NIST SP 800 series
NIST’s Special Publications on computer security, including SP 800-53 security controls and SP 800-171 for controlled unclassified information.
Overview
The 800 series provides detailed control catalogues and guidance used by US federal agencies, contractors and many private organisations.
As an industry standard it binds through regulation that cites it, contracts that require it or audits that test it. The authorities most closely connected to it are NIST. It is often read together with NIST CSF.
Check the official sources below for legal scope, applicable dates and exceptions. This entry is an explanatory reference, not legal advice.
Why it matters
For government contractors, these controls can be contractual requirements.
Who it affects
Federal agencies, contractors and security-mature organisations.
Where it sits
Ten linked steps connect where you operate to the proof that you complied.
- 01Jurisdiction
- 02Industry
- 03Activity
- 04Authority
- 05Regulation
- 06Requirement
- 07Guidance
- 08Control
- 09Evidence
- 10Enforcement
Connections
The terms most closely tied to NIST SP 800 series. Select one to open it.
What to do about it
- 1Decide whether it applies through regulation, contract, audit or certification.
- 2Run a gap assessment against your current controls.
- 3Crosswalk it to the regulations and contracts that reference it.
- 4Collect evidence continuously for the audit period.
From requirement to evidence.
800-series controls are crosswalked to other frameworks and regulations.
Request early access →