NIST CSF 2.0 to NIST 800-53 r5 crosswalk

29 control objectives in NIST Cybersecurity Framework are mapped here to NIST SP 800-53 Security and Privacy Controls. Every one has a requirement on the other side. Each row is one shared objective, with the requirement ids on both sides.

Control objective	NIST CSF 2.0	NIST 800-53 r5
Security governance and policies	`GV.PO`Policy `GV.OV`Oversight	`PM-1`Information security program plan `PL-1`Policy and procedures (planning)
Security roles and accountability	`GV.RR`Roles, responsibilities and authorities	`PM-2`Information security program leadership role `AC-5`Separation of duties
Risk assessment and treatment	`GV.RM`Risk management strategy `ID.RA`Risk assessment	`RA-3`Risk assessment `PM-9`Risk management strategy
Asset and system inventory	`ID.AM`Asset management	`CM-8`System component inventory
Data classification and handling	`ID.AM-07`Inventories of data and corresponding metadata are maintained `PR.DS`Data security	`RA-2`Security categorization
Access provisioning, review and removal	`PR.AA-05`Access permissions, entitlements and authorizations are defined and managed (least privilege, separation of duties)	`AC-2`Account management `AC-3`Access enforcement `PS-4`Personnel termination `PS-5`Personnel transfer
Least privilege and privileged access	`PR.AA-05`Access permissions managed incorporating least privilege	`AC-6`Least privilege `AC-5`Separation of duties
Authentication, unique IDs and multi-factor authentication	`PR.AA-03`Users, services and hardware are authenticated	`IA-2`Identification and authentication (organizational users) `IA-5`Authenticator management
Encryption at rest and key management	`PR.DS-01`The confidentiality, integrity and availability of data-at-rest are protected	`SC-28`Protection of information at rest `SC-12`Cryptographic key establishment and management `SC-13`Cryptographic protection
Encryption in transit	`PR.DS-02`The confidentiality, integrity and availability of data-in-transit are protected	`SC-8`Transmission confidentiality and integrity `SC-13`Cryptographic protection
Network security and segmentation	`PR.IR-01`Networks and environments are protected from unauthorized logical access and usage	`SC-7`Boundary protection `AC-4`Information flow enforcement
Secure configuration and hardening	`PR.PS-01`Configuration management practices are established and applied	`CM-2`Baseline configuration `CM-6`Configuration settings `CM-7`Least functionality
Vulnerability scanning and patching	`ID.RA`Risk assessment (vulnerability identification, ID.RA-01) `PR.PS-02`Software is maintained, replaced and removed commensurate with risk	`RA-5`Vulnerability monitoring and scanning `SI-2`Flaw remediation
Penetration testing and independent assessment	`ID.IM`Improvement (incl. ID.IM-02, improvements from tests and exercises)	`CA-8`Penetration testing `CA-2`Control assessments
Logging, log review and monitoring	`DE.CM`Continuous monitoring `PR.PS-04`Log records are generated and made available for continuous monitoring	`AU-2`Event logging `AU-6`Audit record review, analysis and reporting `AU-11`Audit record retention `SI-4`System monitoring
Intrusion detection and integrity monitoring	`DE.CM`Continuous monitoring `DE.AE`Adverse event analysis	`SI-4`System monitoring `SI-7`Software, firmware and information integrity
Malware protection	`PR.PS-05`Installation and execution of unauthorized software are prevented `DE.CM`Continuous monitoring	`SI-3`Malicious code protection
Incident response and breach notification	`RS.MA`Incident management `RS.AN`Incident analysis `RS.CO`Incident response reporting and communication `RS.MI`Incident mitigation `DE.AE`Adverse event analysis	`IR-4`Incident handling `IR-8`Incident response plan `IR-6`Incident reporting `IR-3`Incident response testing
Change management	`PR.PS-01`Configuration management practices are established and applied	`CM-3`Configuration change control `CM-4`Impact analyses `CM-5`Access restrictions for change
Secure software development	`PR.PS-06`Secure software development practices are integrated and their performance monitored	`SA-3`System development life cycle `SA-8`Security and privacy engineering principles `SA-11`Developer testing and evaluation
Third-party and vendor risk management	`GV.SC`Cybersecurity supply chain risk management	`SR-3`Supply chain controls and processes `SR-6`Supplier assessments and reviews `SA-9`External system services
Business continuity and disaster recovery	`PR.IR-03`Mechanisms are implemented to achieve resilience requirements `RC.RP`Incident recovery plan execution	`CP-2`Contingency plan `CP-4`Contingency plan testing `CP-10`System recovery and reconstitution
Backup and redundancy	`PR.DS-11`Backups of data are created, protected, maintained and tested	`CP-9`System backup
Capacity and availability management	`PR.IR-04`Adequate resource capacity to ensure availability is maintained	`SC-5`Denial-of-service protection
Security awareness and training	`PR.AT`Awareness and training	`AT-2`Literacy training and awareness `AT-3`Role-based training
Personnel screening, terms and sanctions	`GV.RR-04`Cybersecurity is included in human resources practices	`PS-3`Personnel screening `PS-4`Personnel termination `PS-8`Personnel sanctions
Physical access and facility security	`PR.AA-06`Physical access to assets is managed, monitored and enforced commensurate with risk	`PE-2`Physical access authorizations `PE-3`Physical access control `PE-6`Monitoring physical access
Data retention, media handling and secure disposal	`ID.AM-08`Systems, hardware, software, services and data are managed throughout their life cycles	`MP-6`Media sanitization `SI-12`Information management and retention
Ongoing control monitoring and internal audit	`ID.IM`Improvement `GV.OV`Oversight	`CA-2`Control assessments `CA-7`Continuous monitoring

Open a control objective for the evidence checklist.NIST 800-53 r5 to NIST CSF 2.0 →

Scope: Mapped at category level (e.g. PR.AA) or subcategory where one is clearly the match (e.g. PR.AA-05). Base controls only (no enhancements). FedRAMP, TX-RAMP and StateRAMP baselines are built on 800-53, but baseline membership and parameters are not included here. A mapping means the requirements address the same objective. It does not mean satisfying one satisfies the other, because scope, frequency and evidence rules differ.

More from NIST CSF 2.0

NIST CSF 2.0 to SOC 2 NIST CSF 2.0 to PCI DSS 4.0 NIST CSF 2.0 to ISO 27001:2022 NIST CSF 2.0 to HIPAA Security Rule