NIST SP 800-53 Rev 5 binds US federal systems, and reaches other organizations through contracts and flow down clauses. For everyone else it is a reference catalog: a detailed, public description of what a control can look like. PL-11, Baseline Tailoring, asks you to tailor the selected control baseline by applying specified tailoring actions.
The guidance says tailoring lets an organization specialize a baseline to its mission, environment, threats and constraints. Detailed tailoring guidance is in SP 800-53B. The idea is that a baseline is a starting point and you adjust it on purpose, not by accident.
What it means in practice
Tailoring is the paper trail between a generic control set and your actual system. Each decision to add, remove, scope, or rewrite a control gets a reason. A control you drop because the system has no such function is fine if you say so. A control you drop because it is hard is a finding waiting to happen.
Evidence to collect
- A tailoring log listing each change, with rationale and approver.
- Compensating controls for any control removed or weakened.
- Parameter values chosen for controls that ask you to define them.
- Reference from the system plan to the log.
Common gaps
- Not applicable marked without a reason.
- Parameters left blank, so no one can assess the control.
- Tailoring decisions made in meetings and never recorded.
How to implement it
Walk the baseline control by control. Mark each as applies, applies with changes, or does not apply. Write one sentence of reasoning for every change. Have the system owner approve the log and review it when the system changes.
Quick check
What counts as a valid reason to remove a control?
The control addresses something the system does not have or does, and you can show it. Cost alone is not a reason an assessor will accept without compensating measures.
