Projects / Pilot
NIST 800-53 control crosswalk
Filter and search 131 controls (69 base controls plus enhancements that appear in a baseline) from four families: Access Control, Audit and Accountability, Risk Assessment, and System and Information Integrity. See which baselines include each control and how it relates to the NIST AI RMF and CMMC Level 2.
Want the story behind it? Read the case study.
Draft: mappings not yet reviewed
- Controls and baselines come directly from NIST's published OSCAL data for SP 800-53 Rev 5 (catalog 5.2.0).
- CMMC mappings are derived from NIST SP 800-171 Rev 2, Appendix D, which maps to Rev 4 control IDs; controls withdrawn in Rev 5 were dropped. CMMC Level 2 is built on the 800-171 requirements.
- AI RMF mappings are the author's judgment. NIST publishes no official AI RMF to 800-53 crosswalk, and the two documents serve different purposes, so the links are loose.
- This is an informational tool, not an official NIST product, and not legal, audit, or compliance advice.
Showing 131 of 131 controls
| Control | Title | Baselines | AI RMF (judgment) | CMMC L2 / 800-171 (derived) |
|---|---|---|---|---|
| Policy and Procedures | Low, Moderate, High | GOVERN 1.2, GOVERN 1.4 | No mapping | |
| Account Management | Low, Moderate, High | GOVERN 2.1, MEASURE 2.7 | §3.1.1, §3.1.2 | |
| Automated System Account Management | Moderate, High | GOVERN 2.1, MEASURE 2.7 (from AC-2) | No mapping | |
| Automated Temporary and Emergency Account Management | Moderate, High | GOVERN 2.1, MEASURE 2.7 (from AC-2) | No mapping | |
| Disable Accounts | Moderate, High | GOVERN 2.1, MEASURE 2.7 (from AC-2) | No mapping | |
| Automated Audit Actions | Moderate, High | GOVERN 2.1, MEASURE 2.7 (from AC-2) | No mapping | |
| Inactivity Logout | Moderate, High | GOVERN 2.1, MEASURE 2.7 (from AC-2) | No mapping | |
| Usage Conditions | High | GOVERN 2.1, MEASURE 2.7 (from AC-2) | No mapping | |
| Account Monitoring for Atypical Usage | High | GOVERN 2.1, MEASURE 2.7 (from AC-2) | No mapping | |
| Disable Accounts for High-risk Individuals | Moderate, High | GOVERN 2.1, MEASURE 2.7 (from AC-2) | No mapping | |
| Access Enforcement | Low, Moderate, High | MAP 4.2, MEASURE 2.7 | §3.1.1, §3.1.2 | |
| Information Flow Enforcement | Moderate, High | MAP 4.2, MEASURE 2.10 | §3.1.3 | |
| Flow Control of Encrypted Information | High | MAP 4.2, MEASURE 2.10 (from AC-4) | No mapping | |
| Separation of Duties | Moderate, High | GOVERN 2.1, MEASURE 1.3 | §3.1.4 | |
| Least Privilege | Moderate, High | MAP 4.2, MEASURE 2.7, MEASURE 2.10 | §3.1.5 | |
| Authorize Access to Security Functions | Moderate, High | MAP 4.2, MEASURE 2.7, MEASURE 2.10 (from AC-6) | §3.1.5 | |
| Non-privileged Access for Nonsecurity Functions | Moderate, High | MAP 4.2, MEASURE 2.7, MEASURE 2.10 (from AC-6) | §3.1.6 | |
| Network Access to Privileged Commands | High | MAP 4.2, MEASURE 2.7, MEASURE 2.10 (from AC-6) | No mapping | |
| Privileged Accounts | Moderate, High | MAP 4.2, MEASURE 2.7, MEASURE 2.10 (from AC-6) | §3.1.5 | |
| Review of User Privileges | Moderate, High | MAP 4.2, MEASURE 2.7, MEASURE 2.10 (from AC-6) | No mapping | |
| Log Use of Privileged Functions | Moderate, High | MAP 4.2, MEASURE 2.7, MEASURE 2.10 (from AC-6) | §3.1.7 | |
| Prohibit Non-privileged Users from Executing Privileged Functions | Moderate, High | MAP 4.2, MEASURE 2.7, MEASURE 2.10 (from AC-6) | §3.1.7 | |
| Unsuccessful Logon Attempts | Low, Moderate, High | MEASURE 2.7 | §3.1.8 | |
| System Use Notification | Low, Moderate, High | MAP 2.2 | §3.1.9 | |
| Previous Logon Notification | None | No mapping | No mapping | |
| Concurrent Session Control | High | No mapping | No mapping | |
| Device Lock | Moderate, High | No mapping | §3.1.10 | |
| Pattern-hiding Displays | Moderate, High | No mapping | §3.1.10 | |
| Session Termination | Moderate, High | No mapping | §3.1.11 | |
| Permitted Actions Without Identification or Authentication | Low, Moderate, High | No mapping | No mapping | |
| Security and Privacy Attributes | None | MEASURE 2.7, MEASURE 2.10 | No mapping | |
| Remote Access | Low, Moderate, High | MEASURE 2.7 | §3.1.1, §3.1.2 | |
| Monitoring and Control | Moderate, High | MEASURE 2.7 (from AC-17) | §3.1.12 | |
| Protection of Confidentiality and Integrity Using Encryption | Moderate, High | MEASURE 2.7 (from AC-17) | §3.1.13 | |
| Managed Access Control Points | Moderate, High | MEASURE 2.7 (from AC-17) | §3.1.14 | |
| Privileged Commands and Access | Moderate, High | MEASURE 2.7 (from AC-17) | §3.1.15 | |
| Wireless Access | Low, Moderate, High | No mapping | §3.1.16 | |
| Authentication and Encryption | Moderate, High | No mapping | §3.1.17 | |
| Disable Wireless Networking | Moderate, High | No mapping | No mapping | |
| Restrict Configurations by Users | High | No mapping | No mapping | |
| Antennas and Transmission Power Levels | High | No mapping | No mapping | |
| Access Control for Mobile Devices | Low, Moderate, High | No mapping | §3.1.18 | |
| Full Device or Container-based Encryption | Moderate, High | No mapping | §3.1.19 | |
| Use of External Systems | Low, Moderate, High | GOVERN 6.1, MAP 4.1, MEASURE 3.1 | §3.1.20 | |
| Limits on Authorized Use | Moderate, High | GOVERN 6.1, MAP 4.1, MEASURE 3.1 (from AC-20) | §3.1.20 | |
| Portable Storage Devices — Restricted Use | Moderate, High | GOVERN 6.1, MAP 4.1, MEASURE 3.1 (from AC-20) | §3.1.21 | |
| Information Sharing | Moderate, High | GOVERN 4.3, MEASURE 2.10 | No mapping | |
| Publicly Accessible Content | Low, Moderate, High | MEASURE 2.8, MEASURE 2.10 | §3.1.22 | |
| Data Mining Protection | None | MEASURE 2.7, MEASURE 2.10 | No mapping | |
| Access Control Decisions | None | MEASURE 2.7 | No mapping | |
| Reference Monitor | None | No mapping | No mapping | |
| Policy and Procedures | Low, Moderate, High | GOVERN 1.4, GOVERN 1.5 | No mapping | |
| Event Logging | Low, Moderate, High | MEASURE 3.1, MANAGE 4.1 | §3.3.1, §3.3.2 | |
| Content of Audit Records | Low, Moderate, High | MEASURE 2.8, MANAGE 4.1 | §3.3.1, §3.3.2 | |
| Additional Audit Information | Moderate, High | MEASURE 2.8, MANAGE 4.1 (from AU-3) | §3.3.1, §3.3.2 | |
| Audit Log Storage Capacity | Low, Moderate, High | No mapping | No mapping | |
| Response to Audit Logging Process Failures | Low, Moderate, High | MANAGE 4.1 | §3.3.4 | |
| Storage Capacity Warning | High | MANAGE 4.1 (from AU-5) | No mapping | |
| Real-time Alerts | High | MANAGE 4.1 (from AU-5) | No mapping | |
| Audit Record Review, Analysis, and Reporting | Low, Moderate, High | MANAGE 4.1, MEASURE 3.1, MANAGE 4.3 | §3.3.1, §3.3.2 | |
| Automated Process Integration | Moderate, High | MANAGE 4.1, MEASURE 3.1, MANAGE 4.3 (from AU-6) | No mapping | |
| Correlate Audit Record Repositories | Moderate, High | MANAGE 4.1, MEASURE 3.1, MANAGE 4.3 (from AU-6) | §3.3.5 | |
| Integrated Analysis of Audit Records | High | MANAGE 4.1, MEASURE 3.1, MANAGE 4.3 (from AU-6) | No mapping | |
| Correlation with Physical Monitoring | High | MANAGE 4.1, MEASURE 3.1, MANAGE 4.3 (from AU-6) | No mapping | |
| Audit Record Reduction and Report Generation | Moderate, High | MANAGE 4.1 | §3.3.6 | |
| Automatic Processing | Moderate, High | MANAGE 4.1 (from AU-7) | No mapping | |
| Time Stamps | Low, Moderate, High | No mapping | §3.3.7 | |
| Protection of Audit Information | Low, Moderate, High | MEASURE 2.7, MEASURE 2.8 | §3.3.8 | |
| Store on Separate Physical Systems or Components | High | MEASURE 2.7, MEASURE 2.8 (from AU-9) | No mapping | |
| Cryptographic Protection | High | MEASURE 2.7, MEASURE 2.8 (from AU-9) | No mapping | |
| Access by Subset of Privileged Users | Moderate, High | MEASURE 2.7, MEASURE 2.8 (from AU-9) | §3.3.9 | |
| Non-repudiation | High | MEASURE 2.8 | No mapping | |
| Audit Record Retention | Low, Moderate, High | MEASURE 2.8, GOVERN 4.2 | §3.3.1, §3.3.2 | |
| Audit Record Generation | Low, Moderate, High | MANAGE 4.1, MEASURE 2.8 | §3.3.1, §3.3.2 | |
| System-wide and Time-correlated Audit Trail | High | MANAGE 4.1, MEASURE 2.8 (from AU-12) | No mapping | |
| Changes by Authorized Individuals | High | MANAGE 4.1, MEASURE 2.8 (from AU-12) | No mapping | |
| Monitoring for Information Disclosure | None | MEASURE 2.10, MANAGE 4.1 | No mapping | |
| Session Audit | None | MEASURE 2.8 | No mapping | |
| Cross-organizational Audit Logging | None | No mapping | No mapping | |
| Policy and Procedures | Low, Moderate, High | GOVERN 1.3, GOVERN 1.4 | No mapping | |
| Security Categorization | Low, Moderate, High | GOVERN 1.3, MAP 1.5 | No mapping | |
| Risk Assessment | Low, Moderate, High | MAP 5.1, GOVERN 1.3, MEASURE 3.1 | §3.11.1 | |
| Supply Chain Risk Assessment | Low, Moderate, High | MAP 5.1, GOVERN 1.3, MEASURE 3.1 (from RA-3) | No mapping | |
| Vulnerability Monitoring and Scanning | Low, Moderate, High | MEASURE 2.7, MEASURE 3.1 | §3.11.2, §3.11.3 | |
| Update Vulnerabilities to Be Scanned | Low, Moderate, High | MEASURE 2.7, MEASURE 3.1 (from RA-5) | No mapping | |
| Discoverable Information | High | MEASURE 2.7, MEASURE 3.1 (from RA-5) | No mapping | |
| Privileged Access | Moderate, High | MEASURE 2.7, MEASURE 3.1 (from RA-5) | §3.11.2 | |
| Public Disclosure Program | Low, Moderate, High | MEASURE 2.7, MEASURE 3.1 (from RA-5) | No mapping | |
| Technical Surveillance Countermeasures Survey | None | No mapping | No mapping | |
| Risk Response | Low, Moderate, High | MANAGE 1.2, MANAGE 1.3 | No mapping | |
| Privacy Impact Assessments | None | MEASURE 2.10, MAP 5.1 | No mapping | |
| Criticality Analysis | Moderate, High | MAP 5.1, MAP 3.2 | No mapping | |
| Threat Hunting | None | MEASURE 2.7, MANAGE 4.1 | No mapping | |
| Policy and Procedures | Low, Moderate, High | GOVERN 1.2, GOVERN 1.4 | No mapping | |
| Flaw Remediation | Low, Moderate, High | MANAGE 2.3, MANAGE 4.2 | §3.14.1, §3.14.2, §3.14.3 | |
| Automated Flaw Remediation Status | Moderate, High | MANAGE 2.3, MANAGE 4.2 (from SI-2) | No mapping | |
| Malicious Code Protection | Low, Moderate, High | MEASURE 2.7 | §3.14.1, §3.14.2, §3.14.3, §3.14.4, §3.14.5 | |
| System Monitoring | Low, Moderate, High | MANAGE 4.1, MEASURE 2.7 | §3.14.6, §3.14.7 | |
| Automated Tools and Mechanisms for Real-time Analysis | Moderate, High | MANAGE 4.1, MEASURE 2.7 (from SI-4) | No mapping | |
| Inbound and Outbound Communications Traffic | Moderate, High | MANAGE 4.1, MEASURE 2.7 (from SI-4) | §3.14.6 | |
| System-generated Alerts | Moderate, High | MANAGE 4.1, MEASURE 2.7 (from SI-4) | No mapping | |
| Visibility of Encrypted Communications | High | MANAGE 4.1, MEASURE 2.7 (from SI-4) | No mapping | |
| Automated Organization-generated Alerts | High | MANAGE 4.1, MEASURE 2.7 (from SI-4) | No mapping | |
| Wireless Intrusion Detection | High | MANAGE 4.1, MEASURE 2.7 (from SI-4) | No mapping | |
| Privileged Users | High | MANAGE 4.1, MEASURE 2.7 (from SI-4) | No mapping | |
| Unauthorized Network Services | High | MANAGE 4.1, MEASURE 2.7 (from SI-4) | No mapping | |
| Security Alerts, Advisories, and Directives | Low, Moderate, High | MEASURE 3.1, GOVERN 4.3 | §3.14.1, §3.14.2, §3.14.3 | |
| Automated Alerts and Advisories | High | MEASURE 3.1, GOVERN 4.3 (from SI-5) | No mapping | |
| Security and Privacy Function Verification | High | MEASURE 2.5, MEASURE 2.13 | No mapping | |
| Software, Firmware, and Information Integrity | Moderate, High | MEASURE 2.7, MANAGE 3.2 | No mapping | |
| Integrity Checks | Moderate, High | MEASURE 2.7, MANAGE 3.2 (from SI-7) | No mapping | |
| Automated Notifications of Integrity Violations | High | MEASURE 2.7, MANAGE 3.2 (from SI-7) | No mapping | |
| Automated Response to Integrity Violations | High | MEASURE 2.7, MANAGE 3.2 (from SI-7) | No mapping | |
| Integration of Detection and Response | Moderate, High | MEASURE 2.7, MANAGE 3.2 (from SI-7) | No mapping | |
| Code Authentication | High | MEASURE 2.7, MANAGE 3.2 (from SI-7) | No mapping | |
| Spam Protection | Moderate, High | No mapping | No mapping | |
| Automatic Updates | Moderate, High | No mapping | No mapping | |
| Information Input Validation | Moderate, High | MEASURE 2.7, MEASURE 2.5 | No mapping | |
| Error Handling | Moderate, High | MEASURE 2.5, MEASURE 2.6 | No mapping | |
| Information Management and Retention | Low, Moderate, High | MEASURE 2.10, GOVERN 1.7 | No mapping | |
| Predictable Failure Prevention | None | MEASURE 2.6, MANAGE 2.2 | No mapping | |
| Non-persistence | None | No mapping | No mapping | |
| Information Output Filtering | None | MEASURE 2.6, MEASURE 2.10 | No mapping | |
| Memory Protection | Moderate, High | MEASURE 2.7 | No mapping | |
| Fail-safe Procedures | None | MEASURE 2.6, MANAGE 2.4 | No mapping | |
| Personally Identifiable Information Quality Operations | None | MEASURE 2.10, MEASURE 2.5 | No mapping | |
| De-identification | None | MEASURE 2.10 | No mapping | |
| Tainting | None | MEASURE 2.7, MEASURE 2.10 | No mapping | |
| Information Refresh | None | MEASURE 2.5, MANAGE 2.2 | No mapping | |
| Information Diversity | None | MEASURE 2.7 | No mapping | |
| Information Fragmentation | None | MEASURE 2.10 | No mapping | |
- Low baseline
- Moderate baseline
- High baseline
Sources: NIST OSCAL content for SP 800-53 Rev 5; NIST SP 800-171 Rev 2; NIST AI RMF Playbook. Catalog last modified 2026-10-22.