SP 800-53 Rev. 5 has more than a thousand controls and enhancements, but an assessment usually turns on about twenty, because the rest depend on them: if the inventory, accounts, MFA, patching and logging are weak, few other controls can be shown to work. This page is NHI Mgmt Group's selection of those twenty high-value controls. We chose controls that are in the Low baseline or are the base control of a Moderate requirement, that map to CIS Controls Implementation Group 1 or CISA's Cross-Sector Cybersecurity Performance Goals, and that other controls rely on for their evidence. For each we give what the assessor tests, the finding we see most often and the evidence to have ready. Baselines are from NIST's OSCAL Release 5.2.0 baseline profiles. It is written for control owners, ISSOs and teams preparing for an SP 800-53, FedRAMP or customer assessment. For the catalogue itself, see the NIST SP 800-53 Guide.
Key takeaways
- An SP 800-53 assessment usually turns on about twenty controls, because most others depend on them for their evidence.
- CM-8 inventory and AC-2 account management set the scope that almost every other control is measured against.
- MFA under IA-2(1) and IA-2(2) is in the Low baseline, and gaps on VPN, remote access portals and cloud consoles are a frequent finding.
- AC-6 Least Privilege and SC-8 are not in the Low baseline; they start at Moderate.
- Assessors test against the organisation-defined parameters you wrote in the system security plan, so fill those first.
- Collected logs are not enough: AU-6 needs evidence that someone reviews them.
- An annual assessment is not continuous monitoring under CA-7.
The 20 controls at a glance
The table lists all twenty controls in our recommended order of attention (L = Low, M = Moderate, H = High baseline). The order is ours, not NIST's.
| # | Control | Baselines | What it underpins |
|---|---|---|---|
| 1 | CM-8 System Component Inventory | L, M, H | Scope for every technical control |
| 2 | AC-2 Account Management | L, M, H | Who and what can access the system |
| 3 | IA-2 Identification and Authentication (Organizational Users), with (1) and (2) | L, M, H | MFA for every account |
| 4 | AC-6 Least Privilege | M, H | Limits blast radius of any compromise |
| 5 | IA-5 Authenticator Management | L, M, H | Password, key and secret lifecycle |
| 6 | RA-5 Vulnerability Monitoring and Scanning | L, M, H | Knowing what is exposed |
| 7 | SI-2 Flaw Remediation | L, M, H | Fixing what is exposed |
| 8 | CM-6 Configuration Settings | L, M, H | Hardened, consistent systems |
| 9 | CM-7 Least Functionality | L, M, H | Reduced attack surface |
| 10 | AU-2 Event Logging | L, M, H | Evidence for detection and investigation |
| 11 | AU-6 Audit Record Review, Analysis, and Reporting | L, M, H | Turning logs into detection |
| 12 | SI-4 System Monitoring | L, M, H | Detecting attacks in progress |
| 13 | AC-17 Remote Access | L, M, H | The most attacked entry point |
| 14 | SC-7 Boundary Protection | L, M, H | Controlled external and internal interfaces |
| 15 | SC-8 Transmission Confidentiality and Integrity | M, H | Protecting data and credentials in transit |
| 16 | CP-9 System Backup | L, M, H | Recovery from ransomware and error |
| 17 | IR-4 Incident Handling | L, M, H | Containing what monitoring finds |
| 18 | CM-2 Baseline Configuration | L, M, H | The reference state for change and drift |
| 19 | SA-9 External System Services | L, M, H | Cloud, SaaS and managed service risk |
| 20 | CA-7 Continuous Monitoring | L, M, H | Keeping all of the above true between assessments |
1. CM-8 System Component Inventory
What is tested: an inventory that reflects the system, at the level of granularity needed for tracking and reporting, reviewed on your defined frequency. Moderate adds updating it during installation and removal (CM-8(1)) and automated detection of unauthorised components (CM-8(3)). Common finding: separate lists for on-premises, cloud and SaaS that disagree. Evidence: one reconciled inventory with owner and last-seen date, and a discovery comparison. See the Asset Inventory and CMDB Security Guide.
2. AC-2 Account Management
What is tested: defined account types, approval before creation, notification and removal when users leave or move, and reviews on your stated frequency. Moderate adds automated management, removal of temporary accounts and disabling inactive accounts (AC-2(3)). Common finding: service and emergency accounts missing from the inventory, and inactive accounts still enabled. The VPN account used against Colonial Pipeline was unused but never disabled; see the Colonial Pipeline Ransomware Attack 2021. Evidence: account list with owners, HR leaver reconciliation, review sign-offs.
3. IA-2 Identification and Authentication, with MFA
What is tested: unique identification of users and MFA for privileged (IA-2(1)) and non-privileged (IA-2(2)) accounts, plus replay-resistant authentication (IA-2(8)), all at the Low baseline. Common finding: MFA on single sign-on but not on VPN, remote access portals or cloud consoles. Change Healthcare's remote access portal had no MFA; see the Change Healthcare Breach 2024. Evidence: list of access paths with MFA enforcement for each and an exception register. See the Phishing-Resistant MFA Guide.
4. AC-6 Least Privilege
What is tested: only the access needed for assigned tasks, with Moderate enhancements for separate admin accounts (AC-6(2)), restricted privileged accounts (AC-6(5)), privilege reviews (AC-6(7)), logging privileged functions (AC-6(9)) and blocking non-privileged users from privileged functions (AC-6(10)). AC-6 is not in the Low baseline. Common finding: large standing admin groups and reviews that remove nothing. Evidence: privileged account list mapped to people, review records with removals. See the Least Privilege Techniques Guide.
5. IA-5 Authenticator Management
What is tested: the authenticator lifecycle: identity verification at issue, changing defaults before first use, refresh on your defined frequency or events, protection of authenticator content, and IA-5(1) password rules, including a blocklist of common and compromised passwords. Common finding: service account passwords and API keys never rotated, or stored in scripts, which IA-5(7) prohibits when unencrypted. Evidence: password policy, blocklist update date, vault coverage and secret scanning results. See the Secrets Management Guide.
6. RA-5 Vulnerability Monitoring and Scanning
What is tested: scanning on your defined frequency and when new vulnerabilities are reported, analysis of results, remediation within defined response times and sharing of results. RA-5(2) (updating the vulnerabilities scanned) and RA-5(11) (a public disclosure programme) are in all three baselines; RA-5(5) (privileged access for scans) is at Moderate. Common finding: unauthenticated scans that miss most findings, and coverage measured against the scanner's own list instead of CM-8. Evidence: scan schedule, coverage against the inventory, credentialed scan success rate.
7. SI-2 Flaw Remediation
What is tested: identification and correction of flaws, testing updates before installation, installing security updates within your defined time, and folding remediation into configuration management. SI-2(2) adds automated status reporting at Moderate. Common finding: remediation time defined in policy but not measured, and no priority for known exploited vulnerabilities. Evidence: patch compliance by severity against the defined time, exception records. See the Patch Management Guide.
8. CM-6 Configuration Settings
What is tested: documented configuration settings reflecting the most restrictive mode consistent with operations, implemented, with deviations approved and changes monitored. Common finding: a hardening standard that exists on paper with no compliance scan. Evidence: the standard (CIS Benchmarks or DISA STIGs are common sources), scan results and approved deviations. See the Secure Configuration and Hardening Policy Template.
9. CM-7 Least Functionality
What is tested: systems configured to provide only essential capabilities, with unnecessary functions, ports, protocols, software and services prohibited or restricted. Moderate adds periodic review (CM-7(1)), preventing program execution (CM-7(2)) and allow-by-exception software (CM-7(5)). Common finding: legacy protocols and management services left enabled. Evidence: port and service baselines, application control policy.
10. AU-2 Event Logging
What is tested: the event types the system can log, coordination with other functions that need logs, the event types actually selected for logging and the rationale, reviewed on your defined frequency. Common finding: no list of selected events, or identity provider and cloud control-plane logs not collected. Evidence: event selection list and the log sources onboarded. See the Log Management and Retention Guide.
11. AU-6 Audit Record Review, Analysis, and Reporting
What is tested: review and analysis of audit records on your defined frequency for indications of inappropriate or unusual activity, and reporting of findings. Moderate adds automated process integration (AU-6(1)) and correlating repositories (AU-6(3)). Common finding: logs collected but no evidence anyone reviews them. Evidence: detection rules, review records and escalated tickets.
12. SI-4 System Monitoring
What is tested: monitoring for attacks and indicators of potential attacks, unauthorised connections and unauthorised use, with monitoring devices deployed strategically. Moderate adds real-time analysis (SI-4(2)), inbound and outbound traffic monitoring (SI-4(4)) and system-generated alerts (SI-4(5)). Common finding: endpoint alerts monitored but identity and cloud alerts not. Evidence: monitoring architecture, alert volumes and triage metrics. See the SIEM Guide.
13. AC-17 Remote Access
What is tested: documented restrictions and authorisation for each type of remote access. Moderate adds automated monitoring (AC-17(1)), encryption (AC-17(2)), managed access control points (AC-17(3)) and restrictions on privileged commands over remote access (AC-17(4)). Common finding: vendor remote support tools and old VPN profiles outside the authorised list. Evidence: remote access method list, gateway configuration, session logs. See the Remote Access Identity Guide.
14. SC-7 Boundary Protection
What is tested: monitoring and control of communications at external and key internal interfaces, subnetworks for publicly accessible components, and connections only through managed interfaces. Moderate adds limiting access points (SC-7(3)), deny by default (SC-7(5)) and preventing split tunnelling (SC-7(7)). Common finding: broad "any" rules and cloud security groups open to the internet. Evidence: boundary diagram, rule review records. See the Network Segmentation Guide.
15. SC-8 Transmission Confidentiality and Integrity
What is tested: protection of transmitted information, with SC-8(1) requiring cryptographic mechanisms at Moderate. Common finding: internal service traffic and management interfaces in clear text, which also exposes credentials. Evidence: TLS configuration scans and exceptions. See the Encryption Guide.
16. CP-9 System Backup
What is tested: backups of user-level, system-level and documentation information on your defined frequency, with confidentiality and integrity protected. Moderate adds testing for reliability and integrity (CP-9(1)) and cryptographic protection (CP-9(8)). Common finding: backups reachable with production admin credentials, and no restore test. Evidence: backup job reports, restore test records, access list for backup administration. See the Backup Identity Isolation Guide.
17. IR-4 Incident Handling
What is tested: an incident handling capability covering preparation, detection and analysis, containment, eradication and recovery, coordinated with contingency planning, with lessons learned folded back in. IR-4(1) adds automated processes at Moderate. Common finding: a plan that has never been exercised and no identity-specific playbooks. Evidence: incident records, exercise reports, updated procedures. See the Incident Response Guide.
18. CM-2 Baseline Configuration
What is tested: a current baseline configuration under configuration control, reviewed on your defined frequency and when components change. Moderate adds automation (CM-2(2)), retaining previous configurations (CM-2(3)) and configurations for high-risk areas (CM-2(7)). Common finding: baselines that describe the build at deployment, not the running state. Evidence: versioned baseline, infrastructure as code repository, drift reports.
19. SA-9 External System Services
What is tested: security and privacy requirements for external service providers, defined oversight and user roles, and monitoring of provider compliance. SA-9(2) (identifying functions, ports, protocols and services) applies at Moderate. Common finding: SaaS and managed service providers with privileged or API access that no one monitors. Evidence: provider list with responsibilities, contracts and review records. See the Remote access and PAM vendors as tier-zero suppliers guide.
20. CA-7 Continuous Monitoring
What is tested: a continuous monitoring strategy with defined metrics, monitoring frequencies, ongoing control assessments, correlation and reporting. CA-7(4) risk monitoring is in all baselines and CA-7(1) independent assessment at Moderate. Common finding: annual assessment treated as continuous monitoring. Evidence: the strategy, metrics reports and POA&M updates. See the NIST SP 800-137 ISCM Guide and the Plan of Action and Milestones (POA&M) Guide.
Mapping to CSF 2.0 and CIS Controls
| Control | CSF 2.0 | CIS Controls v8.1 |
|---|---|---|
| CM-8 | ID.AM-01, ID.AM-02 | 1.1, 2.1 |
| AC-2, AC-6 | PR.AA-01, PR.AA-05 | 5.1, 5.3, 5.4, 6.1, 6.2 |
| IA-2, IA-5 | PR.AA-01, PR.AA-03 | 5.2, 6.3, 6.4, 6.5 |
| RA-5, SI-2 | ID.RA-01, PR.PS-02 | 7.1 to 7.4 |
| CM-2, CM-6, CM-7 | PR.PS-01 | 4.1, 4.2, 4.6, 4.8 |
| AU-2, AU-6 | PR.PS-04, DE.AE-02 | 8.1, 8.2, 8.11 |
| SI-4 | DE.CM-01, DE.CM-09 | 13.1 |
| AC-17, SC-7 | PR.IR-01 | 4.4, 4.5, 6.4, 12.2 |
| SC-8 | PR.DS-02 | 3.10 |
| CP-9 | PR.DS-11 | 11.1 to 11.4 |
| IR-4 | RS.MA-01 | 17.1 to 17.3 |
| SA-9 | GV.SC-07 | 15.1 |
| CA-7 | ID.IM-01 | None |
These are "intersects with" relationships; confirm them against NIST's informative references and the CIS Controls Navigator before relying on them. For the method, see the Control Mapping Guide.
Getting started
If you can prepare only five controls before an assessment, start with CM-8, AC-2, IA-2, RA-5 and SI-2: almost every other control on this list is measured against the inventory and the account population, and missing MFA or overdue patches are the findings most likely to be rated high. Fill every organisation-defined parameter for these controls in the system security plan first, because the assessor tests against the values you wrote down. Then track five numbers monthly: inventory reconciliation gaps, enabled inactive accounts, accounts without MFA, overdue critical patches and backup restore test age. If your system relies on service accounts, API keys or AI agents, add IA-9 and IA-5(7) by tailoring; they are outside the baselines but cover the credentials attackers now use most. See the NIST SP 800-53B Control Baselines and Tailoring Guide and the NIST SP 800-53A Guide.
Practitioner checklist
- Keep one reconciled inventory across on-premises, cloud and SaaS, with owner and last-seen date.
- Include service and emergency accounts in the account list and disable inactive accounts.
- Record MFA enforcement for every access path, with an exception register.
- Move service account passwords and API keys into a vault and run secret scanning.
- Measure scan coverage against CM-8 and patch compliance against your defined remediation times.
- Keep an event selection list and records showing logs are reviewed and escalated.
- Test backup restores and separate backup administration from production admin credentials.
- Track inventory gaps, inactive accounts, accounts without MFA, overdue critical patches and restore test age monthly.
Standards and references
- NIST, SP 800-53 Rev. 5 OSCAL content and baseline profiles (Release 5.2.0): github.com/usnistgov/oscal-content
- NIST CSRC, SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations: csrc.nist.gov/pubs/sp/800/53/r5/upd1/final
Related NHI Mgmt Group resources: NIST SP 800-53 Guide · System Security Plan Template and Guide · FedRAMP Guide · CIS Controls Guide