NIST 800-53 r5 to SOC 2 crosswalk

29 control objectives in NIST SP 800-53 Security and Privacy Controls are mapped here to SOC 2 Trust Services Criteria. Every one has a requirement on the other side. Each row is one shared objective, with the requirement ids on both sides.

Control objective	NIST 800-53 r5	SOC 2
Security governance and policies	`PM-1`Information security program plan `PL-1`Policy and procedures (planning)	`CC1.1`Demonstrates commitment to integrity and ethical values `CC1.2`Board exercises oversight responsibility `CC5.3`Deploys control activities through policies and procedures
Security roles and accountability	`PM-2`Information security program leadership role `AC-5`Separation of duties	`CC1.3`Establishes structure, authority and responsibility `CC1.5`Enforces accountability
Risk assessment and treatment	`RA-3`Risk assessment `PM-9`Risk management strategy	`CC3.1`Specifies suitable objectives `CC3.2`Identifies and analyzes risk `CC3.3`Considers potential for fraud `CC3.4`Identifies and assesses significant changes
Asset and system inventory	`CM-8`System component inventory	`CC6.1`Logical access security (inventory of information assets is a point of focus)
Data classification and handling	`RA-2`Security categorization	`C1.1`Identifies and maintains confidential information
Access provisioning, review and removal	`AC-2`Account management `AC-3`Access enforcement `PS-4`Personnel termination `PS-5`Personnel transfer	`CC6.2`Registers and authorizes new users prior to issuing credentials `CC6.3`Authorizes, modifies or removes access based on roles
Least privilege and privileged access	`AC-6`Least privilege `AC-5`Separation of duties	`CC6.3`Role-based access and least privilege
Authentication, unique IDs and multi-factor authentication	`IA-2`Identification and authentication (organizational users) `IA-5`Authenticator management	`CC6.1`Logical access security software, infrastructure and architectures
Encryption at rest and key management	`SC-28`Protection of information at rest `SC-12`Cryptographic key establishment and management `SC-13`Cryptographic protection	`CC6.1`Logical access security (encryption of data at rest)
Encryption in transit	`SC-8`Transmission confidentiality and integrity `SC-13`Cryptographic protection	`CC6.7`Restricts transmission, movement and removal of information
Network security and segmentation	`SC-7`Boundary protection `AC-4`Information flow enforcement	`CC6.6`Implements logical access security measures against threats from outside system boundaries
Secure configuration and hardening	`CM-2`Baseline configuration `CM-6`Configuration settings `CM-7`Least functionality	`CC7.1`Uses detection and monitoring procedures to identify changes to configurations
Vulnerability scanning and patching	`RA-5`Vulnerability monitoring and scanning `SI-2`Flaw remediation	`CC7.1`Detection and monitoring procedures identify vulnerabilities
Penetration testing and independent assessment	`CA-8`Penetration testing `CA-2`Control assessments	`CC4.1`Selects, develops and performs ongoing and/or separate evaluations `CC7.1`Detection and monitoring procedures
Logging, log review and monitoring	`AU-2`Event logging `AU-6`Audit record review, analysis and reporting `AU-11`Audit record retention `SI-4`System monitoring	`CC7.2`Monitors system components for anomalies indicative of malicious acts, natural disasters and errors
Intrusion detection and integrity monitoring	`SI-4`System monitoring `SI-7`Software, firmware and information integrity	`CC7.2`Monitors system components for anomalies `CC6.8`Prevents or detects unauthorized or malicious software
Malware protection	`SI-3`Malicious code protection	`CC6.8`Implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software
Incident response and breach notification	`IR-4`Incident handling `IR-8`Incident response plan `IR-6`Incident reporting `IR-3`Incident response testing	`CC7.3`Evaluates security events to determine whether they are incidents `CC7.4`Responds to identified security incidents `CC7.5`Identifies, develops and implements activities to recover from incidents
Change management	`CM-3`Configuration change control `CM-4`Impact analyses `CM-5`Access restrictions for change	`CC8.1`Authorizes, designs, develops, configures, documents, tests, approves and implements changes
Secure software development	`SA-3`System development life cycle `SA-8`Security and privacy engineering principles `SA-11`Developer testing and evaluation	`CC8.1`Changes are developed, tested and approved
Third-party and vendor risk management	`SR-3`Supply chain controls and processes `SR-6`Supplier assessments and reviews `SA-9`External system services	`CC9.2`Assesses and manages risks associated with vendors and business partners
Business continuity and disaster recovery	`CP-2`Contingency plan `CP-4`Contingency plan testing `CP-10`System recovery and reconstitution	`CC9.1`Identifies, selects and develops risk mitigation activities for business disruptions `A1.2`Environmental protections, software, data backup processes and recovery infrastructure `A1.3`Tests recovery plan procedures
Backup and redundancy	`CP-9`System backup	`A1.2`Data backup processes and recovery infrastructure
Capacity and availability management	`SC-5`Denial-of-service protection	`A1.1`Maintains, monitors and evaluates current processing capacity
Security awareness and training	`AT-2`Literacy training and awareness `AT-3`Role-based training	`CC1.4`Demonstrates commitment to attract, develop and retain competent individuals `CC2.2`Internally communicates information necessary to support internal control
Personnel screening, terms and sanctions	`PS-3`Personnel screening `PS-4`Personnel termination `PS-8`Personnel sanctions	`CC1.4`Hiring and competence practices `CC6.3`Removes access on termination
Physical access and facility security	`PE-2`Physical access authorizations `PE-3`Physical access control `PE-6`Monitoring physical access	`CC6.4`Restricts physical access to facilities and protected information assets
Data retention, media handling and secure disposal	`MP-6`Media sanitization `SI-12`Information management and retention	`CC6.5`Discontinues logical and physical protections over assets only after the ability to read or recover data is diminished `C1.2`Disposes of confidential information
Ongoing control monitoring and internal audit	`CA-2`Control assessments `CA-7`Continuous monitoring	`CC4.1`Selects, develops and performs ongoing and/or separate evaluations `CC4.2`Evaluates and communicates internal control deficiencies

Open a control objective for the evidence checklist.SOC 2 to NIST 800-53 r5 →

Scope: Base controls only (no enhancements). FedRAMP, TX-RAMP and StateRAMP baselines are built on 800-53, but baseline membership and parameters are not included here. Security (CC series), Availability (A1) and Confidentiality (C1). Processing Integrity and Privacy are not covered in this dataset version. A mapping means the requirements address the same objective. It does not mean satisfying one satisfies the other, because scope, frequency and evidence rules differ.

More from NIST 800-53 r5

NIST 800-53 r5 to PCI DSS 4.0 NIST 800-53 r5 to NIST CSF 2.0 NIST 800-53 r5 to ISO 27001:2022 NIST 800-53 r5 to HIPAA Security Rule