NIST SP 800-53 Revision 5
Security and Privacy Controls for Information Systems and Organizations
Showing 96 controls in PRIVACY baseline
AC — Access Control (2 controls)
AT — Awareness and Training (5 controls)
AU — Audit and Accountability (4 controls)
CA — Assessment, Authorization, and Monitoring (6 controls)
CM — Configuration Management (2 controls)
IR — Incident Response (10 controls)
IR-1Policy And Procedures
LOW
MODERATE
HIGH
PRIVACY
IR-2Incident Response Training
LOW
MODERATE
HIGH
PRIVACY
IR-2(3)Breach
PRIVACY
IR-3Incident Response Testing
MODERATE
HIGH
PRIVACY
IR-4Incident Handling
LOW
MODERATE
HIGH
PRIVACY
IR-5Incident Monitoring
LOW
MODERATE
HIGH
PRIVACY
IR-6Incident Reporting
LOW
MODERATE
HIGH
PRIVACY
IR-7Incident Response Assistance
LOW
MODERATE
HIGH
PRIVACY
IR-8Incident Response Plan
LOW
MODERATE
HIGH
PRIVACY
IR-8(1)Breaches
PRIVACY
MP — Media Protection (2 controls)
PE — Physical and Environmental Protection (1 controls)
PL — Planning (6 controls)
PL-1Policy And Procedures
LOW
MODERATE
HIGH
PRIVACY
PL-2System Security And Privacy Plans
LOW
MODERATE
HIGH
PRIVACY
PL-4Rules Of Behavior
LOW
MODERATE
HIGH
PRIVACY
PL-4(1)Social Media And External Site/Application Usage Restrictions
LOW
MODERATE
HIGH
PRIVACY
PL-8Security And Privacy Architectures
MODERATE
HIGH
PRIVACY
PL-9Central Management
PRIVACY
PM — Program Management (24 controls)
PM-3Information Security And Privacy Resources
PRIVACY
PM-4Plan Of Action And Milestones Process
PRIVACY
PM-5(1)Inventory Of Personally Identifiable Information
PRIVACY
PM-6Measures Of Performance
PRIVACY
PM-7Enterprise Architecture
PRIVACY
PM-8Critical Infrastructure Plan
PRIVACY
PM-9Risk Management Strategy
PRIVACY
PM-10Authorization Process
PRIVACY
PM-11Mission And Business Process Definition
PRIVACY
PM-13Security And Privacy Workforce
PRIVACY
PM-14Testing, Training, And Monitoring
PRIVACY
PM-17Protecting Controlled Unclassified Information On External Systems
PRIVACY
PM-18Privacy Program Plan
PRIVACY
PM-19Privacy Program Leadership Role
PRIVACY
PM-20Dissemination Of Privacy Program Information
PRIVACY
PM-20(1)Privacy Policies On Websites, Applications, And Digital Services
PRIVACY
PM-21Accounting Of Disclosures
PRIVACY
PM-22Personally Identifiable Information Quality Management
PRIVACY
PM-24Data Integrity Board
PRIVACY
PM-25Minimization Of Personally Identifiable Information Used In Testing, Training, And Research
PRIVACY
PM-26Complaint Management
PRIVACY
PM-27Privacy Reporting
PRIVACY
PM-28Risk Framing
PRIVACY
PM-31Continuous Monitoring Strategy
PRIVACY
PS — Personnel Security (1 controls)
PT — PII Processing and Transparency (13 controls)
PT-1Policy And Procedures
PRIVACY
PT-2Authority To Process Personally Identifiable Information
PRIVACY
PT-3Personally Identifiable Information Processing Purposes
PRIVACY
PT-4Consent
PRIVACY
PT-5Privacy Notice
PRIVACY
PT-5(2)Privacy Act Statements
PRIVACY
PT-6System Of Records Notice
PRIVACY
PT-6(1)Routine Uses
PRIVACY
PT-6(2)Exemption Rules
PRIVACY
PT-7Specific Categories Of Personally Identifiable Information
PRIVACY
PT-7(1)Social Security Numbers
PRIVACY
PT-7(2)First Amendment Information
PRIVACY
PT-8Computer Matching Requirements
PRIVACY
RA — Risk Assessment (4 controls)
SA — System and Services Acquisition (7 controls)
SA-1Policy And Procedures
LOW
MODERATE
HIGH
PRIVACY
SA-2Allocation Of Resources
LOW
MODERATE
HIGH
PRIVACY
SA-3System Development Life Cycle
LOW
MODERATE
HIGH
PRIVACY
SA-4Acquisition Process
LOW
MODERATE
HIGH
PRIVACY
SA-8(33)Minimization
PRIVACY
SA-9External System Services
LOW
MODERATE
HIGH
PRIVACY
SA-11Developer Testing And Evaluation
MODERATE
HIGH
PRIVACY
SC — System and Communications Protection (1 controls)
SI — System and Information Integrity (8 controls)
SI-1Policy And Procedures
LOW
MODERATE
HIGH
PRIVACY
SI-12Information Management And Retention
LOW
MODERATE
HIGH
PRIVACY
SI-12(1)Limit Personally Identifiable Information Elements
PRIVACY
SI-12(2)Minimize Personally Identifiable Information In Testing, Training, And Research
PRIVACY
SI-12(3)Information Disposal
PRIVACY
SI-18Personally Identifiable Information Quality Operations
PRIVACY
SI-18(4)Individual Requests
PRIVACY
SI-19De-Identification
PRIVACY