NIST 800-53 Information Hub

What is NIST?

The National Institute of Standards and Technology (NIST) is responsible for developing guidelines, cybersecurity standards and resources fit for the requirements of US industry, federal agencies and the general public.

However, NIST’s standards of best practice are applicable beyond the borders of the USA, and are valuable to a range of organisations around the world – whether working with US partners or otherwise.

NIST’s work encompasses both short-term, quick-to-implement practices and longer-term research projects catering for future challenges and technological developments.

{{snapshot}}

What NIST is

• US standards body: NIST develops guidelines, cybersecurity standards and resources for US industry, federal agencies and the public.
• Used worldwide: its best-practice standards are valuable to organisations around the world, whether or not they work with US partners.
• Short and long term: NIST’s work spans quick-to-implement practices and longer-term research for future challenges.

{{/snapshot}}

What is NIST 800-53?

NIST 800-53 is a compliance framework and cybersecurity standard required for federal information systems, agencies, government contractors and departments that wish to work with the US government. Importantly, the framework also serves to ensure that third-party suppliers are taking steps to maintain security and reduce risk within their own organisations.

The framework is continuously updated and aims to define standards, controls and assessments for organisations based on risk, capabilities and cost-effectiveness.

NIST 800-53 Controls

NIST 800-53 features a list of controls created to support the development of resilient and secure federal information systems. The range of controls featured within NIST 800-53 are the operational, technical and management standards used by information systems to retain privacy and security. Discover the entire range of NIST 800-53 control families here.

Controls are categorised in three broad classes:

• High impact
• Medium impact
• Low impact

These classes reflect the potential impact of each risk.

There are 20 different security control families within the framework. Each organisation using NIST 900-53 may select the controls that are most applicable to them.

For organisations with limited resources, tackling 20 different control families may seem unrealistic. However, with the Hicomply platform, it's possible to prioritise activities with greater accuracy and visibility.

{{snapshot}}

NIST 800-53 controls in brief

• Operational, technical, management: the controls are the standards information systems use to retain privacy and security.
• Three impact classes: controls are categorised as high, medium or low impact, reflecting the potential impact of each risk.
• 20 families: there are 20 control families, and each organisation selects the controls most applicable to it.

{{/snapshot}}

How to implement NIST 800-53

The Hicomply platform makes establishing your baseline controls, creating a security plan and monitoring control performance easy. Our NIST solution helps you walk through the requirements of the standard step-by-step, so that you are prepared for an audit and can achieve NIST 800-53 certification – whether it’s necessary for your organisation or not. Use our NIST 800-53 Audit Checklist to help prepare for a compliance audit.

What are the benefits of NIST 800-53?

The NIST framework is beneficial to organisations of all shapes, sizes and sectors because it represents a comprehensive approach to establishing controls that address the majority of risk factors that modern organisations face.

The NIST 800-53 framework also encourages organisations to establish a baseline that is designed to be improved upon over time. With a clear starting point or foundation to build upon, an organisation can then use the NIST 800-53 framework to identify the specific access controls that most urgently require attention (a risk-based approach) and those that are less important/time sensitive.

{{snapshot}}

Why NIST 800-53 matters

• Comprehensive coverage: it addresses the majority of risk factors modern organisations face, across all sizes and sectors.
• Baseline to build on: it encourages establishing a baseline designed to be improved over time.
• Risk-based prioritisation: organisations use it to identify the controls that most urgently need attention.

{{/snapshot}}

Who must comply with NIST 800-53?

Any federal information systems, agencies, government contractors and departments that work with US government need to be in compliance with NIST 800-53. This is to ensure that all federal institutions and the third-party organisations that they work with are secure.

What is the difference between NIST 800-53 and other frameworks?

NIST has more than 1,300 standard reference materials. However, the majority of the compliance frameworks fall under the NIST 800 series. Within the 800 series, each framework has slight variations.

For example, while NIST 800-53 concerns federal departments and their contractors that wish to work with the US government, NIST-171 is a set of compliance standards for non-federal departments that wish to work with the US government.

NIST frameworks also vary from industry-specific compliance standards like FISMA, HIPAA and SOX.

Additional information on the differences between NIST 800-53 and other frameworks can be found on our comparison pages:

• NIST 800-53 vs ISO 27001
• NIST 800-53 vs ISO 27002
• NIST 800-53 vs NIST CSF
• NIST 800-53 vs NIST 800-171

{{snapshot}}

NIST 800-53 vs the rest

• Part of the 800 series: most NIST compliance frameworks fall under the NIST 800 series, each with slight variations.
• 800-53 vs 800-171: 800-53 covers federal departments and contractors, while NIST 800-171 covers non-federal departments working with the US government.
• Beyond NIST: NIST frameworks differ from industry-specific standards like FISMA, HIPAA and SOX.

{{/snapshot}}

Additional NIST compliance resources

More information on NIST compliance standards can be found here:

• NIST Framework
• NIST Maturity Levels
• NIST Best Practice

{{snapshot}}

In Hicomply’s experience

There is no NIST 800-53 certification, so compliance is about establishing a baseline and monitoring it continuously rather than passing a one-off audit. Scope data and controls to your risk, then keep the evidence current so an assessment is never a scramble. Because so much overlaps with ISO 27001, teams pursuing both should map controls once and reuse the evidence.

{{/snapshot}}

Achieving NIST 800-53 compliance

While there is no NIST 800-53 certification, NIST compliance is mandatory for federal agencies and their vendors. NIST outlines nine steps to achieving FISMA compliance. These are: