NIST has published SP 800-53 Revision 5, Security and Privacy Controls for Information Systems and Organizations, the most significant update to the catalogue in years.
Key changes
- Controls are now outcome-based and written to apply to any organisation, not only US federal agencies.
- Privacy controls are fully integrated into the catalogue.
- New control families for supply chain risk management and personally identifiable information processing and transparency.
- Control baselines are moved to a separate publication, SP 800-53B.
SP 800-53 underpins US federal requirements and FedRAMP, and increasingly appears in contracts with US customers. NIST publishes mappings to ISO/IEC 27001, helping organisations demonstrate alignment using an existing ISMS.
Source: NIST SP 800-53 Rev. 5 (NIST CSRC)
Need help understanding what this change means for your organisation? Get in touch for a pragmatic, no-obligation conversation.
