Controls to Evidence, Volume 2
NIST SP 800-53 Rev. 5 Security and Privacy Controls (Annotated). Planning to Supply Chain Risk Management
Hardcover ($39.99): Hardcover coming soon (not on Amazon yet; KDP submissions start after 1 Nov 2026)
What this edition adds to the free NIST publication
SP 800-53 and SP 800-53B are public domain and free to download from NIST. You pay for the annotation and for bringing the baselines and mappings together on each control, not for the NIST text.
| NIST SP 800-53 Rev. 5 (free) | This annotated edition | |
|---|---|---|
| Control text | The full catalog | All 164 active base controls and their enhancements in families PL to SR, word for word, labelled NIST VERBATIM |
| Baselines | A separate publication, SP 800-53B | Low, Moderate, High and Privacy allocation on every control and enhancement |
| CSF 2.0 links | Published separately in the CSF 2.0 Reference Tool | Printed on the control for the 91 controls that NIST's tool links to a Subcategory |
| ISO/IEC 27001:2022 | Published separately as a NIST OLIR crosswalk | NIST OLIR numbers on 74 controls, and labelled editorial suggestions on 85 more |
| Practice note and evidence | Not in SP 800-53 | A practice note and 366 typical evidence items across all 164 base controls |
| Changes since December 2020 | Release notes and change summaries | 11 controls and enhancements flagged in place and listed in Appendix A |
What the annotation work gives you:
- A practice note on every one of the 164 active base controls, saying in plain terms what the control covers and how it is usually met.
- 366 typical evidence items, one to four per control: what an assessor may ask to see.
- SP 800-53B baselines on the page: Low, Moderate, High and Privacy boxes on every control and enhancement, and a count of the enhancements each baseline selects.
- CSF 2.0 Subcategories on the control for the 91 controls that NIST's CSF 2.0 Reference Tool links to one.
- ISO/IEC 27001:2022 references: numbers from NIST's OLIR crosswalk on 74 controls, and clearly labelled editorial suggestions of the closest Annex A controls on 85 more.
- 9 family openers, each with an editorial introduction and a table of the family's controls, baselines and enhancement counts.
- Current to Release 5.2.0: 11 controls and enhancements new or changed since the December 2020 PDF are flagged in place and listed in Appendix A, with sources and an index.
Look inside
Description
NIST SP 800-53 Revision 5 is the catalog of security and privacy controls behind FISMA, the Risk Management Framework and many other programmes. This annotated edition reproduces the control text of Release 5.2.0 (August 2025), including the changes NIST has made since the December 2020 PDF, and adds a practitioner annotation after every base control. Volume 2 covers 9 families: Planning (PL), Program Management (PM), Personnel Security (PS), PII Processing and Transparency (PT), Risk Assessment (RA), System and Services Acquisition (SA), System and Communications Protection (SC), System and Information Integrity (SI) and Supply Chain Risk Management (SR).
The control statements, discussion, related controls and references for all 164 active base controls and 320 active control enhancements in these families, re-typeset with the wording unchanged and labelled NIST VERBATIM. Chapters One and Two and the appendices of SP 800-53, the tailoring guidance of SP 800-53B and the assessment procedures of SP 800-53A are not reproduced.
What's inside
- How to use this volume (p. 7); Mapping method and caveats (p. 9); Which volume holds which families (p. 11)
- PL Planning (p. 13); PM Program Management (p. 23); PS Personnel Security (p. 49); PT Personally Identifiable Information Processing and Transparency (p. 59); RA Risk Assessment (p. 71)
- SA System and Services Acquisition (p. 83); SC System and Communications Protection (p. 125); SI System and Information Integrity (p. 175); SR Supply Chain Risk Management (p. 209)
- Appendix A What changed since December 2020 (p. 223); Appendix B Sources (p. 225); About the author (p. 227); Index (p. 229)
Who it is for
Security and compliance practitioners, assessors and auditors working with SP 800-53 controls, whether under FISMA and the Risk Management Framework or another programme built on the catalog. Volume 1 covers Access Control to Physical and Environmental Protection; each volume carries the same front matter, change list and sources, so it can be used on its own.
About the author
Emmanuel Aigbehi Walstra is a CISO who also serves as a virtual CISO (vCISO) for several organisations, with 30+ years in cybersecurity, 10,000+ people trained, and author of the CCSP Excellence books.
Independent companion
This book is an independent companion to the NIST publications. It is not affiliated with or endorsed by NIST, the U.S. Department of Commerce or ISO/IEC. Mappings between frameworks are reading aids, not official equivalences. This book gives general information and is not legal, assessment or compliance advice.
Buy
- PDF edition (232 pages): https://sectutor.gumroad.com/l/controls-to-evidence-vol-2 — $19
- Hardcover ($39.99): Hardcover coming soon (not on Amazon yet; KDP submissions start after 1 Nov 2026)
Controls to Evidence Vol 1 + Vol 2 (Annotated) bundle, $32. Both volumes of the annotated NIST SP 800-53 Rev. 5 control catalog (families AC to PE and PL to SR), with a practice note and evidence list on every active base control, SP 800-53B baselines and CSF 2.0 / ISO/IEC 27001 mappings.
Sectutor NIST Annotated Collection (all five), $79. All five Sectutor annotated NIST editions: CSF 2.0 (Outcomes to Evidence), AI RMF (Trust to Evidence), SP 800-171 Rev. 3 (Determine If) and SP 800-53 Rev. 5 Vol 1 and Vol 2 (Controls to Evidence).
PDF edition
$19