Topic · nist-800-53

NIST SP 800-53

NIST SP 800-53 control catalog — the federal baseline that FedRAMP and FISMA layer on top of.

RSS feed ↗

trade-press
NIST and CISA finalize token-fraud guidance for federal agencies
A mandate first written under Biden and preserved in Trump's 2025 cyber executive order produced a final interagency report that 250 public comments and a year of industry consultation shaped, rare continuity on identity-layer defense.
NIST and CISA released the final version of NIST IR 8587 on September 15, 2026, giving federal agencies and cloud service providers implementation guidance on protecting identity tokens and assertions from forgery, theft, and misuse. The publication expands on NIST SP 800-53 controls and incorporates nearly 250 public comments on token validation, secrets management, and detection. New in the final version: outcome-based cryptographic key guidance, high-level considerations for AI and post-quantum cryptography migration, and expanded options for token revocation and signal-sharing.
SEP 16
trade-press
NIST eyes late-September release for first AI security overlays
The agentic AI overlay is furthest along inside NIST's Center for AI Standards and Innovation, and for good reason. Prompt injection that tricks a model into deleting a codebase isn't theoretical, Vassilev said; attacks of that kind have already been seen.
NIST expects to release the first two draft publications in its Control Overlays for Securing AI Systems (COSAiS) series in late September, according to research supervisor Apostol Vassilev. The series adapts SP 800-53 controls for five AI use cases: predictive AI, generative AI, single-agent and multi-agent systems, and AI developer controls. The first release pairs a methodology overview with an overlay on using and fine-tuning predictive AI. Drafts on the remaining use cases will follow on an unspecified timeline. The overlays are provided as a starting point, NIST's FAQ states organizations aren't required to use them.
SEP 10
trade-press
NSPM-12 strips agency waiver power, puts NSA in command
For the first time, a presidential memorandum eliminates unilateral exemption authority across three branches of federal cybersecurity governance and converts NSA from advisor to enforcement officer.
The White House's NSPM-12, issued in June, rescinds the waiver process that let agency heads unilaterally disregard CNSS cybersecurity directives on national security systems. NSA can now order (not just advise) DoD, IC, and FCEB agencies to implement uniform NIST SP 800-53-aligned controls, including cross-domain solutions for separating classification levels. Agencies that object must escalate to CNSS adjudication; self-exemption is dead. The memo also grants the national manager emergency directive authority over any NSS where a threat is "reasonably suspected," with broad latitude on response actions.
AUG 10
regulator
Fishers First City to Adopt GovRAMP Procurement Preference
The Indianapolis suburb is the first municipality to adopt the nonprofit's "verify once, serve many" model, testing whether state-level momentum translates to city procurement.
The City of Fishers will give preferential awards to cloud service vendors that comply with GovRAMP certification for all contracts entered or renewed on or after January 1, 2024. Vendors selling cloud services to Fishers must enroll in GovRAMP's Progressing Snapshot Program at minimum to remain competitive. The adoption marks the first municipal procurement preference for GovRAMP, signaling whether the nonprofit's "verify once, serve many" credential reciprocity model, already in use at the state level, can reshape vendor behavior at the city scale.
JUL 26
regulator
Chandler mandates GovRAMP authorization within 18 months for cloud contractors
Chandler is the first municipal government to make GovRAMP authorization a binding contract term, Ready in 12 months, Authorized in 18, or the deal's off.
The City of Chandler now requires cloud service contractors handling city data to achieve GovRAMP Ready status within 12 months of contract execution and full Authorized status within 18 months. Contractors without either designation at signing must submit a Security Snapshot within three months and provide monthly progress reports. Chandler sponsors contractors through the process, but missing the 18-month deadline means breach of contract, and likely termination. Chandler, a GovRAMP participant since 2022, is the first municipality to mandate the framework across all cloud products at category-level specificity.
JUL 26
regulator
Oregon adopts GovRAMP for state cloud security vetting
Vendors may need Authorized status, interim badges may satisfy requirements, but Oregon hasn't said how fast or what happens if they don't.
Oregon has adopted GovRAMP (the FedRAMP-aligned, NIST SP 800-53 moderate verification framework) as its mechanism for vetting cloud service offerings in covered procurements. The policy states Oregon "may require" a vendor to reach GovRAMP Authorized status within a defined post-contract timeframe; interim designations "may be accepted" as placeholders until full authorization is achieved. Oregon is one of eleven states now using the program, which is vendor-funded and includes continuous monitoring for the contract lifecycle. The conditional language leaves the enforcement clock and any penalties unspecified.
JUL 26
regulator
North Carolina Cloud Contracts Require GovRAMP by April 1
Six weeks out from the deadline, North Carolina hasn't specified which GovRAMP tier satisfies its new cloud contract mandate.
North Carolina's Department of Information Technology will require GovRAMP authorization for all new executive-branch contracts with cloud components starting April 1, 2026. The mandate, announced February 18, aligns with NIST 800-53 security controls and applies to IaaS, PaaS, and SaaS providers. Authorization is transferable across state agencies: a vendor verified once can serve any participating North Carolina agency. But with roughly six weeks between announcement and deadline, and no word yet on which GovRAMP tier satisfies the requirement, vendors without a prior FedRAMP or state authorization face a narrow path.
JUL 26
regulator
Nevada Mandates GovRAMP Core for Cloud Contracts
Nevada's new cloud security mandate requires GovRAMP Core. SOC 2, ISO 27001, TXRAMP, and HITRUST won't cut it.
Starting July 1, 2026, all new Nevada executive-branch cloud contracts must include GovRAMP Core certification at minimum, the state's Government Technology Office announced. The mandate, built on NIST SP 800-53 Rev 5, covers all three cloud service models. Vendors get a 12-month on-ramp from contract execution to achieve Core; FedRAMP Rev 5 holders can use a Fast Track process. As of July 1, 2028, the on-ramp disappears. Nevada explicitly rejects TXRAMP, SOC 2, ISO 27001, and HITRUST as substitutes.
JUL 26