United States (federal) · federal standard
NIST SP 800-53 Rev. 5: what it requires, and the records to keep
SP 800-53 Rev. 5 is the federal catalog of security and privacy controls, organized in 20 families, that agencies select and tailor under the Risk Management Framework. It is the control set behind FISMA authorizations and FedRAMP, so AI systems in federal use are assessed against it.
01 / What it requires
What NIST SP 800-53 Rev. 5 requires
Federal agencies and the contractors and cloud providers operating systems on their behalf; widely adopted voluntarily elsewhere.
- 01Select a control baseline (from SP 800-53B) based on system impact level, then tailor it.
- 02Implement and document controls across 20 families, including access control, audit, configuration and supply chain risk (SR).
- 03Assess control effectiveness, using SP 800-53A procedures, before authorization to operate.
- 04Continuously monitor controls and update the system security and privacy plans.
- 05Under Release 5.2.0, verify software update integrity and test, deploy and manage patches (SA-24, SI-02(07), SI-07(12)).
02 / AI work
Where it touches AI work
Applies to AI systems as to any system. NIST is drafting AI-specific overlays on these controls, but none has reached a numbered public draft yet.
03 / Dates
The dates that matter
Rev. 5 published
Update 1 errata published
NIST concept paper on control overlays for securing AI systems
Release 5.2.0 adds software update and patch controls
Annotated outline for predictive AI overlay posted
AI overlay project renamed Control Overlays for Super Intelligence Systems
04 / Enforcement
Who enforces it
Agency authorizing officials, inspectors general and OMB under FISMA; FedRAMP for cloud. No direct penalties; contract and authorization consequences.
05 / Records
Records an organisation keeps
What an auditor or an inquiry usually asks to see. Your obligations depend on your role and your facts.
- 01System security and privacy plan with tailored control baseline
- 02Security assessment report and plan of action and milestones
- 03Authorization to operate decision
- 04Continuous monitoring and audit log records
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
SOURCES
Go back to the source
CHANGE LOG
What changed, and when
Rebuilt from primary sources; facts checked on this date.
Related: NIST SP 800-53 Rev. 5 vs CMMC · NIST SP 800-53 Rev. 5 vs ATO · NIST SP 800-53 Rev. 5 vs ISO/IEC 42001 · NIST SP 800-53 Rev. 5 for defense AI workflows · NIST AI RMF · OMB M-25-21/22 · DoW RAI S&IP · EO 14179 · FIPS 140-3 · SHA-256 / FIPS 180-4