IA–RA: Objectives to Evidence, Volume 2

NIST SP 800-53A Rev. 5 Assessment Procedures (Annotated). Identification and Authentication through Risk Assessment, Release 5.2.0

PDF edition (407 pages), $19

Hardcover ($39.99): Hardcover coming soon

Cover of IA–RA: Objectives to Evidence, Volume 2: NIST SP 800-53A Rev. 5 Assessment Procedures (Annotated). Identification and Authentication through Risk Assessment, Release 5.2.0

What this edition adds to the free NIST publication

SP 800-53A, SP 800-53 and SP 800-53B are public domain and free to download from NIST. You pay for the annotation and for bringing the baselines, mappings and cross-references together on each assessment procedure, not for the NIST text.

NIST SP 800-53A Rev. 5 (free)This annotated edition
Assessment proceduresThe full catalogAll 306 active items in families IA to RA (125 base controls and 181 enhancements), word for word, labelled NIST VERBATIM: 421 organization-defined parameters and 1,069 determination statements, with the Examine, Interview and Test objects
AnnotationNot in SP 800-53AAn annotation on every one of the 306 items: in plain English, what the assessor wants to see, common findings and pitfalls, and Examine · Interview · Test tips
Evidence guidanceLists potential assessment objects1,193 items of evidence an assessor may ask to see, and 906 common findings
BaselinesA separate publication, SP 800-53BLow, Moderate, High and Privacy boxes on every item, and a baseline index (Appendix A)
ISO/IEC 27001:2022Published separately as a NIST OLIR crosswalkA row on every item: NIST OLIR numbers where NIST publishes them, otherwise a labelled editorial pointer; cross-reference by clause and Annex A control (Appendix B)
SP 800-53 control textA separate publicationThe volume and page of each item's control text in Controls to Evidence, Volume 1 (IA to PE) and Volume 2 (PL to RA)
Release changesSummary of changes published separatelyIA-13 and its three enhancements (added in 5.1.1) flagged in place; Appendix D points to the 5.2.0 changes in Volume 3
NavigationNIST's own PDF and data formatsEach base control starts on a new page; bookmarks, a control index and 3,135 internal links

What the annotation work gives you:

  • An annotation on every one of the 306 active items, starting with what the objective asks for in plain English.
  • 1,193 evidence items under "What the assessor wants to see", and 906 common findings and pitfalls.
  • Examine · Interview · Test tips for each item, saying how to use each method on it. Enhancements selected in an SP 800-53B baseline also get "What it adds", "When it applies" and interview questions.
  • SP 800-53B baselines on the page: Low, Moderate, High and Privacy boxes on every item. In this volume 64 items are in the Low baseline, 97 in Moderate, 119 in High and 61 in Privacy.
  • ISO/IEC 27001:2022 references on every item, from NIST's OLIR crosswalk where it exists and clearly labelled as editorial where it does not, plus CSF 2.0 references where NIST's tools give them.
  • Cross-references to the control text: each item gives the page in Controls to Evidence, Volume 1 (IA to PE) and Volume 2 (PL to RA) where its SP 800-53 control statement and discussion are printed.
  • 48 withdrawn items listed at the end of their control or family, each with a pointer to where its content went.
  • Reader aids: a primer, "From objective to evidence", a "How to read an entry" page, a baseline index, an ISO/IEC 27001:2022 cross-reference, 47 glossary terms quoted from SP 800-53A, and a control index.

Look inside

Printed pp. 19–20. Left: IA-02(01) Multi-factor Authentication to Privileged Accounts, with the assessment procedure reproduced verbatim and the Sectutor annotation. Right: IA-02(02) for non-privileged accounts, in the same layout.
Printed pp. 19–20. Left: IA-02(01) Multi-factor Authentication to Privileged Accounts, with the assessment procedure reproduced verbatim and the Sectutor annotation. Right: IA-02(02) for non-privileged accounts, in the same layout.
Printed p. 19, close-up of the IA-02(01) annotation: in plain English, what it adds over IA-02, when it applies, example artefacts, common findings, Examine · Interview · Test tips, interview questions, and baseline and mapping rows.
Printed p. 19, close-up of the IA-02(01) annotation: in plain English, what it adds over IA-02, when it applies, example artefacts, common findings, Examine · Interview · Test tips, interview questions, and baseline and mapping rows.
Printed p. 393. Appendix B: ISO/IEC 27001:2022 cross-reference. For each clause or Annex A control, the items in this volume that NIST’s OLIR crosswalk maps to it, plus editorial pointers. No ISO text is reproduced.
Printed p. 393. Appendix B: ISO/IEC 27001:2022 cross-reference. For each clause or Annex A control, the items in this volume that NIST’s OLIR crosswalk maps to it, plus editorial pointers. No ISO text is reproduced.
Printed p. 401. Appendix D: what changed in Release 5.2.0, restated from NIST’s summary of changes, with pointers to the pages in Volume 3.
Printed p. 401. Appendix D: what changed in Release 5.2.0, restated from NIST’s summary of changes, with pointers to the pages in Volume 3.

Description

NIST SP 800-53A Revision 5 sets out how to assess the security and privacy controls of SP 800-53: for each control and enhancement, the assessment objectives an assessor must determine and the methods and objects to use. This annotated edition reproduces the assessment procedures of Release 5.2.0 (August 2025) and adds a practitioner annotation after every one. Volume 2 of 3 covers 10 families: Identification and Authentication (IA), Incident Response (IR), Maintenance (MA), Media Protection (MP), Physical and Environmental Protection (PE), Planning (PL), Program Management (PM), Personnel Security (PS), Personally Identifiable Information Processing and Transparency (PT) and Risk Assessment (RA).

The assessment objectives (organization-defined parameters and determination statements) and the potential assessment methods and objects for all 306 active items in these families, re-typeset from NIST's Release 5.2.0 sources with the wording unchanged and labelled NIST VERBATIM, and 47 glossary entries from Appendix A of SP 800-53A. The SP 800-53 control statements and discussion are not reproduced here; each item points to their page in Controls to Evidence, Volume 1 (IA to PE) and Volume 2 (PL to RA). The other chapters and appendices of SP 800-53A are not reproduced.

What's inside

  • About the author (p. 9); Primer: from objective to evidence (p. 11); How to read an entry (p. 13)
  • IA Identification and Authentication (p. 15); IR Incident Response (p. 79); MA Maintenance (p. 123); MP Media Protection (p. 155); PE Physical and Environmental Protection (p. 179); PL Planning (p. 239); PM Program Management (p. 257); PS Personnel Security (p. 313); PT Personally Identifiable Information Processing and Transparency (p. 335); RA Risk Assessment (p. 359)
  • Appendix A Baseline index (p. 385); Appendix B ISO/IEC 27001:2022 cross-reference (p. 393); Appendix C Glossary, selected NIST terms (p. 397); Appendix D What changed in Release 5.2.0 (p. 401); Control index (p. 403)

Who it is for

Assessors, auditors, system owners and compliance teams who plan, carry out or prepare for assessments of SP 800-53 controls, under FISMA and the Risk Management Framework or another programme built on the catalog. Volume 1 covers AC to CP, Volume 2 IA to RA and Volume 3 SA to SR. Each volume has its own primer, appendices and index, so it can be used on its own.

About the author

Emmanuel Aigbehi Walstra is a CISO who also serves as a virtual CISO (vCISO) for several organisations, with 30+ years in cybersecurity, 10,000+ people trained, and author of the CCSP Excellence books.

Independent companion

This book is an independent companion to the NIST publications. The NIST text in it is public domain and is reproduced courtesy of the National Institute of Standards and Technology. The book is not affiliated with or endorsed by NIST, the U.S. Department of Commerce, the Joint Task Force or ISO/IEC. ISO/IEC 27001:2022 is cited by number only; no ISO text is reproduced. Mappings between frameworks are reading aids, not official equivalences. This book gives general information and is not legal, assessment or compliance advice.

Buy

Read the licence

PDF edition

$19

PDF edition (407 pages), $19