If you searched for AT-5 and found an empty control, that is not a mistake. In NIST SP 800-53 Rev 5, AT-5 (Contacts with Security Groups and Associations) is withdrawn. The OSCAL catalog marks it as incorporated into PM-15.
What changed
In earlier revisions AT-5 sat in the Awareness and Training family. Rev 5 moved the idea to the Program Management family, where PM-15 carries it. There is nothing to implement under the AT-5 number itself.
What it means in practice
The practice is still sensible. Having contacts in security groups and associations keeps your team current on threats, practices and advisories. If a framework or customer questionnaire still cites AT-5, answer it with whatever evidence you would give for PM-15.
Evidence to collect
- A list of the security communities, mailing lists, advisory feeds or associations your team follows.
- Who owns each one and how information from them reaches engineers.
- An example of a notice that led to a change.
Common gaps
Citing the withdrawn number in a policy, which makes the document look out of date. Map to PM-15 instead.
Sources
- NIST SP 800-53 Rev 5, AT-5 on the NIST CPRT catalog
- NIST SP 800-53 Rev 5 publication
- Withdrawn status and PM-15 link: OSCAL catalog, NIST SP 800-53 Rev 5.2.0
