NIST 800-53 Rev 5 Controls
Comprehensive security and privacy controls for federal information systems, with specific relevance to AI systems.
Control Families
AC
3Access Control
AU
1Audit and Accountability
CM
1Configuration Management
IA
1Identification and Authentication
IR
1Incident Response
RA
1Risk Assessment
SA
1System and Services Acquisition
SC
1System and Communications Protection
SI
2System and Information Integrity
SR
5Supply Chain Risk Management
All Controls
Account Management
Access Control
The organization manages information system accounts, including establishing, activating, modifying, reviewing, disabling, and removing accounts.
AI Relevance
Critical for managing access to AI models, training data, and inference services. Ensures only authorized users can access sensitive AI resources.
Access Enforcement
Access Control
The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
AI Relevance
Essential for controlling access to AI models, APIs, training data, and inference results. Prevents unauthorized access to sensitive AI resources.
Least Privilege
Access Control
The organization employs the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned tasks.
AI Relevance
Critical for AI systems to ensure users only have access to necessary models, data, and functions. Prevents privilege escalation in AI environments.
System Monitoring
System and Information Integrity
The organization monitors the information system to detect attacks and indicators of potential attacks in accordance with monitoring objectives.
AI Relevance
Essential for monitoring AI system behavior, detecting model drift, identifying adversarial attacks, and ensuring AI system integrity.
Software, Firmware, and Information Integrity
System and Information Integrity
The organization employs integrity verification tools to detect unauthorized changes to software, firmware, and information.
AI Relevance
Critical for ensuring AI model integrity, preventing model tampering, and maintaining trust in AI system outputs and behavior.
Transmission Confidentiality and Integrity
System and Communications Protection
The information system protects the confidentiality and integrity of transmitted information.
AI Relevance
Essential for protecting AI model communications, API calls, and data transmission between AI system components.
Audit Events
Audit and Accountability
The information system generates audit records for the events defined in AU-2 a. through AU-2 d.
AI Relevance
Critical for auditing AI system usage, tracking model access, monitoring inference requests, and supporting AI security incident response.
Configuration Settings
Configuration Management
The organization establishes and documents configuration settings for information technology products employed within the information system.
AI Relevance
Essential for securing AI system configurations, model parameters, and deployment settings to prevent unauthorized modifications.
Identification and Authentication (Organizational Users)
Identification and Authentication
The information system uniquely identifies and authenticates organizational users (or processes acting on behalf of organizational users).
AI Relevance
Critical for authenticating users accessing AI systems, APIs, and sensitive AI resources to prevent unauthorized access.
Incident Handling
Incident Response
The organization implements an incident handling capability for security incidents that includes preparation, detection and analysis, containment, eradication, and recovery.
AI Relevance
Essential for responding to AI security incidents, model attacks, data breaches, and AI system compromises.
Security Categorization
Risk Assessment
The organization categorizes information and the information system in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.
AI Relevance
Critical for categorizing AI systems, models, and data based on their sensitivity and potential impact on organizational operations.
Developer Security Testing and Evaluation
System and Services Acquisition
The organization requires the developer of the information system, system component, or information system service to create and implement a security assessment plan.
AI Relevance
Essential for ensuring AI systems and models are developed with security in mind and undergo proper security testing.
Supply Chain Risk Management Policy and Procedures
Supply Chain Risk Management
The organization develops, documents, and disseminates to personnel a supply chain risk management policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.
AI Relevance
Critical for managing risks associated with AI model supply chains, third-party AI services, and AI component vendors.
Supply Chain Risk Management Plan
Supply Chain Risk Management
The organization develops a plan to manage supply chain risks associated with the information system, system component, or information system service.
AI Relevance
Essential for planning and managing risks in AI supply chains, including model providers, data sources, and AI infrastructure vendors.
Supply Chain Controls and Processes
Supply Chain Risk Management
The organization establishes and maintains supply chain controls and processes to manage supply chain risks.
AI Relevance
Critical for implementing controls to manage risks from AI model providers, data vendors, and AI infrastructure suppliers.
Provenance
Supply Chain Risk Management
The organization establishes and maintains provenance over information, information systems, system components, and information system services.
AI Relevance
Essential for tracking the origin and history of AI models, training data, and AI system components to ensure trust and authenticity.
Acquisition Strategies, Tools, and Methods
Supply Chain Risk Management
The organization employs the following controls to develop and implement supply chain risk management strategies, tools, and methods.
AI Relevance
Critical for developing effective strategies and tools to manage risks in AI supply chains, including model acquisition and data procurement.
Framework Context
NIST 800-53 Rev 5
Security and Privacy Controls for Federal Information Systems
Official Documentation →