Skip to main content
NIST 800-53 is the catalog of security and privacy controls used by US federal information systems. If you sell SaaS to federal contractors, defense contractors, or directly to agencies, you’ll encounter it in two ways:
  1. Indirectly — via FISMA, FedRAMP, DoD CMMC, and HIPAA all of which derive from 800-53
  2. Directly — when a federal customer requires you implement specific 800-53 controls in your environment
The catalog has 1,189 controls across 20 control families. You don’t implement all of them — you scope to a baseline (Low / Moderate / High) based on the impact level of the data you handle.

​
Baselines

BaselineControl countUse case
Low~149 controlsPublic-facing data, low-impact systems
Moderate~287 controlsInternal data, most SaaS scenarios — the default for FedRAMP Moderate
High~370 controlsSensitive data, mission-critical systems — military, intelligence
For most SaaS companies entering the federal market, Moderate is the target. It maps closely to FedRAMP Moderate and CMMC Level 2.

​
How Codex maps the high-leverage families

​
AC — Access Control (25 controls in Moderate baseline)

ControlCodex evidence
AC-2 Account ManagementIdP user lifecycle (provisioning, modification, termination logs from Google Workspace, M365, Okta)
AC-3 Access EnforcementApp-level role assignments + RLS policy reviews from cloud connector
AC-6 Least PrivilegePrivileged-access reports per app (admin counts, named admins)
AC-7 Unsuccessful Logon AttemptsIdP failed-auth event volume from SIEM connector
AC-11 Session LockMDM screen-lock policy enforcement (FileVault auto-lock, BitLocker session timeout)
AC-17 Remote AccessVPN config + session logs from cloud or VPN connector

​
AU — Audit and Accountability (12 controls in Moderate)

ControlEvidence
AU-2 Event LoggingSIEM connector event coverage report — what’s logged, what isn’t
AU-4 Audit Storage CapacityCloud-storage retention configs for log archives
AU-9 Protection of Audit InformationCloudTrail / Activity Log immutability config
AU-12 Audit Record GenerationPer-system logging-enabled audit (each cloud account, each prod service)

​
CM — Configuration Management (10 controls in Moderate)

ControlEvidence
CM-2 Baseline ConfigurationTerraform/IaC commit history — your declared baseline
CM-3 Configuration Change ControlMerged PR records with reviewer + CI status
CM-7 Least FunctionalityCloud security group config (open ports, allowed protocols)
CM-8 System Component InventoryThe thing Layer is for. Every device, app, license, user, with timestamps.

​
CP — Contingency Planning (9 controls in Moderate)

ControlEvidence
CP-2 Contingency PlanLinked Notion / Google Doc + last review timestamp
CP-9 System BackupBackup snapshot history from cloud connector
CP-10 System RecoveryRestore-test results (manually uploaded with timestamp + tester identity)

​
IA — Identification and Authentication (12 controls in Moderate)

ControlEvidence
IA-2 Identification and AuthenticationIdP MFA enforcement reports
IA-5 Authenticator ManagementPassword policy config + rotation enforcement
IA-8 Identification and Authentication (Non-Org Users)External-user inventory (Slack-Connect, GitHub outside collaborators, etc.)

​
IR — Incident Response (9 controls in Moderate)

ControlEvidence
IR-4 Incident HandlingPer-incident timeline from PagerDuty / Linear / Jira
IR-5 Incident MonitoringAggregate incident metrics (volume, severity, MTTR per quarter)
IR-8 Incident Response PlanLinked plan + last review timestamp

​
RA — Risk Assessment (5 controls in Moderate)

ControlEvidence
RA-3 Risk AssessmentLinked risk register + last update timestamp
RA-5 Vulnerability Monitoring and ScanningSnyk/Wiz/Dependabot findings + remediation timelines per severity

​
SC — System and Communications Protection (24 controls in Moderate)

ControlEvidence
SC-7 Boundary ProtectionCloud security groups + WAF config
SC-8 Transmission ConfidentialityTLS coverage report
SC-13 Cryptographic ProtectionKMS config + algorithms in use
SC-28 Protection of Information at RestAt-rest encryption config across all data stores

​
SI — System and Information Integrity (15 controls in Moderate)

ControlEvidence
SI-2 Flaw RemediationPatch management cadence (OS patch level from MDM, dependency-update PRs)
SI-3 Malicious Code ProtectionEDR coverage from CrowdStrike / SentinelOne
SI-4 System MonitoringSIEM event collection coverage + alert rules

​
What Codex doesn’t replace

NIST 800-53 has a heavy policy + process component that Codex doesn’t auto-generate:
  • PL Planning controls — your System Security Plan (SSP) is a 100+ page document describing every control’s implementation. Codex provides the evidence; you write the prose.
  • PM Program Management controls — organization-wide program (CISO function, threat awareness program, etc.). Pure organizational design.
  • PS Personnel Security controls — background checks, position designation. HR-system data, mostly manual.
Codex’s role: provide the technical evidence for ~70% of the catalog. Your security team writes the SSP, conducts the assessments, and engages the assessor.

​
Connection to FedRAMP

If you want to sell to federal agencies directly (not just contractors), you need FedRAMP authorization — a formal third-party assessment of your 800-53 implementation. Three paths:
  1. FedRAMP Tailored — for low-impact SaaS (think: simple form-collection apps). ~120 controls. ~6 months, ~$50K-100K.
  2. FedRAMP Moderate — the default for most B2B SaaS to federal. ~325 controls. ~12-18 months, ~$300K-500K.
  3. FedRAMP High — only for sensitive workloads. ~410 controls. ~18-24 months, ~$500K-1M.
See the FedRAMP guide for the authorization workflow.

​
When you’re ready

Reports → NIST 800-53 evidence package outputs:
  • Per-control implementation evidence with timestamps
  • Control inheritance map (which controls rely on which CSP — AWS GovCloud, Azure Government — vs your application’s implementation)
  • Continuous monitoring metrics (the ConMon report federal customers expect monthly)
  • Plan of Action and Milestones (POAM) for any controls you’ve documented as exceptions