AC–CP: Objectives to Evidence, Volume 1

NIST SP 800-53A Rev. 5 Assessment Procedures (Annotated). Access Control through Contingency Planning, Release 5.2.0

PDF edition (409 pages), $19

Hardcover ($39.99): Hardcover coming soon

Cover of AC–CP: Objectives to Evidence, Volume 1: NIST SP 800-53A Rev. 5 Assessment Procedures (Annotated). Access Control through Contingency Planning, Release 5.2.0

What this edition adds to the free NIST publication

SP 800-53A, SP 800-53 and SP 800-53B are public domain and free to download from NIST. You pay for the annotation and for bringing the baselines, mappings and cross-references together on each assessment procedure, not for the NIST text.

NIST SP 800-53A Rev. 5 (free)This annotated edition
Assessment proceduresThe full catalogAll 332 active items in families AC to CP (77 base controls and 255 enhancements), word for word, labelled NIST VERBATIM: 528 organization-defined parameters and 876 determination statements, with the Examine, Interview and Test objects
AnnotationNot in SP 800-53AAn annotation on every one of the 332 items: in plain English, what the assessor wants to see, common findings and pitfalls, and Examine · Interview · Test tips
Evidence guidanceLists potential assessment objects1,242 items of evidence an assessor may ask to see, and 1,083 common findings
BaselinesA separate publication, SP 800-53BLow, Moderate, High and Privacy boxes on every item, and a baseline index (Appendix A)
ISO/IEC 27001:2022Published separately as a NIST OLIR crosswalkA row on every item: NIST OLIR numbers where NIST publishes them, otherwise a labelled editorial pointer; cross-reference by clause and Annex A control (Appendix B)
SP 800-53 control textA separate publicationThe volume and page of each item's control text in Controls to Evidence, Volume 1
Release changesSummary of changes published separatelyAppendix D restates NIST's summary of changes, with pointers to Volume 3, where all new and revised items are printed
NavigationNIST's own PDF and data formatsEach base control starts on a new page; bookmarks, a control index and 2,856 internal links

What the annotation work gives you:

  • An annotation on every one of the 332 active items, starting with what the objective asks for in plain English.
  • 1,242 evidence items under "What the assessor wants to see", and 1,083 common findings and pitfalls.
  • Examine · Interview · Test tips for each item, saying how to use each method on it. Enhancements selected in an SP 800-53B baseline also get "What it adds", "When it applies" and interview questions.
  • SP 800-53B baselines on the page: Low, Moderate, High and Privacy boxes on every item. In this volume 49 items are in the Low baseline, 118 in Moderate, 158 in High and 19 in Privacy.
  • ISO/IEC 27001:2022 references on every item, from NIST's OLIR crosswalk where it exists and clearly labelled as editorial where it does not, plus CSF 2.0 references where NIST's tools give them.
  • Cross-references to the control text: each item gives the page in Controls to Evidence, Volume 1 where its SP 800-53 control statement and discussion are printed.
  • 55 withdrawn items listed at the end of their control or family, each with a pointer to where its content went.
  • Reader aids: a primer, "From objective to evidence", a "How to read an entry" page, a baseline index, an ISO/IEC 27001:2022 cross-reference, 48 glossary terms quoted from SP 800-53A, and a control index.

Look inside

Printed pp. 17–18. Left: the SP 800-53A assessment procedure for AC-01 Policy and Procedures, reproduced verbatim (determination statements, then Examine and Interview objects). Right: the Sectutor annotation for the same item.
Printed pp. 17–18. Left: the SP 800-53A assessment procedure for AC-01 Policy and Procedures, reproduced verbatim (determination statements, then Examine and Interview objects). Right: the Sectutor annotation for the same item.
Printed p. 18, close-up of the AC-01 annotation: in plain English, what the assessor wants to see, common findings and pitfalls, Examine · Interview · Test tips, SP 800-53B baselines, ISO/IEC 27001:2022 and CSF 2.0 mappings, and the page of the control text in Controls to Evidence.
Printed p. 18, close-up of the AC-01 annotation: in plain English, what the assessor wants to see, common findings and pitfalls, Examine · Interview · Test tips, SP 800-53B baselines, ISO/IEC 27001:2022 and CSF 2.0 mappings, and the page of the control text in Controls to Evidence.
Printed p. 9. Opening page of the primer: from objective to evidence. What SP 800-53A is for, how objectives and parameters work, and the three assessment methods.
Printed p. 9. Opening page of the primer: from objective to evidence. What SP 800-53A is for, how objectives and parameters work, and the three assessment methods.
Printed p. 389. Appendix A: baseline index. Every active item in the volume with its SP 800-53B Low, Moderate, High and Privacy selection and the page of its procedure.
Printed p. 389. Appendix A: baseline index. Every active item in the volume with its SP 800-53B Low, Moderate, High and Privacy selection and the page of its procedure.

Description

NIST SP 800-53A Revision 5 sets out how to assess the security and privacy controls of SP 800-53: for each control and enhancement, the assessment objectives an assessor must determine and the methods and objects to use. This annotated edition reproduces the assessment procedures of Release 5.2.0 (August 2025) and adds a practitioner annotation after every one. Volume 1 of 3 covers 6 families: Access Control (AC), Awareness and Training (AT), Audit and Accountability (AU), Assessment, Authorization, and Monitoring (CA), Configuration Management (CM) and Contingency Planning (CP).

The assessment objectives (organization-defined parameters and determination statements) and the potential assessment methods and objects for all 332 active items in these families, re-typeset from NIST's Release 5.2.0 sources with the wording unchanged and labelled NIST VERBATIM, and 48 glossary entries from Appendix A of SP 800-53A. The SP 800-53 control statements and discussion are not reproduced here; each item points to their page in Controls to Evidence, Volume 1. The other chapters and appendices of SP 800-53A are not reproduced.

What's inside

  • About the author (p. 7); Primer: from objective to evidence (p. 9); How to read an entry (p. 13)
  • AC Access Control (p. 15); AT Awareness and Training (p. 155); AU Audit and Accountability (p. 173); CA Assessment, Authorization, and Monitoring (p. 233); CM Configuration Management (p. 263); CP Contingency Planning (p. 331)
  • Appendix A Baseline index (p. 389); Appendix B ISO/IEC 27001:2022 cross-reference (p. 397); Appendix C Glossary, selected NIST terms (p. 399); Appendix D What changed in Release 5.2.0 (p. 403); Control index (p. 405)

Who it is for

Assessors, auditors, system owners and compliance teams who plan, carry out or prepare for assessments of SP 800-53 controls, under FISMA and the Risk Management Framework or another programme built on the catalog. Volume 1 covers AC to CP, Volume 2 IA to RA and Volume 3 SA to SR. Each volume has its own primer, appendices and index, so it can be used on its own.

About the author

Emmanuel Aigbehi Walstra is a CISO who also serves as a virtual CISO (vCISO) for several organisations, with 30+ years in cybersecurity, 10,000+ people trained, and author of the CCSP Excellence books.

Independent companion

This book is an independent companion to the NIST publications. The NIST text in it is public domain and is reproduced courtesy of the National Institute of Standards and Technology. The book is not affiliated with or endorsed by NIST, the U.S. Department of Commerce, the Joint Task Force or ISO/IEC. ISO/IEC 27001:2022 is cited by number only; no ISO text is reproduced. Mappings between frameworks are reading aids, not official equivalences. This book gives general information and is not legal, assessment or compliance advice.

Buy

Read the licence

PDF edition

$19

PDF edition (409 pages), $19