Cairn · NIST SP 800-53
The catalog. The pick. The test. None of them is the ATO.
The trio
Rev 5 split what used to live in one book. Do not quote 800-53 when you mean 53B or 53A.
53SP 800-53The catalog. Twenty families of security and privacy controls and enhancements. Rev 5 (Sep 2020). Current patch 5.2.0.
53bSP 800-53BThe pick. Low / Moderate / High baselines. 5.2.0 reissued for version alignment — baselines did not change.
53aSP 800-53AThe test. Assessment procedures for the catalog. 5.2.0 updated with the new controls. This is Assess in RMF, not Authorize.
Twenty families
PT and SR are Rev 5. Allocate them on the road. Do not stand up a twentieth program beside it.
- ACAccess Control
- ATAwareness and Training
- AUAudit and Accountability
- CAAssessment, Authorization, and Monitoring
- CMConfiguration Management
- CPContingency Planning
- IAIdentification and Authentication
- IRIncident Response
- MAMaintenance
- MPMedia Protection
- PEPhysical and Environmental Protection
- PLPlanning
- PMProgram Management
- PSPersonnel Security
- PTPII Processing and Transparency
- RARisk Assessment
- SASystem and Services Acquisition
- SCSystem and Communications Protection
- SISystem and Information Integrity
- SRSupply Chain Risk Management
Select → overlay → authorize
Same catalog. Different picks. FedRAMP High is parameterized High, not IL5.
01Catalog800-53 Rev 5. Twenty families. PT and SR are new in Rev 5 (were not in Rev 4).
02Baseline800-53B Low / Moderate / High. FIPS 199 categorization picks the starting baseline.
03FedRAMP parameterizeHigh baseline parameterized for cloud = FedRAMP High / Class D. Moderate cannot serve IL5.
04SRG overlayCSP SRG Table D-1 FedRAMP+ and DISA parameters. CNSSI 1253 if NSS. Same catalog, different pick.
05Assess800-53A procedures. SAP / SAR. OSCAL can carry the catalog, the baseline, and the results.
06AuthorizeDoDI 8510.01. The AO signs. The catalog did not.
On the 48-month road
Families ride the horizons already named. They do not invent a second sequence.
0–6Foundation SelectPL · PM · RA · CA · PS · ATCloud Foundation Team. Categorize and Select. Name the IL, the AO, the overlay. Do not stand up twenty families as a side program.
IATT/ATOOccupancyAC · IA · SC · CM · AU · PE · CP · IRLanding zone and residual. Identity, boundary, logging, contingency. What the PA does not inherit stays here.
24–36FactorySA · SR · SIAcquisition, supply chain, integrity. SBOM admission and provenance live here. PT rides privacy data wherever it sits.
36–48MonitorCA-7 · AU · IRConMon feed. cATO is this state after an ATO — not a synonym for a pipeline. OSCAL is the reporting language.
Release 5.2.0
27 Aug 2025. Software update reliability (EO 14306). Baselines unchanged.
sa-15-13SA-15(13)Developer testing — software update and patch reliability (EO 14306).
sa-24SA-24Design for cyber resiliency.
si-02-07SI-02(07)Root-cause analysis on flaws.
53b800-53BReissued 5.2.0 for version alignment. Baselines unchanged.
Not this
atoNot the ATOSelecting High does not authorize the system. The AO does.
fedrampNot FedRAMPFedRAMP is a parameterized baseline plus a program. The catalog is shared.
ilNot an impact levelLow / Moderate / High are FIPS 199. IL2 / IL4 / IL5 are the Cloud SRG.
cmmcNot CMMC / 800-171Those are DIB contractor paths. DoD information systems at IL4/IL5 ride 800-53 plus the SRG.
The catalog is not an authorization. Select is where 800-53B meets overlays. The AO still signs.