NIST SP 800-53, by baseline.
The federal information system control catalog. The reference framework behind FedRAMP, FISMA-mandated agency systems, and most federal Authorization to Operate (ATO) packages.
What 800-53 actually requires.
NIST SP 800-53 Rev. 5 is a catalog of over 1,000 controls organized into 20 control families. Systems are not expected to implement everything; they implement a baseline (Low, Moderate, or High) determined by the impact level of the data being processed, plus any agency-specific overlays.
The companion document NIST SP 800-53B defines the actual baselines. Most non-classified federal systems operate at the Moderate baseline. FedRAMP cloud authorizations follow the same Low/Moderate/High structure.
Compliance is documented through the Risk Management Framework (RMF) process: categorize the system, select controls, implement, assess, authorize (an ATO from your Authorizing Official), and continuously monitor.
Low baseline
Limited adverse effect if confidentiality, integrity, or availability is lost. ~149 controls.
Moderate baseline
Serious adverse effect. ~287 controls. Most non-classified federal systems land here.
High baseline
Severe or catastrophic effect. ~370 controls. Mission-critical systems and high-value assets.
Who has to comply.
Federal agencies and their contractors operating federal information systems. Concretely:
- Federal civilian and defense agencies under FISMA.
- Federal contractors hosting or operating federal information systems on behalf of agencies.
- Cloud service providers seeking FedRAMP authorization at Low, Moderate, or High.
- State and local governments when receiving certain federal grant programs that require alignment.
What we implement.
Most engagements focus on the Low or Moderate baseline. We implement the technical and operational controls, document the system, support the assessment, and run continuous monitoring afterward.
System categorization and SSP
FIPS 199 impact analysis. System Security Plan written against the selected baseline. Tailoring rationale documented.
Access control
PIV where required, MFA, role-based access, privileged account management.
Configuration management
Baselined configurations, change control, periodic configuration assessment.
Audit, monitoring, IR
Centralized logging, SIEM, alerting, IR plan tested annually, US-CERT/CISA reporting integrated.
System and communications
FIPS-validated cryptography, boundary protection, network segmentation, trust zones.
Continuous monitoring (ConMon)
Monthly vulnerability scanning, quarterly POA&M updates, annual security control assessment subset.
Who owns what.
On us
- Technical control implementation across the selected baseline
- System Security Plan drafting and maintenance
- Continuous monitoring program operation
- Vulnerability management and patching
- Incident response technical operations and reporting
- Coordination with the agency assessment team or 3PAO (FedRAMP)
On you
- Authorizing Official designation and engagement
- System owner and information system security officer roles
- Contract and agency liaison
- Final ATO acceptance and re-authorization decisions
- Personnel security clearance and background investigations
- Workforce security training program
Common pitfalls we see.
Over-implementing High when Moderate suffices.
High doubles the control count and the operational burden. We've seen agencies over-categorize because "data is important." Impact analysis follows FIPS 199; tailor accordingly.
ATO drift in year two and beyond.
An ATO is granted at a moment in time. Without ConMon discipline, the system that earned authorization is not the system you have a year later. We run the monthly cadence that keeps drift visible.
Inheriting controls from FedRAMP without proving inheritance.
If your system runs on a FedRAMP-authorized PaaS, you can inherit controls from the CSP. The inheritance has to be documented in your SSP and confirmed by the assessor. "It's on AWS" isn't enough.
POA&M items that age in place.
Like 800-171, POA&Ms with no realistic close dates undermine the trust the ATO is built on. We treat the POA&M as an active worklist, not a graveyard.
Common questions about NIST 800-53.
Who has to comply with NIST 800-53?
Federal agencies under FISMA, contractors that host or operate federal information systems on an agency's behalf, and cloud providers seeking FedRAMP authorization. Some state and local governments align to it when a federal grant program requires it. It is the control catalog behind most federal Authorization to Operate packages.
What does NIST 800-53 actually require?
Rev. 5 is a catalog of over 1,000 controls across 20 families. You do not implement all of them. You implement a baseline, Low, Moderate, or High, set by the impact level of the data, plus any agency overlays. Most non-classified federal systems run at the Moderate baseline, around 287 controls.
How do we get an ATO, and can you help?
Authorization runs through the Risk Management Framework: categorize the system, select and implement controls, assess them, authorize, then monitor. We implement the technical controls, write the System Security Plan, and run continuous monitoring. The Authorizing Official, your system owner, and the ISSO roles stay with you, and your AO grants the final ATO.
Which baseline do we need, Low, Moderate, or High?
The baseline follows a FIPS 199 impact analysis of what happens if confidentiality, integrity, or availability is lost. Most systems land at Moderate. High roughly doubles the control count and the operational burden, so over-categorizing because data "feels important" is a costly mistake. We tailor to the actual impact level.
Can we inherit controls from a FedRAMP cloud provider?
Yes, if your system runs on a FedRAMP-authorized platform you can inherit a share of controls from the provider. The catch is that the inheritance has to be documented in your SSP and confirmed by the assessor. "It runs on AWS" on its own does not satisfy a control. We document the inheritance properly.
Related frameworks.
These are closely related.
Let's talk for 30 minutes.
No slides.
Bring your system categorization, your current ATO package, or your agency assessment findings. We'll come back with a written gap analysis, and what it would cost to bring the baseline current.
- 30-min discovery, no slide deck
- Free written assessment, yours to keep
- A clear proposal, no pressure
Or call us directly: 904-639-0003
Schedule a call →