NIST 800-53 Rev. 5 - First Thoughts

Wylie Bayes -

NIST 800-53 is a set of security controls and guidelines developed by the National Institute of Standards and Technology (NIST) to help federal agencies and contractors manage and secure their information systems. The latest version of NIST 800-53 is revision 5, which was released in September 2020. In this blog post, we will explore the major differences between NIST 800-53 rev4 and rev5.

  1. Structure

One of the major changes in NIST 800-53 rev5 is the restructuring of the control families. In rev4, the controls were organized into 18 families, whereas in rev5, the controls are organized into 20 families. Additionally, the number of individual controls has increased from 871 in rev4 to 1,086 in rev5. The new structure is designed to better align with the Risk Management Framework (RMF) and to make it easier for organizations to select and implement controls.

  1. Privacy Controls

Another major change in NIST 800-53 rev5 is the addition of privacy controls. The new privacy controls are designed to help organizations manage the privacy risks associated with their information systems. The privacy controls are organized into a separate family (Privacy and Transparency) and include controls related to data minimization, transparency, individual participation, and consent.

  1. Supply Chain Risk Management

Supply chain risk management is another area that has been given increased attention in NIST 800-53 rev5. The new version includes a separate family (Supply Chain Risk Management) that focuses on managing the risks associated with the acquisition, development, and maintenance of information systems. The new controls are designed to help organizations identify, assess, and manage the risks associated with their supply chain.

  1. Cybersecurity Metrics

NIST 800-53 rev5 also includes a new appendix on cybersecurity metrics. The appendix provides guidance on developing and implementing metrics to measure the effectiveness of an organization's cybersecurity program. The metrics are designed to provide insight into the effectiveness of an organization's security controls and to help identify areas for improvement.

  1. Cybersecurity Resilience

Cybersecurity resilience is another area that has been given increased attention in NIST 800-53 rev5. The new version includes a separate family (Cybersecurity Resilience) that focuses on building resilience into an organization's information systems. The new controls are designed to help organizations prepare for, respond to, and recover from cyber incidents.

  1. Role-Based Access Control

Role-based access control (RBAC) is another area that has been updated in NIST 800-53 rev5. The new version includes a new control (AC-10 (5)) that requires organizations to implement dynamic RBAC. Dynamic RBAC allows organizations to assign access permissions based on an individual's current role, rather than their static position within the organization.

  1. Risk Management Framework

Finally, NIST 800-53 rev5 includes updates to the Risk Management Framework (RMF). The new version of the RMF includes new steps, such as Prepare and Communicate, and places greater emphasis on continuous monitoring and risk management throughout the system development life cycle.

In conclusion, NIST 800-53 rev5 represents a significant update to the previous version (rev4). The new version includes several new families of controls, including privacy and supply chain risk management, as well as updates to existing control families, such as RBAC and cybersecurity resilience. The new version is designed to better align with the Risk Management Framework and to make it easier for organizations to select and implement controls. It is important for organizations to review and update their security programs in accordance with the latest version of NIST 800-53 to ensure that they are adequately addressing the risks associated with their information systems