What does the NIST SP 800-53 provide?

• A. A catalog of controls that support the development of secure and resilient federal information systems.
• B. A framework for evaluating software licenses and vendor compliance.
• C. A set of best practices for open-source software.
• D. A standard for physical security of federal facilities.

Answer: (A)

Security and privacy controls for federal information systems are organized into a comprehensive catalog in this guide. It provides a wide menu of controls that agencies can select, tailor, and implement based on the system’s risk and impact level, supporting risk management and continuous monitoring within the federal framework. The controls cover areas like access management, incident response, contingency planning, risk assessment, and system integrity, all aimed at protecting confidentiality, integrity, and availability. This catalog is meant to be applied through a formal process (the Risk Management Framework) to build a secure and resilient information environment.

This isn’t about evaluating software licenses or vendor compliance, nor is it a general best-practices guide for open-source software. It also isn’t a stand-alone standard for physical security of facilities; those concerns are handled by different standards and guidance.