Topic · nist-800-53

NIST SP 800-53

NIST SP 800-53 control catalog — the federal baseline that FedRAMP and FISMA layer on top of.

RSS feed ↗

trade-press
NSPM-12 strips agency waiver power, puts NSA in command
For the first time, a presidential memorandum eliminates unilateral exemption authority across three branches of federal cybersecurity governance and converts NSA from advisor to enforcement officer.
The White House's NSPM-12, issued in June, rescinds the waiver process that let agency heads unilaterally disregard CNSS cybersecurity directives on national security systems. NSA can now order (not just advise) DoD, IC, and FCEB agencies to implement uniform NIST SP 800-53-aligned controls, including cross-domain solutions for separating classification levels. Agencies that object must escalate to CNSS adjudication; self-exemption is dead. The memo also grants the national manager emergency directive authority over any NSS where a threat is "reasonably suspected," with broad latitude on response actions.
AUG 10
regulator
Fishers First City to Adopt GovRAMP Procurement Preference
The Indianapolis suburb is the first municipality to adopt the nonprofit's "verify once, serve many" model, testing whether state-level momentum translates to city procurement.
The City of Fishers will give preferential awards to cloud service vendors that comply with GovRAMP certification for all contracts entered or renewed on or after January 1, 2024. Vendors selling cloud services to Fishers must enroll in GovRAMP's Progressing Snapshot Program at minimum to remain competitive. The adoption marks the first municipal procurement preference for GovRAMP, signaling whether the nonprofit's "verify once, serve many" credential reciprocity model, already in use at the state level, can reshape vendor behavior at the city scale.
JUL 26
regulator
Chandler mandates GovRAMP authorization within 18 months for cloud contractors
Chandler is the first municipal government to make GovRAMP authorization a binding contract term, Ready in 12 months, Authorized in 18, or the deal's off.
The City of Chandler now requires cloud service contractors handling city data to achieve GovRAMP Ready status within 12 months of contract execution and full Authorized status within 18 months. Contractors without either designation at signing must submit a Security Snapshot within three months and provide monthly progress reports. Chandler sponsors contractors through the process, but missing the 18-month deadline means breach of contract, and likely termination. Chandler, a GovRAMP participant since 2022, is the first municipality to mandate the framework across all cloud products at category-level specificity.
JUL 26
regulator
Oregon adopts GovRAMP for state cloud security vetting
Vendors may need Authorized status, interim badges may satisfy requirements, but Oregon hasn't said how fast or what happens if they don't.
Oregon has adopted GovRAMP (the FedRAMP-aligned, NIST SP 800-53 moderate verification framework) as its mechanism for vetting cloud service offerings in covered procurements. The policy states Oregon "may require" a vendor to reach GovRAMP Authorized status within a defined post-contract timeframe; interim designations "may be accepted" as placeholders until full authorization is achieved. Oregon is one of eleven states now using the program, which is vendor-funded and includes continuous monitoring for the contract lifecycle. The conditional language leaves the enforcement clock and any penalties unspecified.
JUL 26
regulator
North Carolina Cloud Contracts Require GovRAMP by April 1
Six weeks out from the deadline, North Carolina hasn't specified which GovRAMP tier satisfies its new cloud contract mandate.
North Carolina's Department of Information Technology will require GovRAMP authorization for all new executive-branch contracts with cloud components starting April 1, 2026. The mandate, announced February 18, aligns with NIST 800-53 security controls and applies to IaaS, PaaS, and SaaS providers. Authorization is transferable across state agencies: a vendor verified once can serve any participating North Carolina agency. But with roughly six weeks between announcement and deadline, and no word yet on which GovRAMP tier satisfies the requirement, vendors without a prior FedRAMP or state authorization face a narrow path.
JUL 26
regulator
Nevada Mandates GovRAMP Core for Cloud Contracts
Nevada's new cloud security mandate requires GovRAMP Core. SOC 2, ISO 27001, TXRAMP, and HITRUST won't cut it.
Starting July 1, 2026, all new Nevada executive-branch cloud contracts must include GovRAMP Core certification at minimum, the state's Government Technology Office announced. The mandate, built on NIST SP 800-53 Rev 5, covers all three cloud service models. Vendors get a 12-month on-ramp from contract execution to achieve Core; FedRAMP Rev 5 holders can use a Fast Track process. As of July 1, 2028, the on-ramp disappears. Nevada explicitly rejects TXRAMP, SOC 2, ISO 27001, and HITRUST as substitutes.
JUL 26

NIST SP 800-53

NSPM-12 strips agency waiver power, puts NSA in command

Fishers First City to Adopt GovRAMP Procurement Preference

Chandler mandates GovRAMP authorization within 18 months for cloud contractors

Oregon adopts GovRAMP for state cloud security vetting

North Carolina Cloud Contracts Require GovRAMP by April 1

Nevada Mandates GovRAMP Core for Cloud Contracts