Which NIST 800-53 controls do developers touch, and at what baseline?

Developers touch about a dozen NIST SP 800-53 Rev. 5 controls, mostly in System and Services Acquisition, Configuration Management, System and Information Integrity, Risk Assessment and Supply Chain Risk Management. Several of the build-focused ones, such as SA-11 and SA-15, appear only from the moderate baseline up.

How the numbers were checked

Rev. 5 has 20 control families. NIST publishes the catalog and the three baseline profiles in machine-readable form, and the counts below come from the Rev. 5 content at release 5.2.0: 149 controls in the low baseline, 287 in moderate and 370 in high. NIST's own page for SP 800-53B says release 5.2.0 changed the version number but not the baselines.

The developer shortlist

• CM-8 System Component Inventory. What it asks of a software team: An accurate inventory of components; Low: yes; Moderate: yes; High: yes
• RA-5 Vulnerability Monitoring and Scanning. What it asks of a software team: Scan and remediate on a defined schedule; Low: yes; Moderate: yes; High: yes
• SI-2 Flaw Remediation. What it asks of a software team: Identify, report and fix flaws, and install updates within a set time; Low: yes; Moderate: yes; High: yes
• SR-3 Supply Chain Controls and Processes. What it asks of a software team: Find and address weaknesses in supply chain elements; Low: yes; Moderate: yes; High: yes
• SR-11 Component Authenticity. What it asks of a software team: Detect and prevent counterfeit components; Low: yes; Moderate: yes; High: yes
• SA-8 Engineering Principles. What it asks of a software team: Apply security engineering principles in design and build; Low: yes; Moderate: yes; High: yes
• SA-22 Unsupported System Components. What it asks of a software team: Replace components that lose vendor support; Low: yes; Moderate: yes; High: yes
• SA-10 Developer Configuration Management. What it asks of a software team: Control and document changes, track flaws; Low: no; Moderate: yes; High: yes
• SA-11 Developer Testing and Evaluation. What it asks of a software team: A testing plan, evidence of results, verifiable flaw remediation; Low: no; Moderate: yes; High: yes
• SA-15 Development Process, Standards, and Tools. What it asks of a software team: A documented process that addresses security; Low: no; Moderate: yes; High: yes
• SI-7 Software, Firmware, and Information Integrity. What it asks of a software team: Detect unauthorized change; Low: no; Moderate: yes; High: yes
• SA-17 Developer Security and Privacy Architecture and Design. What it asks of a software team: Architecture documentation; Low: no; Moderate: no; High: yes

Reading the list

Low-baseline systems still need an inventory, scanning and flaw remediation. The moderate step adds the developer-process controls: tested evidence, controlled changes and a documented development process. The high baseline adds more design documentation.

Enhancements are listed separately. For example, the automated flaw remediation status enhancement of SI-2 is in moderate and high, and static code analysis under SA-11 is an enhancement that is not selected by any baseline in this release. Your agency or program may select it anyway.

What the blanks mean

Many controls contain organization-defined parameters. The control text leaves a value for someone to fill in, such as how quickly updates must be installed. The baseline gives you the control, and the agency or program gives you the number. Do not guess a value from a blog post.

Try it yourself

Open the demo and click a framework control to see which inventory and scan records satisfy it.

Click through it at your own pace, or open it full screen.

Quick check

Safeguard's SBOM and dependency scanning, policies and gates, and compliance and evidence automation produce records of the kind these controls ask for. A free scan is at gold.safeguard.sh/scan.

Sources

• NIST SP 800-53 Rev. 5 page
• NIST SP 800-53B page
• NIST OSCAL content: 800-53 Rev. 5 catalog and baseline profiles

Last reviewed: 19 October 2026.