<img src="https://ws.zoominfo.com/pixel/4CagHYMZMRWAjWFEK36G" width="1" height="1" style="display: none;">
Request Demo

NIST SP 800-53 Control Families Explained

down-arrow

The National Institute of Standards and Technology (NIST) information technology laboratory is responsible for developing the NIST CSF, seen as the gold standard cybersecurity framework. NIST Special Publication 800-53 operates as one of the forefront cybersecurity guidelines for federal agencies in the United States to maintain their information security systems. These guidelines function to protect the system security and the sensitive data of the citizens being served. Exactly how many security controls are in NIST 800 53? NIST SP 800-53 has had five revisions and is composed of over 1000 controls. This catalog of security controls allows federal government agencies the recommended security and privacy controls for federal information systems and organizations to protect against potential security issues and cyber attacks. Here, we will take a look at the 18 NIST 800 53 control families, and give a general overview of the list of NIST standards.

NIST 800 53 Control Families

AC - Access Control

The AC Control Family consists of security requirements detailing system logging. This includes who has access to what assets and reporting capabilities like account management, system privileges, and remote access logging to determine when users have access to the system and their level of access.

AU - Audit and Accountability

The AU control family consists of security controls related to an organization’s audit capabilities. This includes audit policies and procedures, audit logging, audit report generation, and protection of audit information.

AT - Awareness and Training

The control sets in the AT Control Family are specific to your security training and procedures, including security training records.

CM - Configuration Management

CM controls are specific to an organization’s configuration management policies. This includes a baseline configuration to operate as the basis for future builds or changes to information systems. Additionally, this includes information system component inventories and a security impact analysis control.

CP - Contingency Planning

The CP control family includes controls specific to an organization's contingency plan if a cybersecurity event should occur. This includes controls like contingency plan testing, updating, training, and backups, and system reconstitution.

IA - Identification and Authentication

IA controls are specific to the identification and authentication policies in an organization. This includes the identification and authentication of organizational and non-organizational users and how the management of those systems.

IR - Incident Response

IR controls are specific to an organization’s incident response policies and procedures. This includes incident response training, testing, monitoring, reporting, and response plan.

MA - Maintenance

The MA controls in NIST 800-53 revision five detail requirements for maintaining organizational systems and the tools used.

MP - Media Protection

The Media Protection control family includes controls specific to access, marking, storage, transport policies, sanitization, and defined organizational media use.

PS - Personnel Security

PS controls relate to how an organization protects its personnel through position risk, personnel screening, termination, transfers, sanctions, and access agreements.

PE - Physical and Environmental Protection

The Physical and Environmental Protection control family is implemented to protect systems, buildings, and related supporting infrastructure against physical threats. These controls include physical access authorizations, monitoring, visitor records, emergency shutoff, power, lighting, fire protection, and water damage protection.

PL - Planning

The NIST SP 800-53 control PL family is specific to an organization's security planning policies and must address the purpose, scope, roles, responsibilities, management commitment, coordination among entities, and organizational compliance.

PM - Program Management

The PM control family is specific to who manages your cybersecurity program and how it operates. This includes, but is not limited to, a critical infrastructure plan, information security program plan, plan of action milestones and processes, risk management strategy, and enterprise architecture.

RA - Risk Assessment

The RA control family relates to an organization’s risk assessment policies and vulnerability scanning capabilities. Using an integrated risk management solution like CyberStrong can help streamline and automate your NIST 800 53 compliance efforts.

CA - Security Assessment and Authorization

The Security Assessment and Authorization control family includes controls that supplement the execution of security assessments, authorizations, continuous monitoring, plan of actions and milestones, and system interconnections.

SC - System and Communications Protection

The SC control family is responsible for systems and communications protection procedures. This includes boundary protection, protection of information at rest, collaborative computing devices, cryptographic protection, denial of service protection, and many others.

SI - System and Information Integrity

The SI control family correlates to controls that protect system and information integrity. This control family includes NIST SI 7 which involves flaw remediation, malicious code protection, information system monitoring, security alerts, software, and firmware integrity, and spam protection.

SA - System and Services Acquisition

The SA control family correlates with controls that protect allocated resources and an organization’s system development life cycle. This includes information system documentation controls, development configuration management controls, and developer security testing and evaluation controls.

Using an integrated risk management solution like CyberStrong can help streamline and harmonize an organization's cybersecurity efforts across multiple standards and guidelines, saving teams valuable time, energy, and resources towards becoming compliant continuously. If you have any questions about NIST SP 800 53, the NIST Cybersecurity Framework, integrated risk management, or to learn how CyberStrong is enabling regulatory agencies to streamline and automate their compliance efforts in the new year, give us a call at 1 800 NIST CSF or click here to schedule a conversation.

 

You may also like

How Does FAIR Fit into ...
on September 26, 2022

The Factor Analysis of Information Risk (FAIR) methodology breaks down risk into elements that organizations can compute, understand, analyze and quantify cyber threats and their ...

All-in-One Cybersecurity Board ...
on September 19, 2022

CISOs and Board Members can no longer ignore the importance of cybersecurity. New cyber attacks and threats surface every week and threaten the security of business operations. ...

Rules for Effective Cyber Risk ...
on September 12, 2022

Cybersecurity threats are becoming more challenging for businesses. According to PurpleSec’s Cyber Security Trend Report in 2021, cybercrime surged by 600% during the pandemic, ...

A Pocket Guide to Factor Analysis ...
on September 14, 2022

FAIR, short for Factor Analysis of Information Risk, is a risk quantification methodology founded to help businesses evaluate information risks. FAIR is the only international ...

Your Guide to Cyber Risk ...
on August 30, 2022

During the pandemic, online businesses flourished as people turned to e-commerce stores to shop from the comfort and safety of their homes. This unprecedented expansion of ...

Pros and Cons of Continual ...
on July 22, 2022

The cybersecurity landscape is constantly changing with the hackers that threaten this industry continually advancing their attack techniques. According to the Sophos 2022 Threat ...