IT Security ArchitectDESIGN REVIEW · THREAT MODEL · TRACE

NIST SP 800-53 vs. SP 800-171 Rev. 3, measured from the source data

Sheet FW-101Rev 0Published By IT Security Architect
How SP 800-171 Rev. 3 requirements trace to SP 800-53Left: the SP 800-53 Rev. 5 catalog with 324 base controls and 872 enhancements. Right: 97 active SP 800-171 Rev. 3 requirements. Lines show that the requirements list 155 distinct SP 800-53 controls as their sources.SP 800-53 Rev. 5324 base controls872 enhancements20 familiesSP 800-171 Rev. 397 active requirements33 withdrawn identifiers17 families155 source controls
Counts computed from NIST OSCAL releases. Drawing: IT Security Architect, original.

General notes

  1. SP 800-53 is a catalog of controls for federal information systems and organizations; SP 800-171 Rev. 3 is a set of requirements for protecting CUI in nonfederal systems.
  2. In NIST's machine-readable release, each of the 97 active SP 800-171 Rev. 3 requirements lists the SP 800-53 controls it was derived from, 155 distinct controls in total.
  3. All 155 of those source controls are in the SP 800-53 Moderate baseline.
  4. For design work, the source links let a contractor architect reuse 800-53 guidance, and let a federal architect see which controls a CUI-handling partner must also meet.

Most comparisons of these two publications restate their purpose and stop there. This one starts from NIST’s own machine-readable releases and measures the relationship. Every count on this page is computed by our build script from the OSCAL files listed in the references, so it changes when NIST’s data changes.

What is the difference between SP 800-53 and SP 800-171?

  • SP 800-53 Rev. 5 is a catalog of security and privacy controls for information systems and organizations. Federal agencies select from it using the baselines in SP 800-53B.[3][4]
  • SP 800-171 Rev. 3 sets security requirements for protecting Controlled Unclassified Information when it is held in nonfederal systems, typically by contractors. NIST published the final Rev. 3 on May 14, 2024; it supersedes Rev. 2 (January 28, 2021).[2]

The two are not alternatives. SP 800-171 is derived from SP 800-53, and Rev. 3 makes the derivation explicit.

How does SP 800-171 Rev. 3 derive from SP 800-53?

In the OSCAL release, every Rev. 3 requirement carries links to the SP 800-53 controls it came from.[1] Requirement 03.01.01 Account Management, for example, links to AC-2 Account Management, AC-2(3) Disable Accounts, AC-2(5) Inactivity Logout and AC-2(13) Disable Accounts for High-risk Individuals.

Computed from NIST OSCAL releases (SP 800-53 5.2.0; SP 800-171 Rev. 3 1.1.0).
MeasureValue
SP 800-171 Rev. 3 requirement identifiers130
Withdrawn identifiers33
Active requirements97
Families17
Distinct SP 800-53 source controls155 (113 base, 42 enhancements)
Source controls in the Moderate baseline155 of 155
Moderate baseline size (controls + enhancements)287
Requirements with exactly one source control66 of 97

Three findings stand out:

  1. The sources sit entirely in Moderate. All 155 distinct source controls are in the SP 800-53 Moderate baseline, as published in NIST’s baseline profile. The Moderate baseline has 287 controls and enhancements, so 132 Moderate controls are not a source for any SP 800-171 requirement.
  2. Most requirements map to one control. 66 of the 97 active requirements list exactly one source control. The largest is 03.15.01 Policy and Procedures, which lists 17: the “-1” policy-and-procedures control of each relevant family.
  3. Enhancements matter. 42 of the 155 sources are control enhancements, not base controls. A contractor who reads only base controls will miss them.
Inference, labeled

That all sources fall in the Moderate baseline is a computed fact. That Rev. 3 was therefore built from the Moderate baseline is our inference from the data, not a statement we are quoting from NIST.

How are the requirements organized?

Rev. 3 has 17 families. Access Control is the largest with 16 active requirements; Awareness and Training and Personnel Security have 2 each. Planning, System and Services Acquisition, and Supply Chain Risk Management each have 3.

Requirement identifiers keep their numbers when withdrawn, so gaps in numbering (03.01.13, 03.01.14, …) are expected. The OSCAL file marks 33 identifiers as withdrawn.

What does this mean for an architecture?

If you design contractor systems that handle CUI, the source links are a shortcut to better guidance. SP 800-53 controls come with discussion text and enhancements; when a Rev. 3 requirement is terse, read its sources. The crosswalk shows them for any control.

If you design federal systems that exchange CUI with contractors, the reverse view matters: of the controls you implement under Moderate, these 155 are the ones your contractor partners are also on the hook for. Interconnection agreements (CA-3 Information Exchange) are the natural place to make that explicit.

In a design review, trace findings once and report twice. The architecture review builder lists, for every SP 800-53 control it cites, the Rev. 3 requirements that use it as a source.

How does CSF 2.0 fit?

CSF 2.0 sits above both as an outcome framework. NIST’s informative references connect CSF 2.0 subcategories to SP 800-53 Rev. 5.2.0 controls and to SP 800-171 Rev. 3 requirements.[5] See the CSF 2.0 to SP 800-53 mapping guide.

Questions

How many requirements does SP 800-171 Rev. 3 have?

NIST's OSCAL release of Rev. 3 contains 130 requirement identifiers, of which 33 are marked withdrawn, leaving 97 active requirements in 17 families. Counts quoted elsewhere may describe Rev. 2, which Rev. 3 superseded in May 2024; check which revision a source means.

If I implement the SP 800-53 Moderate baseline, have I met SP 800-171 Rev. 3?

Not automatically. Every source control is in the Moderate baseline, but SP 800-171 Rev. 3 states its own requirements and assessment objectives, and organization-defined parameters may need specific values. Assess against SP 800-171 itself.

References

  1. SP 800-171 Rev. 3, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations (OSCAL). National Institute of Standards and Technology, 10/22/2026.Official standard (machine-readable) · checked 11/04/2026 (dataset)
  2. SP 800-171 Rev. 3 publication page. National Institute of Standards and Technology, 05/14/2024.Official standard · checked 11/04/2026 (page)
  3. SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations (OSCAL release 5.2.0). National Institute of Standards and Technology (Joint Task Force), 10/22/2026.Official standard (machine-readable) · checked 11/04/2026 (dataset)
  4. SP 800-53B control baselines (LOW, MODERATE, HIGH, PRIVACY profiles, OSCAL). National Institute of Standards and Technology, 10/22/2026.Official standard (machine-readable) · checked 11/04/2026 (dataset)
  5. CSF 2.0 Reference Tool: Informative References export. National Institute of Standards and Technology (CPRT), 11/03/2026.Official dataset · checked 11/04/2026 (dataset)

Revisions

RevDateDescription
0First issue.

Related sheets

More in Frameworks and controls.