NIST 800-53 Control Guides: What to Show an Auditor

NIST SP 800-53 Rev 5 is the control catalog behind many federal and customer security requirements. This index links a guide for each base control, with the evidence to collect and the gaps auditors find.

Key takeaways

• 322 guides, each written for defenders and based on the source record.
• 800-53 binds federal systems and, by contract, some suppliers. For everyone else it is a reference.
• Start with the free dependency scan at gold.safeguard.sh/scan if you want a quick look at your own packages.

All guides

• NIST 800-53 AC-1 Access Control Policy: What to Show an Auditor
• NIST 800-53 AC-10 Concurrent Session Control in Plain English
• NIST 800-53 AC-11 Device Lock: Screen Locks Auditors Accept
• NIST 800-53 AC-12 Session Termination and Timeouts
• NIST 800-53 AC-13: Withdrawn, Where the Requirements Went
• NIST 800-53 AC-14: Actions Allowed Without Logging In
• NIST 800-53 AC-15: Withdrawn, Automated Marking Moved to MP-3
• NIST 800-53 AC-16 Security and Privacy Attributes Explained
• NIST 800-53 AC-17 Remote Access: Evidence for VPN and Beyond
• NIST 800-53 AC-18 Wireless Access: What to Document
• NIST 800-53 AC-19 Mobile Device Access Control Explained
• NIST 800-53 AC-2 Account Management: What to Show an Auditor
• NIST 800-53 AC-20 Use of External Systems and Third Party Access
• NIST 800-53 AC-21 Information Sharing With Partners
• NIST 800-53 AC-22 Publicly Accessible Content Review
• NIST 800-53 AC-23 Data Mining Protection Explained
• NIST 800-53 AC-24 Access Control Decisions Explained
• NIST 800-53 AC-25 Reference Monitor: What It Really Means
• NIST 800-53 AC-3 Access Enforcement: Proving Access Rules Work
• NIST 800-53 AC-4 Information Flow Enforcement Explained
• NIST 800-53 AC-5 Separation of Duties: Evidence and Examples
• NIST 800-53 AC-6 Least Privilege: Evidence That Holds Up
• NIST 800-53 AC-7 Unsuccessful Logon Attempts and Lockouts
• NIST 800-53 AC-8 System Use Notification Banners
• NIST 800-53 AC-9 Previous Logon Notification Explained
• NIST 800-53 AT-1 Awareness and Training Policy and Procedures
• NIST 800-53 AT-2 Literacy Training and Awareness: Evidence
• NIST 800-53 AT-3 Role-Based Training: What to Show an Auditor
• NIST 800-53 AT-4 Training Records: What to Show an Auditor
• NIST 800-53 AT-5 Withdrawn: Where Security Group Contacts Went
• NIST 800-53 AT-6 Training Feedback: What to Show an Auditor
• NIST 800-53 AU-1 Audit Policy and Procedures: What to Show
• NIST 800-53 AU-10 Non-repudiation: What to Show an Auditor
• NIST 800-53 AU-11 Audit Record Retention: What to Show
• NIST 800-53 AU-12 Audit Record Generation: What to Show
• NIST 800-53 AU-13 Monitoring for Information Disclosure
• NIST 800-53 AU-14 Session Audit: What to Show an Auditor
• NIST 800-53 AU-15 Withdrawn: Alternate Audit Logging Capability
• NIST 800-53 AU-16 Cross-organizational Audit Logging
• NIST 800-53 AU-2 Event Logging: What to Show an Auditor
• NIST 800-53 AU-3 Content of Audit Records: What to Show
• NIST 800-53 AU-4 Audit Log Storage Capacity: What to Show
• NIST 800-53 AU-5 Audit Logging Failures: What to Show an Auditor
• NIST 800-53 AU-6 Audit Record Review: What to Show an Auditor
• NIST 800-53 AU-7 Audit Record Reduction and Reports: What to Show
• NIST 800-53 AU-8 Time Stamps: What to Show an Auditor
• NIST 800-53 AU-9 Protection of Audit Information: What to Show
• NIST 800-53 CA-1 Assessment Policy and Procedures: What to Show
• NIST 800-53 CA-2 Control Assessments: What to Show an Auditor
• NIST 800-53 CA-3 Information Exchange: What to Show an Auditor
• NIST 800-53 CA-4 Withdrawn: Security Certification Moved to CA-2
• NIST 800-53 CA-5 Plan of Action and Milestones: What to Show
• NIST 800-53 CA-6 Authorization: What to Show an Auditor
• NIST 800-53 CA-7 Continuous Monitoring: What to Show an Auditor
• NIST 800-53 CA-8 Penetration Testing and What to Show an Auditor
• NIST 800-53 CA-9 Internal System Connections Explained
• NIST 800-53 CM-1 Configuration Management Policy and Procedures
• NIST 800-53 CM-10 Software Usage Restrictions and License Evidence
• NIST 800-53 CM-11 User Installed Software Policy and Evidence
• NIST 800-53 CM-12 Information Location and the Data Map Auditors Want
• NIST 800-53 CM-13 Data Action Mapping for Privacy Reviews
• NIST 800-53 CM-14 Signed Components and Code Signature Checks
• NIST 800-53 CM-2 Baseline Configuration and What to Show an Auditor
• NIST 800-53 CM-3 Configuration Change Control Evidence Guide
• NIST 800-53 CM-4 Impact Analyses Before You Change Systems
• NIST 800-53 CM-5 Access Restrictions for Change in Practice
• NIST 800-53 CM-6 Configuration Settings Evidence and Hardening Guide
• NIST 800-53 CM-7 Least Functionality and Reducing Attack Surface
• NIST 800-53 CM-8 System Component Inventory That Survives an Audit
• NIST 800-53 CM-9 Configuration Management Plan Explained
• NIST 800-53 CP-1 Contingency Planning Policy and Procedures
• NIST 800-53 CP-10 System Recovery and Reconstitution Evidence
• NIST 800-53 CP-11 Alternate Communications Protocols
• NIST 800-53 CP-12 Safe Mode of Operation
• NIST 800-53 CP-13 Alternative Security Mechanisms
• NIST 800-53 CP-2 Contingency Plan and What to Show an Auditor
• NIST 800-53 CP-3 Contingency Training and Role Based Evidence
• NIST 800-53 CP-4 Contingency Plan Testing That Proves Readiness
• NIST 800-53 CP-5 Contingency Plan Update Is Withdrawn
• NIST 800-53 CP-6 Alternate Storage Site and Backup Location Evidence
• NIST 800-53 CP-7 Alternate Processing Site and Failover Evidence
• NIST 800-53 CP-8 Telecommunications Services: A Backup Path
• NIST 800-53 CP-9 System Backup: Prove You Can Restore
• NIST 800-53 IA-1 Identification and Authentication Policy
• NIST 800-53 IA-10 Adaptive Authentication Explained
• NIST 800-53 IA-11 Re-authentication: When to Ask Again
• NIST 800-53 IA-12 Identity Proofing: Who Is Really Joining?
• NIST 800-53 IA-13 Identity Providers and Authorization Servers
• NIST 800-53 IA-2 Organizational Users: MFA Evidence for Auditors
• NIST 800-53 IA-3 Device Identification and Authentication
• NIST 800-53 IA-4 Identifier Management: Names That Stay Unique
• NIST 800-53 IA-5 Authenticator Management: Passwords, Keys, Tokens
• NIST 800-53 IA-6 Authentication Feedback: Mask the Secret
• NIST 800-53 IA-7 Cryptographic Module Authentication
• NIST 800-53 IA-8 Non-organizational Users: Customers and Partners
• NIST 800-53 IA-9 Service Identification and Authentication
• NIST 800-53 IR-1 Incident Response Policy and Procedures
• NIST 800-53 IR-10 Withdrawn: Where It Went
• NIST 800-53 IR-2 Incident Response Training: Role Based Proof
• NIST 800-53 IR-3 Incident Response Testing: Run the Drill
• NIST 800-53 IR-4 Incident Handling: What to Show an Auditor
• NIST 800-53 IR-5 Incident Monitoring: Keep the Record
• NIST 800-53 IR-6 Incident Reporting: Internal and External
• NIST 800-53 IR-7 Incident Response Assistance: Who Helps?
• NIST 800-53 IR-8 Incident Response Plan: Contents Auditors Expect
• NIST 800-53 IR-9 Information Spillage Response
• NIST 800-53 MA-1 Maintenance Policy and Procedures
• NIST 800-53 MA-2 Controlled Maintenance: Records and Approvals
• NIST 800-53 MA-3 Maintenance Tools: What to Show an Auditor
• NIST 800-53 MA-4 Nonlocal Maintenance: Remote Sessions Explained
• NIST 800-53 MA-5 Maintenance Personnel: Who May Touch Your Systems
• NIST 800-53 MA-6 Timely Maintenance: Spare Parts and Support
• NIST 800-53 MA-7 Field Maintenance: Restrict It on Critical Systems
• NIST 800-53 MP-1 Media Protection Policy: What an Auditor Reads
• NIST 800-53 MP-2 Media Access: Who Can Reach Removable Media
• NIST 800-53 MP-3 Media Marking: Labels and Handling Caveats
• NIST 800-53 MP-4 Media Storage: Secure Until Destroyed
• NIST 800-53 MP-5 Media Transport: Moving Drives and Tapes Safely
• NIST 800-53 MP-6 Media Sanitization: Proving Data Is Gone
• NIST 800-53 MP-7 Media Use: Controlling USB and Portable Storage
• NIST 800-53 MP-8 Media Downgrading: A Plain Explanation
• NIST 800-53 PE-1 Physical Protection Policy: What to Write and Keep
• NIST 800-53 PE-10 Emergency Shutoff: Power Off Safely
• NIST 800-53 PE-11 Emergency Power: UPS Basics for Auditors
• NIST 800-53 PE-12 Emergency Lighting: Exit Routes in an Outage
• NIST 800-53 PE-13 Fire Protection: Detection and Suppression Evidence
• NIST 800-53 PE-14 Environmental Controls: Temperature and Humidity
• NIST 800-53 PE-15 Water Damage Protection: Shutoff Valves
• NIST 800-53 PE-16 Delivery and Removal: Tracking Equipment In and Out
• NIST 800-53 PE-17 Alternate Work Site: Securing Remote Work
• NIST 800-53 PE-18 Location of System Components: Placement Matters
• NIST 800-53 PE-19 Information Leakage: Electromagnetic Emanations
• NIST 800-53 PE-2 Physical Access Authorizations: Lists and Reviews
• NIST 800-53 PE-20 Asset Monitoring and Tracking: Location Technology
• NIST 800-53 PE-21 Electromagnetic Pulse Protection: A Brief Guide
• NIST 800-53 PE-22 Component Marking: What to Show an Auditor
• NIST 800-53 PE-23 Facility Location: What to Show an Auditor
• NIST 800-53 PE-3 Physical Access Control: What to Show an Auditor
• NIST 800-53 PE-4 Access Control for Transmission: What to Show
• NIST 800-53 PE-5 Access Control for Output Devices: Audit Guide
• NIST 800-53 PE-6 Monitoring Physical Access: What Auditors Ask
• NIST 800-53 PE-7 Visitor Control: Withdrawn, and Where It Went
• NIST 800-53 PE-8 Visitor Access Records: What to Show an Auditor
• NIST 800-53 PE-9 Power Equipment and Cabling: Evidence Guide
• NIST 800-53 PL-1 Planning Policy and Procedures: Audit Guide
• NIST 800-53 PL-10 Baseline Selection: How to Pick and Show It
• NIST 800-53 PL-11 Baseline Tailoring: Evidence and Pitfalls
• NIST 800-53 PL-2 System Security and Privacy Plans: Audit Guide
• NIST 800-53 PL-3 System Security Plan Update: Withdrawn in Rev 5
• NIST 800-53 PL-4 Rules of Behavior: What to Show an Auditor
• NIST 800-53 PL-5 Privacy Impact Assessment: Withdrawn, Now RA-8
• NIST 800-53 PL-6 Security Activity Planning: Withdrawn, Now PL-2
• NIST 800-53 PL-7 Concept of Operations: What to Show an Auditor
• NIST 800-53 PL-8 Security and Privacy Architectures: What to Show
• NIST 800-53 PL-9 Central Management: What It Means for Controls
• NIST 800-53 PM-1 Information Security Program Plan: Audit Guide
• NIST 800-53 PM-10 Authorization Process: What to Show an Auditor
• NIST 800-53 PM-11 Mission and Business Process Definition
• NIST 800-53 PM-12 Insider Threat Program: What to Show an Auditor
• NIST 800-53 PM-13 Security and Privacy Workforce: Audit Guide
• NIST 800-53 PM-14 Testing, Training, and Monitoring: Audit Guide
• NIST 800-53 PM-15 Security and Privacy Groups and Associations
• NIST 800-53 PM-16 Threat Awareness Program: Share to Defend
• NIST 800-53 PM-17: Protecting CUI on External Systems
• NIST 800-53 PM-18 Privacy Program Plan: What It Contains
• NIST 800-53 PM-19 Privacy Program Leadership Role Explained
• NIST 800-53 PM-2: Naming Your Security Program Leader
• NIST 800-53 PM-20 Privacy Web Page: What to Publish
• NIST 800-53 PM-21 Accounting of Disclosures: What to Log
• NIST 800-53 PM-22: Keeping Personal Data Accurate
• NIST 800-53 PM-23 Data Governance Body: Who Sits on It
• NIST 800-53 PM-24 Data Integrity Board in Plain Terms
• NIST 800-53 PM-25: Keep Real PII Out of Testing
• NIST 800-53 PM-26 Complaint Management: Build the Intake
• NIST 800-53 PM-27 Privacy Reporting: What Gets Reported
• NIST 800-53 PM-28 Risk Framing: Write Down Your Assumptions
• NIST 800-53 PM-29 Risk Management Leadership Roles
• NIST 800-53 PM-3 Security and Privacy Resources in Budget
• NIST 800-53 PM-30 Supply Chain Risk Management Strategy
• NIST 800-53 PM-31 Continuous Monitoring Strategy: Metrics and Cadence
• NIST 800-53 PM-32 Purposing: Is a System Doing Its Job?
• NIST 800-53 PM-4 Plan of Action and Milestones: Track Fixes
• NIST 800-53 PM-5 System Inventory: List What You Run
• NIST 800-53 PM-6 Measures of Performance: Pick Metrics That Hold
• NIST 800-53 PM-7 Enterprise Architecture with Security in It
• NIST 800-53 PM-8 Critical Infrastructure Plan Explained
• NIST 800-53 PM-9 Risk Management Strategy: What a Plan Needs
• NIST 800-53 PS-1 Personnel Security Policy: What to Write
• NIST 800-53 PS-2 Position Risk Designation Explained
• NIST 800-53 PS-3 Personnel Screening: What to Show an Auditor
• NIST 800-53 PS-4 Personnel Termination: What to Show an Auditor
• NIST 800-53 PS-5 Personnel Transfer: Access After a Role Change
• NIST 800-53 PS-6 Access Agreements: What to Show an Auditor
• NIST 800-53 PS-7 External Personnel Security: Contractors and Vendors
• NIST 800-53 PS-8 Personnel Sanctions: A Short Evidence Guide
• NIST 800-53 PS-9 Position Descriptions: Security Roles in Job Specs
• NIST 800-53 PT-1 PII Processing Policy: What to Show an Auditor
• NIST 800-53 PT-2 Authority to Process PII: Legal Basis in Practice
• NIST 800-53 PT-3 PII Processing Purposes: Evidence Guide
• NIST 800-53 PT-4 Consent: What the Control Asks For
• NIST 800-53 PT-5 Privacy Notice: Content and Evidence for Auditors
• NIST 800-53 PT-6 System of Records Notice: Who It Applies To
• NIST 800-53 PT-7 Special Categories of PII: Sensitive Data Handling
• NIST 800-53 PT-8 Computer Matching Requirements: Federal Scope
• NIST 800-53 RA-1 Risk Assessment Policy: What to Show an Auditor
• NIST 800-53 RA-10 Threat Hunting: What an Auditor Looks For
• NIST 800-53 RA-2 Security Categorization: Rating Your Systems
• NIST 800-53 RA-3 Risk Assessment: What to Show an Auditor
• NIST 800-53 RA-5 Vulnerability Scanning: Evidence an Auditor Accepts
• NIST 800-53 RA-6 Technical Surveillance Countermeasures Survey
• NIST 800-53 RA-7 Risk Response: Mitigate, Accept, Share or Avoid
• NIST 800-53 RA-8 Privacy Impact Assessments: When and How
• NIST 800-53 RA-9 Criticality Analysis: Find What Matters Most
• NIST 800-53 SA-1 System and Services Acquisition Policy: A Guide
• NIST 800-53 SA-10 Developer Configuration Management: Proof Guide
• NIST 800-53 SA-11 Developer Testing: What to Show an Auditor
• NIST 800-53 SA-12 Supply Chain Protection: Withdrawn, Now SR
• NIST 800-53 SA-13 Trustworthiness: Withdrawn, Now in SA-8
• NIST 800-53 SA-14 Criticality Analysis: Withdrawn, Now RA-9
• NIST 800-53 SA-15 Development Process, Standards, Tools: Evidence
• NIST 800-53 SA-16 Developer-provided Training: What to Show
• NIST 800-53 SA-17 Developer Security Architecture and Design
• NIST 800-53 SA-18 Tamper Resistance and Detection: Now SR-9
• NIST 800-53 SA-19 Component Authenticity: Now SR-11
• NIST 800-53 SA-2 Allocation of Resources: What to Show
• NIST 800-53 SA-20 Customized Development of Critical Components
• NIST 800-53 SA-21 Developer Screening: What to Show an Auditor
• NIST 800-53 SA-22 Unsupported System Components: What to Show
• NIST 800-53 SA-23 Specialization: Hardening What Matters Most
• NIST 800-53 SA-24 Design for Cyber Resiliency: A Practical Read
• NIST 800-53 SA-3 System Development Life Cycle: Audit Evidence
• NIST 800-53 SA-4 Acquisition Process: What to Put in the Contract
• NIST 800-53 SA-5 System Documentation: What to Show an Auditor
• NIST 800-53 SA-6 Software Usage Restrictions: Withdrawn
• NIST 800-53 SA-7 User-installed Software: Withdrawn
• NIST 800-53 SA-8 Security Engineering Principles: Audit Evidence
• NIST 800-53 SA-9 External System Services: What to Show
• NIST 800-53 SC-1 System and Communications Protection Policy
• NIST 800-53 SC-10 Network Disconnect: What to Show an Auditor
• NIST 800-53 SC-11 Trusted Path: What It Is and What to Show
• NIST 800-53 SC-12 Cryptographic Key Management: What to Show
• NIST 800-53 SC-13 Cryptographic Protection: What to Show
• NIST 800-53 SC-14 Public Access Protections: Withdrawn, Now Where?
• NIST 800-53 SC-15 Collaborative Computing: What to Show an Auditor
• NIST 800-53 SC-16 Security and Privacy Attributes in Transit
• NIST 800-53 SC-17 PKI Certificates: Evidence an Auditor Wants
• NIST 800-53 SC-18 Mobile Code: Controlling Code That Travels
• NIST 800-53 SC-19 Voice Over IP: Withdrawn, Still Worth Checking
• NIST 800-53 SC-2 Separating User and Admin Functions: What to Show
• NIST 800-53 SC-20 Secure DNS for Authoritative Servers
• NIST 800-53 SC-21 Secure DNS for Recursive Resolvers
• NIST 800-53 SC-22 Fault Tolerant DNS Architecture
• NIST 800-53 SC-23 Session Authenticity: What to Show an Auditor
• NIST 800-53 SC-24 Fail in Known State: Designing Safe Failures
• NIST 800-53 SC-25 Thin Nodes: Keep Endpoints Small
• NIST 800-53 SC-26 Decoys: Honeypots and What Evidence Looks Like
• NIST 800-53 SC-27 Platform Independent Applications Explained
• NIST 800-53 SC-28 Protection of Information at Rest
• NIST 800-53 SC-29 Heterogeneity: Diversity Has a Cost
• NIST 800-53 SC-3 Security Function Isolation Explained
• NIST 800-53 SC-30 Concealment and Misdirection Explained
• NIST 800-53 SC-31 Covert Channel Analysis in Practice
• NIST 800-53 SC-32 System Partitioning: Segmenting Your Environment
• NIST 800-53 SC-33 Transmission Preparation Integrity: Now in SC-8
• NIST 800-53 SC-34 Non-modifiable Executable Programs
• NIST 800-53 SC-35 External Malicious Code Identification
• NIST 800-53 SC-36 Distributed Processing and Storage
• NIST 800-53 SC-37 Out of Band Channels: What to Show
• NIST 800-53 SC-38 Operations Security (OPSEC) Explained
• NIST 800-53 SC-39 Process Isolation: What to Show an Auditor
• NIST 800-53 SC-4 Information in Shared System Resources
• NIST 800-53 SC-40 Wireless Link Protection: What to Show an Auditor
• NIST 800-53 SC-41 Port and I/O Device Access: What to Show an Auditor
• NIST 800-53 SC-42 Sensor Capability and Data: Phones and Cameras
• NIST 800-53 SC-43 Usage Restrictions: What to Show an Auditor
• NIST 800-53 SC-44 Detonation Chambers: Sandboxing Suspicious Files
• NIST 800-53 SC-45 System Time Synchronization: What to Show
• NIST 800-53 SC-46 Cross Domain Policy Enforcement Explained
• NIST 800-53 SC-47 Alternate Communications Paths for Operations
• NIST 800-53 SC-48 Sensor Relocation: Moving Your Monitoring
• NIST 800-53 SC-49 Hardware-enforced Separation and Policy Enforcement
• NIST 800-53 SC-5 Denial-of-service Protection: What to Show
• NIST 800-53 SC-50 Software-enforced Separation and Policy Enforcement
• NIST 800-53 SC-51 Hardware-based Protection of Firmware
• NIST 800-53 SC-6 Resource Availability: Priorities and Quotas
• NIST 800-53 SC-7 Boundary Protection: What to Show an Auditor
• NIST 800-53 SC-8 Transmission Confidentiality and Integrity
• NIST 800-53 SC-9 Transmission Confidentiality: Withdrawn, Use SC-8
• NIST 800-53 SI-1 System and Information Integrity Policy: Evidence
• NIST 800-53 SI-10 Information Input Validation: What to Show
• NIST 800-53 SI-11 Error Handling: What to Show an Auditor
• NIST 800-53 SI-12 Information Management and Retention Explained
• NIST 800-53 SI-13 Predictable Failure Prevention Explained
• NIST 800-53 SI-14 Non-persistence: Short Lived Systems as Security
• NIST 800-53 SI-15 Information Output Filtering: What to Show
• NIST 800-53 SI-16 Memory Protection: DEP and ASLR as Evidence
• NIST 800-53 SI-17 Fail-safe Procedures: What to Show an Auditor
• NIST 800-53 SI-18 PII Quality Operations: What to Show an Auditor
• NIST 800-53 SI-19 De-identification: Evidence and Common Gaps
• NIST 800-53 SI-2 Flaw Remediation: What to Show an Auditor
• NIST 800-53 SI-20 Tainting: Planting Data to Catch Exfiltration
• NIST 800-53 SI-21 Information Refresh: Evidence for Auditors
• NIST 800-53 SI-22 Information Diversity: A Practical Reading
• NIST 800-53 SI-23 Information Fragmentation Explained
• NIST 800-53 SI-3 Malicious Code Protection: Evidence Guide
• NIST 800-53 SI-4 System Monitoring: What to Show an Auditor
• NIST 800-53 SI-5 Security Alerts and Advisories: Evidence
• NIST 800-53 SI-6 Security Function Verification Evidence
• NIST 800-53 SI-7 Software and Information Integrity: Evidence
• NIST 800-53 SI-8 Spam Protection: What to Show an Auditor
• NIST 800-53 SR-1 SCRM Policy and Procedures: What to Show
• NIST 800-53 SR-10 Inspection of Components: What It Asks
• NIST 800-53 SR-11 Component Authenticity: Counterfeit Controls
• NIST 800-53 SR-12 Component Disposal: Evidence and Gaps
• NIST 800-53 SR-2 SCRM Plan: What to Show an Auditor
• NIST 800-53 SR-3 Supply Chain Controls and Processes: Evidence
• NIST 800-53 SR-4 Provenance: What to Show an Auditor
• NIST 800-53 SR-5 Acquisition Strategies: What to Show an Auditor
• NIST 800-53 SR-6 Supplier Assessments and Reviews: Evidence
• NIST 800-53 SR-7 Supply Chain OPSEC: What It Means for You
• NIST 800-53 SR-8 Notification Agreements and Supplier Contracts
• NIST 800-53 SR-9 Tamper Resistance and Detection: Evidence

Frequently asked questions

Last reviewed: 19 October 2026.