NIST SP 800-53B provides three security baselines, one each for low, moderate and high impact systems, plus a privacy baseline that applies at any level. You pick the baseline from the system's impact level, then tailor it. Higher impact means more controls and stronger versions of them.
Where the baselines come from
SP 800-53 is the catalog: 20 control families, covering areas such as access control, incident response and supply chain risk management. The catalog does not say which controls a given system needs. SP 800-53B does that. It publishes starting sets of controls for each impact level and guidance on tailoring them.
The base documents date from September 2020, with updates in December 2020. NIST issued a minor release, 5.2.0, on 27 August 2025. For 800-53B, NIST says that release made no changes to the baselines. The version number was aligned with SP 800-53 and SP 800-53A.
How a system gets its level
Categorization comes first. FIPS 199 is the standard for categorizing federal information and systems by the potential impact of a compromise, looking at confidentiality, integrity and availability. In the Risk Management Framework, the Categorize step assigns impact levels, and the Select step then chooses controls from the matching baseline.
In practice the system takes the level of its most sensitive information type. A small internal tool that touches only public data may be low. A service that holds sensitive mission data may be moderate or high.
Tailoring and overlays
A baseline is a starting point. Tailoring means adjusting it for your environment. You may drop a control that does not apply, substitute a compensating control, or add controls for specific risk. 800-53B also explains how to build overlays, which are agreed sets of adjustments for a community, a technology or an operating environment.
Document each choice. Assessors will ask why a control was removed or changed, and the written reason is your evidence.
What this means for a software team
If you build for federal customers, expect the customer's categorization to set your baseline, not your own preference. Ask early which level applies. Then map your engineering practices to the controls in that baseline instead of to the whole catalog.
Safeguard's compliance and evidence automation can hold control mappings and evidence for the frameworks you track, and its policies and gates enforce some of the engineering controls in the pipeline. It does not replace the categorization decision, which belongs to the system owner and authorizing official.
Quick check
Does the privacy baseline depend on impact level?
No. NIST describes it as applying regardless of impact level.
Did the 5.2.0 release change the baselines?
NIST states that for SP 800-53B the 5.2.0 release made no changes to the baselines. Check the current text for your own work.
Sources
Last reviewed: 19 October 2026.
