- Home
- Frameworks
- NIST SP 800-53
NIST SP 800-53 Rev. 5
NIST 800-53 controls, backed by what your cloud says.
NIST SP 800-53 is the control catalogue many other frameworks build on. ACSE tracks 45 of its technical controls across ten families and shows, for each, the checks that evaluate it on AWS, Google Cloud and Azure, or that it is manual.
Controls tied to evidence
Each tracked control lists the checks behind it and their latest result, so a control assessment starts from facts.
One catalogue, three clouds
The same control draws on checks from every cloud you connect, so families like access control read across the estate.
A base for related frameworks
FedRAMP Moderate and CCCS Medium draw on the same control families, so work on one carries over.
Coverage
Tracked controls with a check behind them
ACSE tracks 45 technical controls from the AC, AU, CA, CM, CP, IA, IR, RA, SC and SI families, not the whole catalogue. Controls without a check are listed as manual, beside the score, so nothing quietly drops out of view.
- AWS
- 24 of 45 tracked controls
- Google Cloud
- 15 of 45 tracked controls
- Azure
- 12 of 45 tracked controls
Families
Where the checks carry weight
Access control and identification
Least privilege, administrator rights, MFA, key rotation, guest access and unused credentials.
Audit and accountability
Audit trails in every region, log integrity, flow logs and alarms on sensitive changes.
Configuration management
Secure defaults such as IMDSv2, OS Login, Shielded VM and default networks removed.
System and communications protection
Boundary protection, encryption in transit and encryption at rest with managed keys.
Contingency planning
Versioning, retention and backup retention on the stores you would recover from.
Risk assessment and integrity
Configuration monitoring and security services enabled, re-evaluated on every scan.
Change control
Every change authorized and recorded
When a check fails, the fix is proposed as code, validated against a plan, approved by a person who did not author it, and verified after it applies.
Each of those steps is a signed record in your own cloud, which supports the change control and audit families with evidence rather than screenshots.
Questions
What people ask us
Does ACSE cover the whole NIST 800-53 catalogue?
No. ACSE tracks the technical controls that cloud configuration can speak to, 45 in all, and lists those. Organizational, personnel and physical controls are outside its scope.
How does this relate to FedRAMP and CCCS Medium?
FedRAMP Moderate is the Rev. 5 Moderate baseline, and CCCS Medium uses ITSG-33 controls derived from 800-53. ACSE maps its checks to each separately, so each framework reports in its own terms.
Which revision does ACSE use?
Rev. 5. Every report names the framework version it was produced under.
Keep reading
Related
FedRAMP Moderate
ACSE maps cloud checks to the technical controls of the FedRAMP Moderate baseline, based on NIST SP 800-53 Rev. 5, and keeps signed evidence of every fix.
ReadSolutionsPublic sector
ACSE maps your cloud to CCCS Medium, NIST 800-53 Rev 5 and FedRAMP Moderate, fixes through your own code and keeps sovereign evidence in your account.
ReadPlatformCompliance posture
ACSE maps its checks to CIS, PCI DSS, NIST 800-53, FedRAMP, CCCS Medium, ISO 27001 and SOC 2, with signed framework versions and honest scores.
ReadTalk to us
See ACSE on your cloud.
Tell us what you run and what your auditors ask for. We’ll show you the loop end to end: a real finding, a fix as code, an approval with MFA and the sealed record.