Review

Which baseline is your system working toward?

Your system's security categorization decides this. You'll only be asked once — it shapes which controls you review and which parameter values you record. You can change it later on Your data.

BaselineLow 162 controls and enhancements · 445 parametersA breach would have a limited adverse effect on operations, assets or people.Moderate 300 controls and enhancements · 643 parametersA breach would have a serious adverse effect. The most common choice for business and government systems.High 383 controls and enhancements · 767 parametersA breach would have a severe or catastrophic adverse effect.Privacy 109 controls and enhancements · 259 parametersThe privacy controls, for systems that process personally identifiable information.

Not sure? Moderate is the most common starting point.

· change

Reviewing a control means two things: set each of its parameters — confirm NIST's wording or enter your organization's value — and record its status. Controls are taken in catalog order.

What's left, by family

Other ways in

Set many parameters at once — a table of every parameter, with batch entry for the shared policy controls.
See your progress — completion by family, and what's blocking you.

Electronic (OSCAL) Version of NIST SP 800-53 Rev 5.2.0 Controls and SP 800-53A Rev 5.2.0 Assessment Procedures — Catalog v5.2.0. ISO/IEC 27001:2022 crosswalk transcribed 2026-09-17.

This is an unofficial reading tool — not a substitute for the published NIST SP 800-53 Rev 5 document in any audit or compliance context.