NIST 800-53 r5 to ISO 27001:2022 crosswalk

29 control objectives in NIST SP 800-53 Security and Privacy Controls are mapped here to ISO/IEC 27001 (Annex A controls and management clauses). Every one has a requirement on the other side. Each row is one shared objective, with the requirement ids on both sides.

Control objective	NIST 800-53 r5	ISO 27001:2022
Security governance and policies	`PM-1`Information security program plan `PL-1`Policy and procedures (planning)	`A.5.1`Policies for information security `A.5.36`Compliance with policies, rules and standards for information security
Security roles and accountability	`PM-2`Information security program leadership role `AC-5`Separation of duties	`A.5.2`Information security roles and responsibilities `A.5.3`Segregation of duties
Risk assessment and treatment	`RA-3`Risk assessment `PM-9`Risk management strategy	`Clause 6.1.2`Information security risk assessment `Clause 6.1.3`Information security risk treatment
Asset and system inventory	`CM-8`System component inventory	`A.5.9`Inventory of information and other associated assets
Data classification and handling	`RA-2`Security categorization	`A.5.12`Classification of information `A.5.13`Labelling of information
Access provisioning, review and removal	`AC-2`Account management `AC-3`Access enforcement `PS-4`Personnel termination `PS-5`Personnel transfer	`A.5.15`Access control `A.5.16`Identity management `A.5.18`Access rights
Least privilege and privileged access	`AC-6`Least privilege `AC-5`Separation of duties	`A.8.2`Privileged access rights `A.8.3`Information access restriction
Authentication, unique IDs and multi-factor authentication	`IA-2`Identification and authentication (organizational users) `IA-5`Authenticator management	`A.5.17`Authentication information `A.8.5`Secure authentication
Encryption at rest and key management	`SC-28`Protection of information at rest `SC-12`Cryptographic key establishment and management `SC-13`Cryptographic protection	`A.8.24`Use of cryptography
Encryption in transit	`SC-8`Transmission confidentiality and integrity `SC-13`Cryptographic protection	`A.5.14`Information transfer `A.8.24`Use of cryptography
Network security and segmentation	`SC-7`Boundary protection `AC-4`Information flow enforcement	`A.8.20`Networks security `A.8.21`Security of network services `A.8.22`Segregation of networks
Secure configuration and hardening	`CM-2`Baseline configuration `CM-6`Configuration settings `CM-7`Least functionality	`A.8.9`Configuration management
Vulnerability scanning and patching	`RA-5`Vulnerability monitoring and scanning `SI-2`Flaw remediation	`A.8.8`Management of technical vulnerabilities
Penetration testing and independent assessment	`CA-8`Penetration testing `CA-2`Control assessments	`A.8.29`Security testing in development and acceptance `A.5.35`Independent review of information security
Logging, log review and monitoring	`AU-2`Event logging `AU-6`Audit record review, analysis and reporting `AU-11`Audit record retention `SI-4`System monitoring	`A.8.15`Logging `A.8.16`Monitoring activities `A.8.17`Clock synchronization
Intrusion detection and integrity monitoring	`SI-4`System monitoring `SI-7`Software, firmware and information integrity	`A.8.16`Monitoring activities
Malware protection	`SI-3`Malicious code protection	`A.8.7`Protection against malware
Incident response and breach notification	`IR-4`Incident handling `IR-8`Incident response plan `IR-6`Incident reporting `IR-3`Incident response testing	`A.5.24`Information security incident management planning and preparation `A.5.25`Assessment and decision on information security events `A.5.26`Response to information security incidents `A.5.27`Learning from information security incidents
Change management	`CM-3`Configuration change control `CM-4`Impact analyses `CM-5`Access restrictions for change	`A.8.32`Change management
Secure software development	`SA-3`System development life cycle `SA-8`Security and privacy engineering principles `SA-11`Developer testing and evaluation	`A.8.25`Secure development life cycle `A.8.26`Application security requirements `A.8.28`Secure coding `A.8.29`Security testing in development and acceptance `A.8.31`Separation of development, test and production environments
Third-party and vendor risk management	`SR-3`Supply chain controls and processes `SR-6`Supplier assessments and reviews `SA-9`External system services	`A.5.19`Information security in supplier relationships `A.5.20`Addressing information security within supplier agreements `A.5.21`Managing information security in the ICT supply chain `A.5.22`Monitoring, review and change management of supplier services `A.5.23`Information security for use of cloud services
Business continuity and disaster recovery	`CP-2`Contingency plan `CP-4`Contingency plan testing `CP-10`System recovery and reconstitution	`A.5.29`Information security during disruption `A.5.30`ICT readiness for business continuity
Backup and redundancy	`CP-9`System backup	`A.8.13`Information backup `A.8.14`Redundancy of information processing facilities
Capacity and availability management	`SC-5`Denial-of-service protection	`A.8.6`Capacity management
Security awareness and training	`AT-2`Literacy training and awareness `AT-3`Role-based training	`A.6.3`Information security awareness, education and training
Personnel screening, terms and sanctions	`PS-3`Personnel screening `PS-4`Personnel termination `PS-8`Personnel sanctions	`A.6.1`Screening `A.6.2`Terms and conditions of employment `A.6.4`Disciplinary process `A.6.5`Responsibilities after termination or change of employment
Physical access and facility security	`PE-2`Physical access authorizations `PE-3`Physical access control `PE-6`Monitoring physical access	`A.7.1`Physical security perimeters `A.7.2`Physical entry `A.7.4`Physical security monitoring
Data retention, media handling and secure disposal	`MP-6`Media sanitization `SI-12`Information management and retention	`A.7.10`Storage media `A.7.14`Secure disposal or re-use of equipment `A.8.10`Information deletion
Ongoing control monitoring and internal audit	`CA-2`Control assessments `CA-7`Continuous monitoring	`Clause 9.2`Internal audit `Clause 9.3`Management review

Open a control objective for the evidence checklist.ISO 27001:2022 to NIST 800-53 r5 →

Scope: Base controls only (no enhancements). FedRAMP, TX-RAMP and StateRAMP baselines are built on 800-53, but baseline membership and parameters are not included here. Annex A controls are prefixed 'A.'; management-system clauses are prefixed 'Clause'. A mapping means the requirements address the same objective. It does not mean satisfying one satisfies the other, because scope, frequency and evidence rules differ.

More from NIST 800-53 r5

NIST 800-53 r5 to SOC 2 NIST 800-53 r5 to PCI DSS 4.0 NIST 800-53 r5 to NIST CSF 2.0 NIST 800-53 r5 to HIPAA Security Rule