NIST 800-53 Rev 5 Compliance Checklist

Before you start

• Confirm you're working from Revision 5, the current catalog, not lingering Rev 4 documentation.
• Check whether Release 5.2.0 (August 2025) applies to your scope. It added controls for software-update integrity and cyber resiliency (SA-15, SI-02(07), SA-24) in response to recent federal direction on patching. If you build or ship software, those apply to you.
• Pull your control baseline from SP 800-53B: in Rev 5 the Low/Moderate/High baselines moved out of the main catalog into this separate document.
• Confirm privacy is in scope. Rev 5 folds privacy controls into the same catalog through the PT family, so security and privacy are handled together.

Phase 1: Prepare and categorize

• Assign roles: system owner, authorizing official (AO), information system security officer, and control assessors.
• Set your organizational risk tolerance.
• Identify common (inherited) controls you can reuse across systems instead of rebuilding per system.
• Categorize the system under FIPS 199: Low, Moderate, or High, based on the impact of losing confidentiality, integrity, or availability.
• Inventory the system: authorization boundary, data types, data flows, and any FTI, PII, or CUI in scope.

Phase 2: Select and tailor

• Pull the matching baseline (Low, Moderate, or High) from SP 800-53B.
• Tailor it: add, remove, or adjust controls based on your risk assessment.
• Apply any overlays that fit your mission or data type.
• Layer in regulatory requirements where they apply, FedRAMP for cloud services, IRS Pub 1075 for federal tax information, CMMC for controlled unclassified information.
• Document every tailoring decision and the reasoning behind it. Undocumented tailoring is an audit finding waiting to happen.

Phase 3: Implement

• Put each selected control and enhancement in place.
• Write the System Security Plan (SSP): how each control is met, by whom, and where.
• Separate inherited control responsibilities from system-specific ones so nothing falls through the cracks.

Phase 4: Assess

• Build a security assessment plan aligned to the procedures in SP 800-53A.
• Test the controls, using an independent assessor where your impact level requires one.
• Record every gap and open item in a Plan of Action and Milestones (POA&M).

Phase 5: Authorize

• Assemble the authorization package: SSP, assessment results, and POA&M.
• Have the AO weigh residual risk and issue, or withhold, the Authority to Operate (ATO).
• Record the authorization term and any conditions attached to it.

Phase 6: Monitor (the step that never ends)

• Stand up continuous monitoring for control status, vulnerabilities, and configuration drift.
• Keep the POA&M current and actively work it down.
• Re-assess on a set cadence and after any significant system change.
• Track NIST releases and fold new or updated controls, like those in Release 5.2.0: into your scope.

Control-family coverage check

A final pass to confirm you've addressed all 20 Rev 5 families. For each, ask: do I have documented, implemented controls here?

• AC, Access Control: least privilege, account management, remote access.
• AT, Awareness and Training: role-based security and privacy training.
• AU, Audit and Accountability: logging, log review, log protection.
• CA, Assessment, Authorization, and Monitoring: assessments, ATO, continuous monitoring. (Renamed in Rev 5 to put monitoring front and center.)
• CM, Configuration Management: secure baselines, change control, asset inventory.
• CP, Contingency Planning: backups, disaster recovery, tested restoration.
• IA, Identification and Authentication: multi-factor authentication, identity management, credential handling.
• IR, Incident Response: plan, training, reporting, and testing.
• MA, Maintenance: controlled and logged system maintenance.
• MP, Media Protection: media handling, marking, sanitization, disposal.
• PE, Physical and Environmental Protection: facility access, environmental safeguards.
• PL, Planning: the SSP, rules of behavior, security architecture.
• PM, Program Management: organization-wide security and privacy governance.
• PS, Personnel Security: screening, onboarding, offboarding.
• PT, PII Processing and Transparency: consent, data minimization, privacy notices. (New in Rev 5.)
• RA, Risk Assessment: risk assessments and vulnerability scanning.
• SA, System and Services Acquisition: secure development practices and security terms in contracts.
• SC, System and Communications Protection: encryption, boundary protection, segmentation.
• SI, System and Information Integrity: patching, malware defense, flaw remediation, monitoring.
• SR, Supply Chain Risk Management: vendor risk, component provenance, software bills of materials. (New in Rev 5.)

Don't-skip reminders from the field

• Treat monitoring as ongoing work, not a one-time certification. An ATO is accurate the day it's signed and decays from there.
• Give PT and SR real attention, they're the two families added in Rev 5, and the ones programs carried over from Rev 4 most often neglect.
• If you develop or ship software, re-check your scope against Release 5.2.0's update-integrity and resiliency controls.
• Keep the SSP and POA&M as living documents. Assessors open those first, and stale ones set the tone for the whole review.

About the author

Jose D Soto is an IT infrastructure and cybersecurity leader who runs infrastructure operations and operational security for the DC Office of the Chief Financial Officer. He has built and assessed programs against NIST 800-53, IRS Publication 1075, and related federal frameworks, and writes these guides from that work.