You are viewing this page in an unauthorized frame window. This is a potential security issue, you are being redirected to https://csrc.nist.gov . An official website of the United States government Here’s how you know Here’s how you know Official websites use .gov A .gov website belongs to an official government organization in the United States. Secure .gov websites use HTTPS A lock ( Lock Locked padlock icon ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites. Search Search CSRC MENU Search Search Projects Publications Expand or Collapse Drafts for Public Comment All Public Drafts Final Pubs FIPS (standards) Special Publications (SP s ) IR (interagency/internal reports) CSWP (cybersecurity white papers) ITL Bulletins Project Descriptions Journal Articles Conference Papers Books Topics Expand or Collapse Security & Privacy Applications Technologies Sectors Laws & Regulations Activities & Products News & Updates Events Glossary About CSRC Expand or Collapse Computer Security Division Cryptographic Technology Software Security Group Hardware Security Group Security Engineering and Risk Management Applied Cybersecurity Division Cybersecurity and Privacy Applications National Cybersecurity Center of Excellence (NCCoE) National Initiative for Cybersecurity Education (NICE) Contact Us Information Technology Laboratory Computer Security Resource Center Publications NIST SP 800-53B Control Baselines for Information Systems and Organizations Share to Facebook Share to X Share to LinkedIn Share ia Email Documentation Topics Date Published: September 2020 (includes updates as of Dec. 10, 2020) Supersedes: SP 800-53B (10/29/2020) Planning Note ( 08/27/2025 ): On August 27, 2025, NIST issued a minor release of SP 800-53B (Release 5.2.0) that includes no changes to the baselines. The SP 800-53B version number was updated for consistency with SP 800-53 and SP 800-53A . Author(s) Joint Task Force Abstract This publication provides security and privacy control baselines for the Federal Government. There are three security control baselines (one for each system impact level—low-impact, moderate-impact, and high-impact), as well as a privacy baseline that is applied to systems irrespective of impact level. In addition to the control baselines, this publication provides tailoring guidance and a set of working assumptions that help guide and inform the control selection process. Finally, this publication provides guidance on the development of overlays to facilitate control baseline customization for specific communities of interest, technologies, and environments of operation. This publication provides security and privacy control baselines for the Federal Government. There are three security control baselines (one for each system impact level—low-impact, moderate-impact, and high-impact), as well as a privacy baseline that is applied to systems irrespective of impact... See full abstract This publication provides security and privacy control baselines for the Federal Government. There are three security control baselines (one for each system impact level—low-impact, moderate-impact, and high-impact), as well as a privacy baseline that is applied to systems irrespective of impact level. In addition to the control baselines, this publication provides tailoring guidance and a set of working assumptions that help guide and inform the control selection process. Finally, this publication provides guidance on the development of overlays to facilitate control baseline customization for specific communities of interest, technologies, and environments of operation. Hide full abstract Keywords assurance ; impact level ; privacy control ; privacy control baseline ; security control ; security control baseline ; tailoring ; control selection ; control overlays Control Families None selected Documentation Publication: https://doi.org/10.6028/NIST.SP.800-53B Download URL Supplemental Material: SP 800-53B Release 5.2.0 Control Baselines spreadsheet (xlsx) Security Control Overlay Repository (SCOR) OSCAL GitHub NIST news article Publication Parts: SP 800-53A Rev. 5 SP 800-53 Rev. 5 Document History: 12/10/20: SP 800-53B (Final) Topics Security and Privacy cybersecurity supply chain risk management , general security & privacy , privacy , privacy controls , security controls , security programs & operations HEADQUARTERS 100 Bureau Drive Gaithersburg, MD 20899 X (link is external) facebook (link is external) linkedin (link is external) instagram (link is external) youtube (link is external) rss govdelivery (link is external) Want updates about CSRC and our publications? Subscribe Contact Us | Our Other Offices Send inquiries to [email protected] Site Privacy Accessibility Privacy Program Copyrights Vulnerability Disclosure No Fear Act Policy FOIA Environmental Policy Scientific Integrity Information Quality Standards Commerce.gov Science.gov USA.gov Vote.gov