What this edition adds to the free NIST publication

SP 800-53 and SP 800-53B are public domain and free to download from NIST. You pay for the annotation and for bringing the baselines and mappings together on each control, not for the NIST text.

	NIST SP 800-53 Rev. 5 (free)	This annotated edition
Control text	The full catalog	All 136 active base controls and their enhancements in families AC to PE, word for word, labelled NIST VERBATIM
Baselines	A separate publication, SP 800-53B	Low, Moderate, High and Privacy allocation on every control and enhancement
CSF 2.0 links	Published separately in the CSF 2.0 Reference Tool	Printed on the control for the 101 controls that NIST's tool links to a Subcategory
ISO/IEC 27001:2022	Published separately as a NIST OLIR crosswalk	NIST OLIR numbers on 98 controls, and labelled editorial suggestions on 38 more
Practice note and evidence	Not in SP 800-53	A practice note and 396 typical evidence items across all 136 base controls
Changes since December 2020	Release notes and change summaries	4 controls and enhancements flagged in place and listed in Appendix A

What the annotation work gives you:

A practice note on every one of the 136 active base controls, saying in plain terms what the control covers and how it is usually met.
396 typical evidence items, one to four per control: what an assessor may ask to see.
SP 800-53B baselines on the page: Low, Moderate, High and Privacy boxes on every control and enhancement, and a count of the enhancements each baseline selects.
CSF 2.0 Subcategories on the control for the 101 controls that NIST's CSF 2.0 Reference Tool links to one.
ISO/IEC 27001:2022 references: numbers from NIST's OLIR crosswalk on 98 controls, and clearly labelled editorial suggestions of the closest Annex A controls on 38 more.
11 family openers, each with an editorial introduction and a table of the family's controls, baselines and enhancement counts.
Current to Release 5.2.0: 4 controls and enhancements new or changed since the December 2020 PDF are flagged in place and listed in Appendix A, with sources and an index.

Look inside

Printed pp. 13–14. Left: Access Control family opener with an editorial summary and a baseline table. Right: AC-01 control text reproduced verbatim from SP 800-53 Rev. 5, followed by the Sectutor annotation box.

Printed p. 16, close-up of the AC-02 Account Management annotation: practice note, typical evidence, SP 800-53B baselines, and CSF 2.0 and ISO/IEC 27001 mappings.

Printed p. 11. Which volume holds which families, with active control and enhancement counts.

Description

NIST SP 800-53 Revision 5 is the catalog of security and privacy controls behind FISMA, the Risk Management Framework and many other programmes. This annotated edition reproduces the control text of Release 5.2.0 (August 2025), including the changes NIST has made since the December 2020 PDF, and adds a practitioner annotation after every base control. Volume 1 covers 11 families: Access Control (AC), Awareness and Training (AT), Audit and Accountability (AU), Assessment, Authorization, and Monitoring (CA), Configuration Management (CM), Contingency Planning (CP), Identification and Authentication (IA), Incident Response (IR), Maintenance (MA), Media Protection (MP) and Physical and Environmental Protection (PE).

The control statements, discussion, related controls and references for all 136 active base controls and 394 active control enhancements in these families, re-typeset with the wording unchanged and labelled NIST VERBATIM. Chapters One and Two and the appendices of SP 800-53, the tailoring guidance of SP 800-53B and the assessment procedures of SP 800-53A are not reproduced.

What's inside

How to use this volume (p. 7); Mapping method and caveats (p. 9); Which volume holds which families (p. 11)
AC Access Control (p. 13); AT Awareness and Training (p. 55); AU Audit and Accountability (p. 63); CA Assessment, Authorization, and Monitoring (p. 85); CM Configuration Management (p. 99); CP Contingency Planning (p. 121)
IA Identification and Authentication (p. 139); IR Incident Response (p. 159); MA Maintenance (p. 173); MP Media Protection (p. 185); PE Physical and Environmental Protection (p. 195)
Appendix A What changed since December 2020 (p. 215); Appendix B Sources (p. 217); About the author (p. 219); Index (p. 221)

Who it is for

Security and compliance practitioners, assessors and auditors working with SP 800-53 controls, whether under FISMA and the Risk Management Framework or another programme built on the catalog. Volume 2 covers Planning to Supply Chain Risk Management; each volume carries the same front matter, change list and sources, so it can be used on its own.

About the author

Emmanuel Aigbehi Walstra is a CISO who also serves as a virtual CISO (vCISO) for several organisations, with 30+ years in cybersecurity, 10,000+ people trained, and author of the CCSP Excellence books.

Independent companion

This book is an independent companion to the NIST publications. It is not affiliated with or endorsed by NIST, the U.S. Department of Commerce or ISO/IEC. Mappings between frameworks are reading aids, not official equivalences. This book gives general information and is not legal, assessment or compliance advice.

Buy

PDF edition (224 pages): https://sectutor.gumroad.com/l/controls-to-evidence-vol-1 — $19
Hardcover ($39.99): Hardcover coming soon (not on Amazon yet; KDP submissions start after 1 Nov 2026)

Controls to Evidence Vol 1 + Vol 2 (Annotated) bundle, $32. Both volumes of the annotated NIST SP 800-53 Rev. 5 control catalog (families AC to PE and PL to SR), with a practice note and evidence list on every active base control, SP 800-53B baselines and CSF 2.0 / ISO/IEC 27001 mappings.

Sectutor NIST Annotated Collection (all five), $79. All five Sectutor annotated NIST editions: CSF 2.0 (Outcomes to Evidence), AI RMF (Trust to Evidence), SP 800-171 Rev. 3 (Determine If) and SP 800-53 Rev. 5 Vol 1 and Vol 2 (Controls to Evidence).

Read the licence

Controls to Evidence, Volume 1