The CSF 2.0 to SP 800-53 mapping, and how to use it in design
General notes
- NIST publishes the mapping itself, as informative references in its CSF 2.0 Reference Tool. Use that export, not a third-party copy.
- Every one of the 106 CSF 2.0 subcategories has at least one SP 800-53 reference; together there are 737 control-level references to 210 distinct controls.
- The references cluster in GOVERN and IDENTIFY. DETECT, RESPOND and RECOVER have far fewer.
- A mapping says two things are related. It does not say that implementing the control achieves the outcome, or the reverse.
CSF 2.0 describes outcomes (“the organizational mission is understood and informs cybersecurity risk management”). SP 800-53 describes controls (“develop security and privacy architectures for the system”). Architects work in the second language and report in the first. NIST connects the two with informative references, and publishes them through the CPRT.[2]
Where does the official mapping come from?
The CSF 2.0 Reference Tool exports every subcategory with its informative references, from NIST and from other organizations.[1] This site uses only the NIST-authored ones: references to SP 800-53 Rev. 5.2.0 and to SP 800-171 Rev. 3. The export we used was generated on November 3, 2026.
The structure of CSF 2.0 itself comes from NIST’s OSCAL catalog: six functions, their categories, and 106 active subcategories.[3]
What does the mapping contain?
| Function | Subcategories | SP 800-53 refs | SP 800-171 r3 refs |
|---|---|---|---|
| Govern (GV) | 31 | 239 | 66 |
| Identify (ID) | 21 | 204 | 77 |
| Protect (PR) | 22 | 170 | 89 |
| Detect (DE) | 11 | 60 | 35 |
| Respond (RS) | 13 | 42 | 31 |
| Recover (RC) | 8 | 22 | 12 |
| Total | 106 | 737 | 310 |
210 distinct SP 800-53 controls referenced, 17 of them enhancements.
Some patterns are useful to know before you rely on it:
- Coverage is complete but uneven. Every subcategory has at least one SP 800-53 reference, but 11 have exactly one. GV.OC-01 (mission understood) maps only to
PM-11Mission and Business Process Definition. - The heaviest subcategories are about improvement and supply chain. ID.IM-02 has 40 references, ID.IM-03 39 and ID.IM-01 37; GV.SC-03 has 28.
- A few references point at whole families. GV.OC-03 references the PT family, and PR.IR-03 references the CP and IR families, rather than individual controls. Our tools show these separately.
- Enhancements are rare. Of the 210 distinct controls referenced, 17 are enhancements. Multi-factor authentication for privileged accounts,
IA-2(1)Multi-factor Authentication to Privileged Accounts, is not referenced at all; its base controlIA-2Identification and Authentication (Organizational Users) is, under PR.AA-01 and PR.AA-03. Expect to reach enhancements through their base controls.
How should an architect use it?
To translate findings upward. A gap against SC-7 Boundary Protection in a design review can be reported to leadership against the CSF subcategories that reference SC-7. The architecture review builder does this lookup for every control it cites.
To check that a design covers the outcomes the organization has prioritized. If an organizational profile targets PR.AA (identity and access), the referenced controls are the starting checklist for the design. The crosswalk lists them per subcategory.
Not as proof. The mapping does not establish that implementing the referenced controls achieves the outcome. Treat it as “these are the controls to look at,” then judge.
The CPRT export also contains references contributed by other organizations, for example to ISO/IEC 27001, PCI DSS and the CSA Cloud Controls Matrix. Those documents carry their own licenses, so this site does not reproduce them. NIST’s own data is a U.S. government work.
Reading the identifiers
- CSF:
GV(function) .OC(category)-01(subcategory). Functions are GOVERN, IDENTIFY, PROTECT, DETECT, RESPOND and RECOVER. - SP 800-53:
AC(family)-2(control)(3)(enhancement). The CPRT export zero-pads numbers (AC-02); this site shows them unpadded (AC-2), as in the catalog’s labels. - SP 800-171 Rev. 3:
03.01.01, where03.01is the family (Access Control).
References
- CSF 2.0 Reference Tool: Informative References export. National Institute of Standards and Technology (CPRT), 11/03/2026.Official dataset · checked 11/04/2026 (dataset)
- Informative References (CSF 2.0). National Institute of Standards and Technology.Official documentation · checked 11/04/2026 (page)
- The NIST Cybersecurity Framework (CSF) 2.0 (OSCAL catalog). National Institute of Standards and Technology, 10/22/2026.Official framework (machine-readable) · checked 11/04/2026 (dataset)
- SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations (OSCAL release 5.2.0). National Institute of Standards and Technology (Joint Task Force), 10/22/2026.Official standard (machine-readable) · checked 11/04/2026 (dataset)
Revisions
| Rev | Date | Description |
|---|---|---|
| 0 | First issue. |
Related sheets
How SP 800-171 Rev. 3 derives from SP 800-53, with counts computed from NIST's OSCAL releases, the source-control links, and what that means for system design.
A practical workflow for security design reviews, from scoping and diagrams to findings traced to NIST SP 800-53, CSF 2.0 and SP 800-171 controls.
How to apply STRIDE per element to a data-flow diagram, with a worked example of a document upload service and candidate NIST SP 800-53 controls for each threat.
More in Frameworks and controls.