Draft - NIST-SP-800-53-R5/NIST-SP-800-53-R5.github.io GitHub Wiki

NIST Special Publication 800-
Revision 5

Security and Privacy Controls for

Information Systems and Organizations

JOINT TASK FORCE

This publication is available free of charge from:
https://doi.org/10.6028/NIST.SP.800-53r

NIST Special Publication 800-
Revision 5

Security and Privacy Controls for

Information Systems and Organizations

JOINT TASK FORCE

This publication is available free of charge from:
https://doi.org/10.6028/NIST.SP.800-53r

September 2020

U.S. Department of Commerce
Wilbur L. Ross, Jr., Secretary

National Institute of Standards and Technology

Walter Copan, NIST Director and Under Secretary of Commerce for Standards and Technology

_________________________________________________________________________________________________

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.

Authority

This publication has been developed by NIST to further its statutory responsibilities under the
Federal Information Security Modernization Act (FISMA), 44 U.S.C. § 3551 et seq. , Public Law
(P.L.) 113-283. NIST is responsible for developing information security standards and guidelines,
including minimum requirements for federal information systems. Such information security
standards and guidelines shall not apply to national security systems without the express
approval of the appropriate federal officials exercising policy authority over such systems. This
guideline is consistent with the requirements of the Office of Management and Budget (OMB)
Circular A-130.

Nothing in this publication should be taken to contradict the standards and guidelines made
mandatory and binding on federal agencies by the Secretary of Commerce under statutory
authority. Nor should these guidelines be interpreted as altering or superseding the existing
authorities of the Secretary of Commerce, OMB Director, or any other federal official. This
publication may be used by nongovernmental organizations on a voluntary basis and is not
subject to copyright in the United States. Attribution would, however, be appreciated by NIST.

National Institute of Standards and Technology Special Publication 800-53, Revision 5
Natl. Inst. Stand. Technol. Spec. Publ. 800-53, Rev. 5, 483 pages (September 2020 )
CODEN: NSPUE
This publication is available free of charge from:
https://doi.org/10.6028/NIST.SP.800-53r

National Institute of Standards and Technology
Attn: Computer Security Division, Information Technology Laboratory
100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-
Email: [email protected]

All comments are subject to release under the Freedom of Information Act (FOIA) [FOIA96].

Certain commercial entities, equipment, or materials may be identified in this document to describe
an experimental procedure or concept adequately. Such identification is not intended to imply
recommendation or endorsement by NIST, nor is it intended to imply that the entities, materials, or
equipment are necessarily the best available for the purpose.
There may be references in this publication to other publications currently under development by
NIST in accordance with its assigned statutory responsibilities. The information in this publication,
including concepts, practices, and methodologies may be used by federal agencies even before the
completion of such companion publications. Thus, until each publication is completed, current
requirements, guidelines, and procedures, where they exist, remain operative. For planning and
transition purposes, federal agencies may wish to closely follow the development of these new
publications by NIST.
Organizations are encouraged to review draft publications during the designated public comment
periods and provide feedback to NIST. Many NIST publications, other than the ones noted above,
are available at https://csrc.nist.gov/publications.

_________________________________________________________________________________________________

ii

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.

Reports on Computer Systems Technology

The National Institute of Standards and Technology (NIST) Information Technology Laboratory
(ITL) promotes the U.S. economy and public welfare by providing technical leadership for the
Nation’s measurement and standards infrastructure. ITL develops tests, test methods, reference
data, proof of concept implementations, and technical analyses to advance the development
and productive use of information technology (IT). ITL’s responsibilities include the development
of management, administrative, technical, and physical standards and guidelines for the cost-
effective security of other than national security-related information in federal information
systems. The Special Publication 800-series reports on ITL’s research, guidelines, and outreach
efforts in information systems security and privacy and its collaborative activities with industry,
government, and academic organizations.

Abstract

This publication provides a catalog of security and privacy controls for information systems and
organizations to protect organizational operations and assets, individuals, other organizations,
and the Nation from a diverse set of threats and risks, including hostile attacks, human errors,
natural disasters, structural failures, foreign intelligence entities, and privacy risks. The controls
are flexible and customizable and implemented as part of an organization-wide process to
manage risk. The controls address diverse requirements derived from mission and business
needs, laws, executive orders, directives, regulations, policies, standards, and guidelines. Finally,
the consolidated control catalog addresses security and privacy from a functionality perspective
(i.e., the strength of functions and mechanisms provided by the controls) and from an assurance
perspective (i.e., the measure of confidence in the security or privacy capability provided by the
controls). Addressing functionality and assurance helps to ensure that information technology
products and the systems that rely on those products are sufficiently trustworthy.

Keywords

Assurance; availability; computer security; confidentiality; control; cybersecurity; FISMA;
information security; information system; integrity; personally identifiable information; Privacy
Act; privacy controls; privacy functions; privacy requirements; Risk Management Framework;
security controls; security functions; security requirements; system; system security.

_________________________________________________________________________________________________

iii

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.

Acknowledgements

This publication was developed by the Joint Task Force Interagency Working Group. The group
includes representatives from the civil, defense, and intelligence communities. The National
Institute of Standards and Technology wishes to acknowledge and thank the senior leaders from
the Department of Commerce, Department of Defense, the Office of the Director of National
Intelligence, the Committee on National Security Systems, and the members of the interagency
working group whose dedicated efforts contributed significantly to this publication.

Department of Defense Office of the Director of National
Intelligence
Dana Deasy La’Naia Jones
Chief Information Officer Acting Chief Information Officer
John Sherman Cynthia Mendoza
Principal Deputy CIO Acting Deputy Chief Information Officer
Mark Hakun Ben Phelps
Deputy CIO for Cybersecurity and DoD SISO Acting Director, Cybersecurity Group and IC CISO
Kevin Dulany Vacant
Director, Cybersecurity Policy and Partnerships Director, Security Coordination Center

National Institute of Standards Committee on National Security
and Technology Systems
Charles H. Romine Mark G. Hakun
Director, Information Technology Laboratory Chair
Kevin Stine Susan Dorr
Acting Cybersecurity Advisor, ITL Co-Chair
Matthew Scholl Kevin Dulany
Chief, Computer Security Division Tri-Chair—Defense Community
Kevin Stine Chris Johnson
Chief, Applied Cybersecurity Division Tri-Chair—Intelligence Community
Ron Ross Vicki Michetti
FISMA Implementation Project Leader Tri-Chair—Civil Agencies

Joint Task Force Working Group
Victoria Pillitteri McKay Tolboe Dorian Pappas Kelley Dempsey
NIST, JTF Leader DoD Intelligence Community NIST
Ehijele Olumese Lydia Humphries Daniel Faigin Naomi Lefkovitz
The MITRE Corporation Booz Allen Hamilton Aerospace Corporation NIST
Esten Porter Julie Nethery Snyder Christina Sames Christian Enloe
The MITRE Corporation The MITRE Corporation The MITRE Corporation NIST
David Black Rich Graubart Peter Duspiva Kaitlin Boeckl
The MITRE Corporation The MITRE Corporation Intelligence Community NIST
Eduardo Takamura Ned Goren Andrew Regenscheid Jon Boyens
NIST NIST NIST NIST

_________________________________________________________________________________________________

iv

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.

In addition to the above acknowledgments, a special note of thanks goes to Jeff Brewer, Jim
Foti, and the NIST web team for their outstanding administrative support. The authors also wish
to recognize Kristen Baldwin, Carol Bales, John Bazile, Jennifer Besceglie, Sean Brooks, Ruth
Cannatti, Kathleen Coupe, Keesha Crosby, Charles Cutshall, Ja’Nelle DeVore, Jennifer Fabius, Jim
Fenton, Hildy Ferraiolo, Ryan Galluzzo, Robin Gandhi, Mike Garcia, Paul Grassi, Marc Groman,
Matthew Halstead, Kevin Herms, Scott Hill, Ralph Jones, Martin Kihiko, Raquel Leone, Jason
Marsico, Kirsten Moncada, Ellen Nadeau, Elaine Newton, Michael Nieles, Michael Nussdorfer,
Taylor Roberts, Jasmeet Seehra, Joe Stuntz, Jeff Williams, the professional staff from the NIST
Computer Security Division and Applied Cybersecurity Division, and the representatives from
the Federal CIO Council, Federal CISO Council, Federal Privacy Council, Control Baseline
Interagency Working Group, Security and Privacy Collaboration Working Group, and Federal
Privacy Council Risk Management Subcommittee for their ongoing contributions in helping to
improve the content of the publication. Finally, the authors gratefully acknowledge the
contributions from individuals and organizations in the public and private sectors, both
nationally and internationally, whose insightful and constructive comments improved the
overall quality, thoroughness, and usefulness of this publication.

HISTORICAL CONTRIBUTIONS TO NIST SPECIAL PUBLICATION 800-

The authors wanted to acknowledge the many individuals who contributed to previous versions
of Special Publication 800-53 since its inception in 2005. They include Marshall Abrams, Dennis
Bailey, Lee Badger, Curt Barker, Matthew Barrett, Nadya Bartol, Frank Belz, Paul Bicknell, Deb
Bodeau, Paul Brusil, Brett Burley, Bill Burr, Dawn Cappelli, Roger Caslow, Corinne Castanza, Mike
Cooper, Matt Coose, Dominic Cussatt, George Dinolt, Randy Easter, Kurt Eleam, Denise Farrar,
Dave Ferraiolo, Cita Furlani, Harriett Goldman, Peter Gouldmann, Tim Grance, Jennifer Guild,
Gary Guissanie, Sarbari Gupta, Priscilla Guthrie, Richard Hale, Peggy Himes, Bennett Hodge,
William Hunteman, Cynthia Irvine, Arnold Johnson, Roger Johnson, Donald Jones, Lisa Kaiser,
Stuart Katzke, Sharon Keller, Tom Kellermann, Cass Kelly, Eustace King, Daniel Klemm, Steve
LaFountain, Annabelle Lee, Robert Lentz, Steven Lipner, William MacGregor, Thomas Macklin,
Thomas Madden, Robert Martin, Erika McCallister, Tim McChesney, Michael McEvilley, Rosalie
McQuaid, Peter Mell, John Mildner, Pam Miller, Sandra Miravalle, Joji Montelibano, Douglas
Montgomery, George Moore, Rama Moorthy, Mark Morrison, Harvey Newstrom, Sherrill Nicely,
Robert Niemeyer, LouAnna Notargiacomo, Pat O’Reilly, Tim Polk, Karen Quigg, Steve Quinn,
Mark Riddle, Ed Roback, Cheryl Roby, George Rogers, Scott Rose, Mike Rubin, Karen Scarfone,
Roger Schell, Jackie Snouffer, Ray Snouffer, Murugiah Souppaya, Gary Stoneburner, Keith
Stouffer, Marianne Swanson, Pat Toth, Glenda Turner, Patrick Viscuso, Joe Weiss, Richard
Wilsher, Mark Wilson, John Woodward, and Carol Woody.

_________________________________________________________________________________________________

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.

Patent Disclosure Notice

NOTICE: The Information Technology Laboratory (ITL) has requested that holders of patent
claims whose use may be required for compliance with the guidance or requirements of this
publication disclose such patent claims to ITL. However, holders of patents are not obligated to
respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify
which, if any, patents may apply to this publication.

As of the date of publication and following call(s) for the identification of patent claims whose
use may be required for compliance with the guidance or requirements of this publication, no
such patent claims have been identified to ITL.

No representation is made or implied by ITL that licenses are not required to avoid patent
infringement in the use of this publication.

_________________________________________________________________________________________________

vi

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.

RISK MANAGEMENT
Organizations must exercise due diligence in managing information security and privacy risk. This
is accomplished, in part, by establishing a comprehensive risk management program that uses
the flexibility inherent in NIST publications to categorize systems, select and implement security
and privacy controls that meet mission and business needs, assess the effectiveness of the
controls, authorize the systems for operation, and continuously monitor the systems. Exercising
due diligence and implementing robust and comprehensive information security and privacy risk
management programs can facilitate compliance with applicable laws, regulations, executive
orders, and governmentwide policies. Risk management frameworks and risk management
processes are essential in developing, implementing, and maintaining the protection measures
necessary to address stakeholder needs and the current threats to organizational operations
and assets, individuals, other organizations, and the Nation. Employing effective risk-based
processes, procedures, methods, and technologies ensures that information systems and
organizations have the necessary trustworthiness and resiliency to support essential mission and
business functions, the U.S. critical infrastructure, and continuity of government.

_________________________________________________________________________________________________

vii

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.

COMMON SECURITY AND PRIVACY FOUNDATIONS
In working with the Office of Management and Budget to develop standards and guidelines
required by FISMA, NIST consults with federal agencies, state, local, and tribal governments, and
private sector organizations to improve information security and privacy, avoid unnecessary and
costly duplication of effort, and help ensure that its publications are complementary with the
standards and guidelines used for the protection of national security systems. In addition to a
comprehensive and transparent public review and comment process, NIST is engaged in a
collaborative partnership with the Office of Management and Budget, Office of the Director of
National Intelligence, Department of Defense, Committee on National Security Systems, Federal
CIO Council, and Federal Privacy Council to establish a Risk Management Framework (RMF) for
information security and privacy for the Federal Government. This common foundation provides
the Federal Government and their contractors with cost-effective, flexible, and consistent ways
to manage security and privacy risks to organizational operations and assets, individuals, other
organizations, and the Nation. The framework provides a basis for the reciprocal acceptance of
security and privacy control assessment evidence and authorization decisions and facilitates
information sharing and collaboration. NIST continues to work with public and private sector
entities to establish mappings and relationships between the standards and guidelines
developed by NIST and those developed by other organizations. NIST anticipates using these
mappings and the gaps they identify to improve the control catalog.

_________________________________________________________________________________________________

viii

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.

DEVELOPMENT OF INFORMATION SYSTEMS, COMPONENTS, AND SERVICES
With a renewed emphasis on the use of trustworthy, secure information systems and supply
chain security, it is essential that organizations express their security and privacy requirements
with clarity and specificity in order to obtain the systems, components, and services necessary
for mission and business success. Accordingly, this publication provides controls in the System
and Services Acquisition (SA) and Supply Chain Risk Management (SR) families that are directed
at developers. The scope of the controls in those families includes information system, system
component, and system service development and the associated developers whether the
development is conducted internally by organizations or externally through the contracting and
acquisition processes. The affected controls in the control catalog include SA-8, SA- 10 , SA- 11 ,
SA- 15 , SA-16, SA-17, SA- 20 , SA-21, SR-3, SR-4, SR-5, SR-6, SR-7, SR-8, SR-9, and SR- 11.

_________________________________________________________________________________________________

ix

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.

INFORMATION SYSTEMS — A BROAD-BASED PERSPECTIVE
As we push computers to “the edge,” building an increasingly complex world of interconnected
systems and devices, security and privacy continue to dominate the national dialogue. There is
an urgent need to further strengthen the underlying systems, products, and services that we
depend on in every sector of the critical infrastructure to ensure that those systems, products,
and services are sufficiently trustworthy and provide the necessary resilience to support the
economic and national security interests of the United States. NIST Special Publication 800-53,
Revision 5, responds to this need by embarking on a proactive and systemic approach to develop
and make available to a broad base of public and private sector organizations a comprehensive
set of security and privacy safeguarding measures for all types of computing platforms, including
general purpose computing systems, cyber-physical systems, cloud systems, mobile systems,
industrial control systems, and Internet of Things (IoT) devices. Safeguarding measures include
both security and privacy controls to protect the critical and essential operations and assets of
organizations and the privacy of individuals. The objective is to make the systems we depend on
more penetration resistant to attacks, limit the damage from those attacks when they occur,
and make the systems resilient, survivable, and protective of individuals’ privacy.

_________________________________________________________________________________________________

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.

CONTROL BASELINES
The control baselines that have previously been included in NIST Special Publication 800-53 have
been relocated to NIST Special Publication 800-53B. Special Publication 800-53B contains control
baselines for federal information systems and organizations. It provides guidance for tailoring
control baselines and for developing overlays to support the security and privacy requirements
of stakeholders and their organizations. CNSS Instruction 1253 provides control baselines and
guidance for security categorization and security control selection for national security systems.

_________________________________________________________________________________________________

xi

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.

USE OF EXAMPLES IN THIS PUBLICATION
Throughout this publication, examples are used to illustrate, clarify, or explain certain items in
chapter sections, controls, and control enhancements. These examples are illustrative in nature
and are not intended to limit or constrain the application of controls or control enhancements
by organizations.

_________________________________________________________________________________________________

xii

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.

FEDERAL RECORDS MANAGEMENT COLLABORATION
Federal records management processes have a nexus with certain information security and
privacy requirements and controls. For example, records officers may be managing records
retention, including when records will be deleted. Collaborating with records officers on the
selection and implementation of security and privacy controls related to records management
can support consistency and efficiency and ultimately strengthen the organization’s security and
privacy posture.

_________________________________________________________________________________________________

xiii

https://doi.org/10.6028/NIST.SP. This publication is available free of charge from:
- 53r
- CHAPTER ONE INTRODUCTION Table of Contents
  - 1.1 PURPOSE AND APPLICABILITY
  - 1.2 TARGET AUDIENCE
  - 1.3 ORGANIZATIONAL RESPONSIBILITIES
  - 1.4 RELATIONSHIP TO OTHER PUBLICATIONS
  - 1.5 REVISIONS AND EXTENSIONS
  - 1.6 PUBLICATION ORGANIZATION
- CHAPTER TWO THE FUNDAMENTALS
  - 2.1 REQUIREMENTS AND CONTROLS
  - 2.2 CONTROL STRUCTURE AND ORGANIZATION
  - 2.3 CONTROL IMPLEMENTATION APPROACHES
  - 2.4 SECURITY AND PRIVACY CONTROLS
  - 2.5 TRUSTWORTHINESS AND ASSURANCE
- CHAPTER THREE THE CONTROLS
  - 3.1 ACCESS CONTROL
  - 3.2 AWARENESS AND TRAINING
  - 3.3 AUDIT AND ACCOUNTABILITY
  - 3.4 ASSESSMENT, AUTHORIZATION, AND MONITORING
  - 3.5 CONFIGURATION MANAGEMENT
  - 3.6 CONTINGENCY PLANNING
  - 3.7 IDENTIFICATION AND AUTHENTICATION
  - 3.8 INCIDENT RESPONSE
  - 3.9 MAINTENANCE
  - 3.10 MEDIA PROTECTION
  - 3.11 PHYSICAL AND ENVIRONMENTAL PROTECTION
  - 3.12 PLANNING
  - 3.13 PROGRAM MANAGEMENT
  - 3.14 PERSONNEL SECURITY
  - 3.15 PERSONALLY IDENTIFIABLE INFORMATION PROCESSING AND TRANSPARENCY
  - 3.16 RISK ASSESSMENT
  - 3.17 SYSTEM AND SERVICES ACQUISITION
  - 3.18 SYSTEM AND COMMUNICATIONS PROTECTION
  - 3.19 SYSTEM AND INFORMATION INTEGRITY
  - 3.20 SUPPLY CHAIN RISK MANAGEMENT
- REFERENCES
- APPENDIX A GLOSSARY
- APPENDIX B ACRONYMS
- APPENDIX C CONTROL SUMMARIES

_________________________________________________________________________________________________

xiv

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.

- 53r

Executive Summary

As we push computers to “the edge,” building an increasingly complex world of connected
information systems and devices, security and privacy will continue to dominate the national
dialogue. In its 2017 report, Task Force on Cyber Deterrence [DSB 2017], the Defense Science
Board (DSB) provides a sobering assessment of the current vulnerabilities in the U.S. critical
infrastructure and the information systems that support mission-essential operations and assets
in the public and private sectors.
“...The Task Force notes that the cyber threat to U.S. critical infrastructure is outpacing
efforts to reduce pervasive vulnerabilities, so that for the next decade at least the United States
must lean significantly on deterrence to address the cyber threat posed by the most capable
U.S. adversaries. It is clear that a more proactive and systematic approach to U.S. cyber
deterrence is urgently needed...”

There is an urgent need to further strengthen the underlying information systems, component
products, and services that the Nation depends on in every sector of the critical infrastructure—
ensuring that those systems, components, and services are sufficiently trustworthy and provide
the necessary resilience to support the economic and national security interests of the United
States. This update to NIST Special Publication (SP) 800-53 responds to the call by the DSB by
embarking on a proactive and systemic approach to develop and make available to a broad base
of public and private sector organizations a comprehensive set of safeguarding measures for all
types of computing platforms, including general purpose computing systems, cyber-physical
systems, cloud-based systems, mobile devices, Internet of Things (IoT) devices, weapons
systems, space systems, communications systems, environmental control systems, super
computers, and industrial control systems. Those safeguarding measures include implementing
security and privacy controls to protect the critical and essential operations and assets of
organizations and the privacy of individuals. The objectives are to make the information systems
we depend on more penetration-resistant, limit the damage from attacks when they occur,
make the systems cyber-resilient and survivable, and protect individuals’ privacy.

Revision 5 of this foundational NIST publication represents a multi-year effort to develop the
next generation of security and privacy controls that will be needed to accomplish the above
objectives. It includes changes to make the controls more usable by diverse consumer groups
(e.g., enterprises conducting mission and business functions; engineering organizations
developing information systems, IoT devices, and systems-of-systems; and industry partners
building system components, products, and services). The most significant changes to this
publication include:

Making the controls more outcome-based by removing the entity responsible for satisfying the control (i.e., information system, organization) from the control statement;
Integrating information security and privacy controls into a seamless, consolidated control catalog for information systems and organizations;
Establishing a new supply chain risk management control family;
Separating control selection processes from the controls , thereby allowing the controls to be used by different communities of interest, including systems engineers, security architects, software developers, enterprise architects, systems security and privacy engineers, and mission or business owners;

_________________________________________________________________________________________________

xv

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.

53r
- Removing control baselines and tailoring guidance from the publication and transferring the content to NIST SP 800-53B, Control Baselines for Information Systems and Organizations ;
- Clarifying the relationship between requirements and controls and the relationship between security and privacy controls; and
- Incorporating new, state-of-the-practice controls (e.g., controls to support cyber resiliency, support secure systems design, and strengthen security and privacy governance and accountability) based on the latest threat intelligence and cyber-attack data.

In separating the process of control selection from the controls and removing the control
baselines, a significant amount of guidance and other informative material previously contained
in SP 800-53 was eliminated. That content will be moved to other NIST publications such as SP
800-37 (Risk Management Framework) and SP 800-53B during the next update cycle. In the near
future, NIST also plans to offer the content of SP 800-53, SP 800-53A, and SP 800-53B to a web-
based portal to provide its customers interactive, online access to all control, control baseline,
overlay, and assessment information.

_________________________________________________________________________________________________

xvi

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.

Prologue

“... Through the process of risk management, leaders must consider risk to US interests from
adversaries using cyberspace to their advantage and from our own efforts to employ the global
nature of cyberspace to achieve objectives in military, intelligence, and business operations... “

“...For operational plans development, the combination of threats, vulnerabilities, and impacts
must be evaluated in order to identify important trends and decide where effort should be
applied to eliminate or reduce threat capabilities; eliminate or reduce vulnerabilities; and assess,
coordinate, and deconflict all cyberspace operations...”

“...Leaders at all levels are accountable for ensuring readiness and security to the same degree as
in any other domain..."

THE NATIONAL STRATEGY FOR CYBERSPACE OPERATIONS
OFFICE OF THE CHAIRMAN, JOINT CHIEFS OF STAFF, U.S. DEPARTMENT OF DEFENSE

“Networking and information technology [are] transforming life in the 21st century, changing
the way people, businesses, and government interact. Vast improvements in computing, storage,
and communications are creating new opportunities for enhancing our social wellbeing;
improving health and health care; eliminating barriers to education and employment; and
increasing efficiencies in many sectors such as manufacturing, transportation, and agriculture.

The promise of these new applications often stems from their ability to create, collect, transmit,
process, and archive information on a massive scale. However, the vast increase in the quantity
of personal information that is being collected and retained, combined with the increased ability
to analyze it and combine it with other information, is creating valid concerns about privacy and
about the ability of entities to manage these unprecedented volumes of data responsibly.... A key
challenge of this era is to assure that growing capabilities to create, capture, store, and process
vast quantities of information will not damage the core values of the country....”

“...When systems process personal information, whether by collecting, analyzing, generating,
disclosing, retaining, or otherwise using the information, they can impact privacy of individuals.
System designers need to account for individuals as stakeholders in the overall development of
the solution....Designing for privacy must connect individuals’ privacy desires with system
requirements and controls in a way that effectively bridges the aspirations with development....”

THE NATIONAL PRIVACY RESEARCH STRATEGY

NATIONAL SCIENCE AND TECHNOLOGY COUNCIL, NETWORKING AND INFORMATION TECHNOLOGY RESEARCH AND DEVELOPMENT PROGRAM

_________________________________________________________________________________________________

xvii

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.

Errata

This table contains changes that have been incorporated into SP 800-53. Errata updates can
include corrections, clarifications, or other minor changes in the publication that are either
editorial or substantive in nature.

DATE TYPE REVISION PAGE

_________________________________________________________________________________________________

CHAPTER ONE PAGE 1

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.

CHAPTER ONE

INTRODUCTION
THE NEED TO PROTECT INFORMATION, SYSTEMS, ORGANIZATIONS, AND INDIVIDUALS

Modern information systems^1 can include a variety of computing platforms (e.g., industrial
control systems, general purpose computing systems, cyber-physical systems, super computers,
weapons systems, communications systems, environmental control systems, medical devices,
embedded devices, sensors, and mobile devices such as smart phones and tablets). These
platforms all share a common foundation—computers with complex hardware, software and
firmware providing a capability that supports the essential mission and business functions of
organizations.^2

Security controls are the safeguards or countermeasures employed within a system or an
organization to protect the confidentiality, integrity, and availability of the system and its
information and to manage information security^3 risk. Privacy controls are the administrative,
technical, and physical safeguards employed within a system or an organization to manage
privacy risks and to ensure compliance with applicable privacy requirements.^4 Security and
privacy controls are selected and implemented to satisfy security and privacy requirements
levied on a system or organization. Security and privacy requirements are derived from
applicable laws, executive orders, directives, regulations, policies, standards, and mission needs
to ensure the confidentiality, integrity, and availability of information processed, stored, or
transmitted and to manage risks to individual privacy.

The selection, design, and implementation of security and privacy controls^5 are important tasks
that have significant implications for the operations^6 and assets of organizations as well as the
welfare of individuals and the Nation. Organizations should answer several key questions when
addressing information security and privacy controls:

What security and privacy controls are needed to satisfy security and privacy requirements and to adequately manage mission/business risks or risks to individuals?
Have the selected controls been implemented or is there a plan in place to do so?
What is the required level of assurance (i.e., grounds for confidence) that the selected controls, as designed and implemented, are effective?^7

(^1) An information system is a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information [OMB A-130]. (^2) The term organization describes an entity of any size, complexity, or positioning within an organizational structure (e.g., a federal agency or, as appropriate, any of its operational elements). (^3) The two terms information security and security are used synonymously in this publication. (^4) [OMB A-130] defines security and privacy controls. (^5) Controls provide safeguards and countermeasures in systems security and privacy engineering processes to reduce risk during the system development life cycle. (^6) Organizational operations include mission, functions, image, and reputation. (^7) Security and privacy control effectiveness addresses the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the designated security and privacy requirements.

_________________________________________________________________________________________________

CHAPTER ONE PAGE 2

This publication is available free of charge from: