NIST SP 800-53 Rev 5
ActiveCore framework
Best for: NIST SP 800-53 mandates specific security and privacy controls required for the federal government and critical infrastructure. It builds on FISMA, a federal law that requires U.S. government agencies to create, review, and report on agency-wide practices that prioritize information security.
| Mandatory? | Mandatory for U.S. federal agencies; voluntary for private sector |
|---|---|
| Who validates? | Authorizing Official; 3PAO for FedRAMP overlays. No self-assessment. |
| Renewal | ATO reauthorization every 3 years (federal) |
| Scope | Federal information systems; also used as private-sector baseline |
| Governing body | National Institute of Standards and Technology (NIST), NIST SP 800-53 Rev 5 (Sep 2020). Official source |
Controls by category
67 controls are Mapped to NIST SP 800-53 Rev 5.
AC-17 Remote Access
| Control | Status |
|---|---|
| Compute Engine instances should have 'Block Project-wide SSH keys' enabled | Mapped |
AC-18 Wireless Access
AC-2 Account Management
| Control | Status |
|---|---|
| Compute Engine instances should all have OS Login enabled in the project | Mapped |
AC-3 Account Management
AC-5 Separation Of Duties
AC-6 Least Privilege
AU-12 Audit Record Generation
AU-2 Event Logging
AU-3 Content of Audit Records
AU-6 Audit Record Review, Analysis And Reporting
AU-7 Audit Record Reduction And Report Generation
CA-9 Internal System Connections
CM-1 Configuration Management Policy and Procedures
CM-2 Baseline Configuration
CM-6 Configuration Settings
CM-7 Least Functionality
CM-8 System Component Inventory
| Control | Status |
|---|---|
| Projects should have Cloud Asset Inventory enabled | Mapped |
CM-9 Configuration Management Plan
IA-5 Authenticator Management
IR-6 Incident Reporting
| Control | Status |
|---|---|
| Organizations should have Essential Contacts configured | Mapped |
MA-4 Nonlocal Maintenance
| Control | Status |
|---|---|
| Cloud SQL instances should not have public IP addresses | Mapped |
MP-2 Media Access
PL-8 Information Security Architecture
SA-10 Developer Configuration Management
SA-3 System Development Life Cycle
SA-8 Security Engineering Principles
SC-28 Protection Of Information At Rest
SC-7 Boundary Protection
SC-8 Transmission Confidentiality And Integrity
| Control | Status |
|---|---|
| Compute Engine instances should have 'Block Project-wide SSH keys' enabled | Mapped |
SI-4 System Monitoring
| Control | Status |
|---|---|
| VPC subnets should all have VPC Flow Logs enabled | Mapped |
SI-7 Software, Firmware, and Information Integrity
Related frameworks
| Framework | Control overlap | Note |
|---|---|---|
| CIS GCP Benchmark v2.0.0 | High 94% | |
| CIS GCP Benchmark v3.0.0 | High 93% | |
| CIS GCP Benchmark v4.0.0 | High 93% |
Frequently asked questions
Who publishes NIST SP 800-53 and what is its purpose?
NIST publishes it, and NIST is part of the U.S. Department of Commerce. It is a catalog of security and privacy controls for information systems and organizations. The catalog is meant to protect operations, assets, individuals and the Nation from a diverse set of threats and risks.
Which control families does SP 800-53 Rev. 5 include?
They include Access Control, Audit and Accountability, Configuration Management, Identification and Authentication, Incident Response, System and Communications Protection, System and Information Integrity, and Supply Chain Risk Management.
What changed in the most recent minor release of Rev. 5?
On August 27, 2025, NIST issued Release 5.2.0. It added `SA-15(13)`, `SA-24` and `SI-02(07)`, and revised `SI-07(12)`. It also updated the discussion of several controls.
What attestation has Google Cloud received for NIST SP 800-53?
Google Cloud received an attestation letter through an independent, third-party assessment. The letter confirmed that a subset of its Google Cloud and Google Workspace services operate in compliance with NIST SP 800-53 controls.