NIST SP 800-53B gives three security baselines (low, moderate and high) plus a privacy baseline, then tells you how to tailor them. Tailoring adds, removes or adjusts controls for your situation. An overlay packages a set of those changes so a whole community, technology or environment can reuse them.
What the publication contains
The NIST page for SP 800-53B describes it as control baselines for information systems and organizations. It sets out three security baselines, one each for low, moderate and high system impact, and a privacy baseline that applies regardless of impact level. It provides tailoring guidance and working assumptions to help with control selection, and explains how to develop overlays for specific communities of interest, technologies and operating environments.
On 27 August 2025 NIST issued release 5.2.0, which changed the version number but not the baselines.
Tailoring in practice
Tailoring is a set of decisions about a baseline. Common kinds are listed below, but check the formal tailoring steps in SP 800-53B before you rely on this list.
- Assign values. Fill the organization-defined parameters.
- Scope. Apply a control only to the components where it makes sense.
- Compensate. Where a control cannot be met as written, document an alternative that addresses the same risk.
- Supplement. Add controls or enhancements the baseline lacks, based on your risk assessment.
The point is that each choice has a reason. A tailored baseline with no recorded reasons will not hold up in an assessment.
What an overlay adds
An overlay is a reusable tailoring. A community that shares a mission or technology agrees a common adjustment once instead of every system doing it alone. NIST's own control overlays project for securing AI systems is an example of the idea applied to a technology area, and its page lists it as a related project.
If you sell to a program, ask whether it uses an overlay. If so, you inherit its tailoring decisions, and your plan should say so.
A simple record for your own system
- Baseline chosen, with the impact level and reason.
- Each tailoring decision: control, change, rationale, approver, date.
- Any overlay applied, with its name and version.
- Controls inherited from a provider, and which party owns each.
- Review date.
Keep this in the system plan, per SP 800-18 Rev. 2, so assessors see the decisions and the controls together.
Common mistakes
Dropping a control because it feels hard. Removal needs a rationale tied to risk.
Adding every enhancement. More controls is not safer if you cannot operate them.
Copying another program's tailoring without checking its assumptions.
Try it yourself
Click a control to see how mapping differs between frameworks, which is what tailoring decisions must stay consistent with.
Click through it at your own pace, or open it full screen.
Quick check
Does tailoring change the baselines in the publication?
No. Tailoring changes what applies to your system. The published baselines stay as they are.
What is an overlay?
A reusable set of tailoring decisions for a community of interest, technology or operating environment, per SP 800-53B.
Safeguard's compliance and evidence automation and framework mapping help keep a tailored control set and its evidence together. A free scan is at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
