NIST 800-53 r5 to NIST CSF 2.0 crosswalk

29 control objectives in NIST SP 800-53 Security and Privacy Controls are mapped here to NIST Cybersecurity Framework. Every one has a requirement on the other side. Each row is one shared objective, with the requirement ids on both sides.

Control objective	NIST 800-53 r5	NIST CSF 2.0
Security governance and policies	`PM-1`Information security program plan `PL-1`Policy and procedures (planning)	`GV.PO`Policy `GV.OV`Oversight
Security roles and accountability	`PM-2`Information security program leadership role `AC-5`Separation of duties	`GV.RR`Roles, responsibilities and authorities
Risk assessment and treatment	`RA-3`Risk assessment `PM-9`Risk management strategy	`GV.RM`Risk management strategy `ID.RA`Risk assessment
Asset and system inventory	`CM-8`System component inventory	`ID.AM`Asset management
Data classification and handling	`RA-2`Security categorization	`ID.AM-07`Inventories of data and corresponding metadata are maintained `PR.DS`Data security
Access provisioning, review and removal	`AC-2`Account management `AC-3`Access enforcement `PS-4`Personnel termination `PS-5`Personnel transfer	`PR.AA-05`Access permissions, entitlements and authorizations are defined and managed (least privilege, separation of duties)
Least privilege and privileged access	`AC-6`Least privilege `AC-5`Separation of duties	`PR.AA-05`Access permissions managed incorporating least privilege
Authentication, unique IDs and multi-factor authentication	`IA-2`Identification and authentication (organizational users) `IA-5`Authenticator management	`PR.AA-03`Users, services and hardware are authenticated
Encryption at rest and key management	`SC-28`Protection of information at rest `SC-12`Cryptographic key establishment and management `SC-13`Cryptographic protection	`PR.DS-01`The confidentiality, integrity and availability of data-at-rest are protected
Encryption in transit	`SC-8`Transmission confidentiality and integrity `SC-13`Cryptographic protection	`PR.DS-02`The confidentiality, integrity and availability of data-in-transit are protected
Network security and segmentation	`SC-7`Boundary protection `AC-4`Information flow enforcement	`PR.IR-01`Networks and environments are protected from unauthorized logical access and usage
Secure configuration and hardening	`CM-2`Baseline configuration `CM-6`Configuration settings `CM-7`Least functionality	`PR.PS-01`Configuration management practices are established and applied
Vulnerability scanning and patching	`RA-5`Vulnerability monitoring and scanning `SI-2`Flaw remediation	`ID.RA`Risk assessment (vulnerability identification, ID.RA-01) `PR.PS-02`Software is maintained, replaced and removed commensurate with risk
Penetration testing and independent assessment	`CA-8`Penetration testing `CA-2`Control assessments	`ID.IM`Improvement (incl. ID.IM-02, improvements from tests and exercises)
Logging, log review and monitoring	`AU-2`Event logging `AU-6`Audit record review, analysis and reporting `AU-11`Audit record retention `SI-4`System monitoring	`DE.CM`Continuous monitoring `PR.PS-04`Log records are generated and made available for continuous monitoring
Intrusion detection and integrity monitoring	`SI-4`System monitoring `SI-7`Software, firmware and information integrity	`DE.CM`Continuous monitoring `DE.AE`Adverse event analysis
Malware protection	`SI-3`Malicious code protection	`PR.PS-05`Installation and execution of unauthorized software are prevented `DE.CM`Continuous monitoring
Incident response and breach notification	`IR-4`Incident handling `IR-8`Incident response plan `IR-6`Incident reporting `IR-3`Incident response testing	`RS.MA`Incident management `RS.AN`Incident analysis `RS.CO`Incident response reporting and communication `RS.MI`Incident mitigation `DE.AE`Adverse event analysis
Change management	`CM-3`Configuration change control `CM-4`Impact analyses `CM-5`Access restrictions for change	`PR.PS-01`Configuration management practices are established and applied
Secure software development	`SA-3`System development life cycle `SA-8`Security and privacy engineering principles `SA-11`Developer testing and evaluation	`PR.PS-06`Secure software development practices are integrated and their performance monitored
Third-party and vendor risk management	`SR-3`Supply chain controls and processes `SR-6`Supplier assessments and reviews `SA-9`External system services	`GV.SC`Cybersecurity supply chain risk management
Business continuity and disaster recovery	`CP-2`Contingency plan `CP-4`Contingency plan testing `CP-10`System recovery and reconstitution	`PR.IR-03`Mechanisms are implemented to achieve resilience requirements `RC.RP`Incident recovery plan execution
Backup and redundancy	`CP-9`System backup	`PR.DS-11`Backups of data are created, protected, maintained and tested
Capacity and availability management	`SC-5`Denial-of-service protection	`PR.IR-04`Adequate resource capacity to ensure availability is maintained
Security awareness and training	`AT-2`Literacy training and awareness `AT-3`Role-based training	`PR.AT`Awareness and training
Personnel screening, terms and sanctions	`PS-3`Personnel screening `PS-4`Personnel termination `PS-8`Personnel sanctions	`GV.RR-04`Cybersecurity is included in human resources practices
Physical access and facility security	`PE-2`Physical access authorizations `PE-3`Physical access control `PE-6`Monitoring physical access	`PR.AA-06`Physical access to assets is managed, monitored and enforced commensurate with risk
Data retention, media handling and secure disposal	`MP-6`Media sanitization `SI-12`Information management and retention	`ID.AM-08`Systems, hardware, software, services and data are managed throughout their life cycles
Ongoing control monitoring and internal audit	`CA-2`Control assessments `CA-7`Continuous monitoring	`ID.IM`Improvement `GV.OV`Oversight

Open a control objective for the evidence checklist.NIST CSF 2.0 to NIST 800-53 r5 →

Scope: Base controls only (no enhancements). FedRAMP, TX-RAMP and StateRAMP baselines are built on 800-53, but baseline membership and parameters are not included here. Mapped at category level (e.g. PR.AA) or subcategory where one is clearly the match (e.g. PR.AA-05). A mapping means the requirements address the same objective. It does not mean satisfying one satisfies the other, because scope, frequency and evidence rules differ.

More from NIST 800-53 r5

NIST 800-53 r5 to SOC 2 NIST 800-53 r5 to PCI DSS 4.0 NIST 800-53 r5 to ISO 27001:2022 NIST 800-53 r5 to HIPAA Security Rule