Recommended Security Controls for Federal Information Systems and Organizations (NIST 800-53 Revision 3)

The purpose of this publication is to give guidelines for selecting and specifying controls for IS and to help achieve more secure information systems and effective management within federal government. Security controls described in this publication are organized into seventeen families.  Each family contains security controls related to the security functionality of the family. A two-character identifier is assigned to uniquely identify each security control family.

TABLE 1: SECURITY CONTROL CLASSES, FAMILIES, AND IDENTIFIERS

IDENTIFIER	FAMILY	CLASS
AC	Access Control	Technical
AT	Awareness and Training	Operational
AU	Audit and Accountability	Technical
CA	Security Assessment and Authorization	Management
CM	Configuration Management	Operational
CP	Contingency Planning	Operational
IA	Identification and Authentication	Technical
IR	Incident Response	Operational
MA	Maintenance	Operational
MP	Media Protection	Operational
PE	Physical and Environmental Protection	Operational
PL	Planning	Management
PS	Personnel Security	Operational
RA	Risk Assessment	Management
SA	System and Services Acquisition	Management
SC	System and Communications Protection	Technical
SI	System and Information Integrity	Operational
PM	Program Management	Management

 To identify each security control, a numeric identifier is appended to the family identifier to indicate the number of the control within the family.

This publication also provides the description of the selecting and specifying security controls for an IS.  The selection and specification of these controls for an information system is accomplished as part of an organization-wide information security program for the management of risk.

 Also, in NIST 800-53 we can find the specific activities in the Risk Management Framework:

 

Moreover, there is described security selection process in this publication, which can be shown as: