber Forward tools

Cybersecurity Rubric 2.0 categories

GV.POPolicy
PR.AAIdentity Management, Authentication, and Access Control
PR.PSPlatform Security
DE.CMContinuous Monitoring

Tools in the program portal

Policy BuilderDraft policy language tied to rubric categories
Evidence LockerKeep the artifact that shows a practice is in place
Cyber insurancePolicy conditions, questionnaire and Breach Day card

Related publications

SP 800-53A Rev. 5Assessing controls
SP 800-53BControl baselines
SP 1347Informative references quick-start

Citation and source

SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations. National Institute of Standards and Technology. 2020. https://doi.org/10.6028/NIST.SP.800-53r5.

Replaces: SP 800-53 Rev. 5 original release (2020-09-23).

Topics: Control catalogs and assessment. This summary was written by the K12 Cyber Forward program team in its own words. NIST is not affiliated with the program and has not reviewed it. The official publication on csrc.nist.gov controls.