NIST SP 800-53 Rev 5: The 20 Control Families Explained

The 20 Control Families (Official Rev 5)

Source: NIST SP 800-53 Rev 5 Control Families list (CSRC).

Rev 5 includes privacy integration (notably PT) and SR (Supply Chain Risk Management). These are control-catalog families — not CSF Functions.

Why It Matters

FedRAMP, agency ATO, and many “NIST-based” contracts mean selected 800-53 controls, usually from a baseline — not “all of 800-53.”

How CyberSilo Helps

• Compliance Standards Automation — map AU/IR/SI/CM evidence to selected controls
• ThreatHawk SIEM — continuous monitoring evidence for AU/IR
• CIS Benchmarking Tool — hardening evidence that supports CM-oriented outcomes

Frequently Asked Questions

How many control families are in SP 800-53 Rev 5?

Twenty: AC, AT, AU, CA, CM, CP, IA, IR, MA, MP, PE, PL, PM, PS, PT, RA, SA, SC, SI, and SR.

What is the difference between the catalog and a baseline?

SP 800-53 is the control catalog. SP 800-53B defines Low, Moderate, and High security baselines plus a privacy baseline used to select controls from that catalog.

Are CSF Functions the same as 800-53 families?

No. CSF 2.0 uses Functions/Categories/Subcategories (outcomes). SP 800-53 uses control families and controls (a selectable catalog).

Related NIST Resources

NIST hub · What Is NIST CSF 2.0? · CSF Function Guides · 800-53 Baselines