VoltVerify™Compliance & Reliability Readiness PlatformVoltBreach

NIST · Shared reference library

NIST SP 800-53 Rev. 5 Common Control Library

Browse 1,193 controls and enhancements across 20 security and privacy families. Use the GovRAMP crosswalk to locate controls referenced by Security Snapshot, Core, and Moderate.

A shared catalog supports common-control planning; designation as a common, hybrid, or system-specific control depends on your organization’s implementation and inheritance decisions.

Sources and crosswalk scope

NIST OSCAL content 5.1.1+u4, retrieved 2026-09-18. GovRAMP Snapshot v1.4 and Core selection from Moderate v1.06 reference the December 2020 Rev. 5 text. Mappings establish exact identifier correspondence, not identical requirements, inherited implementation, or GovRAMP authorization. GovRAMP parameters and additional requirements remain authoritative for each program. Full Moderate, High, and other programs are not mapped here. Withdrawn controls are retained for reference.

Official pinned NIST source

SHA-256: 81cf2de45ede9aef3de7ce09d65ea9d32f662c483bbf916f6e346292b22f7763

GovRAMP readiness programsDownload GovRAMP crosswalk JSONManage organization crosswalk
Reset

1011 matching controls · Page 41 of 41

Supply Chain Risk Management · Enhancement

SR-6(1) · Testing and Analysis

View parent control
Control statement and discussion

NIST control statement

Employ [Selection (one-or-more): organizational analysis; independent third-party analysis; organizational testing; independent third-party testing] of the following supply chain elements, processes, and actors associated with the system, system component, or system service: [Assignment: supply chain elements, processes, and actors].

Discussion

Relationships between entities and procedures within the supply chain, including development and delivery, are considered. Supply chain elements include organizations, entities, or tools that are used for the research and development, design, manufacturing, acquisition, delivery, integration, operations, maintenance, and disposal of systems, system components, or system services. Supply chain processes include supply chain risk management programs; SCRM strategies and implementation plans; personnel and physical security programs; hardware, software, and firmware development processes; configuration management tools, techniques, and measures to maintain provenance; shipping and handling procedures; and programs, processes, or procedures associated with the production and distribution of supply chain elements. Supply chain actors are individuals with specific roles and responsibilities in the supply chain. The evidence generated and collected during analyses and testing of supply chain elements, processes, and actors is documented and used to inform organizational risk management activities and decisions.

GovRAMP crosswalk

Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.

Supply Chain Risk Management · Base control

SR-7 · Supply Chain Operations Security

Control statement and discussion

NIST control statement

Employ the following Operations Security (OPSEC) controls to protect supply chain-related information for the system, system component, or system service: [Assignment: OPSEC controls].

Discussion

Supply chain OPSEC expands the scope of OPSEC to include suppliers and potential suppliers. OPSEC is a process that includes identifying critical information, analyzing friendly actions related to operations and other activities to identify actions that can be observed by potential adversaries, determining indicators that potential adversaries might obtain that could be interpreted or pieced together to derive information in sufficient time to cause harm to organizations, implementing safeguards or countermeasures to eliminate or reduce exploitable vulnerabilities and risk to an acceptable level, and considering how aggregated information may expose users or specific uses of the supply chain. Supply chain information includes user identities; uses for systems, system components, and system services; supplier identities; security and privacy requirements; system and component configurations; supplier processes; design specifications; and testing and evaluation results. Supply chain OPSEC may require organizations to withhold mission or business information from suppliers and may include the use of intermediaries to hide the end use or users of systems, system components, or system services.

GovRAMP crosswalk

Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.

Supply Chain Risk Management · Base control

SR-8 · Notification Agreements

Control statement and discussion

NIST control statement

Establish agreements and procedures with entities involved in the supply chain for the system, system component, or system service for the [Selection (one-or-more): notification of supply chain compromises; [Assignment: results of assessments or audits] ].

Discussion

The establishment of agreements and procedures facilitates communications among supply chain entities. Early notification of compromises and potential compromises in the supply chain that can potentially adversely affect or have adversely affected organizational systems or system components is essential for organizations to effectively respond to such incidents. The results of assessments or audits may include open-source information that contributed to a decision or result and could be used to help the supply chain entity resolve a concern or improve its processes.

GovRAMP crosswalk

Supply Chain Risk Management · Base control

SR-9 · Tamper Resistance and Detection

Control statement and discussion

NIST control statement

Implement a tamper protection program for the system, system component, or system service.

Discussion

Anti-tamper technologies, tools, and techniques provide a level of protection for systems, system components, and services against many threats, including reverse engineering, modification, and substitution. Strong identification combined with tamper resistance and/or tamper detection is essential to protecting systems and components during distribution and when in use.

GovRAMP crosswalk

Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.

Supply Chain Risk Management · Enhancement

SR-9(1) · Multiple Stages of System Development Life Cycle

View parent control
Control statement and discussion

NIST control statement

Employ anti-tamper technologies, tools, and techniques throughout the system development life cycle.

Discussion

The system development life cycle includes research and development, design, manufacturing, acquisition, delivery, integration, operations and maintenance, and disposal. Organizations use a combination of hardware and software techniques for tamper resistance and detection. Organizations use obfuscation and self-checking to make reverse engineering and modifications more difficult, time-consuming, and expensive for adversaries. The customization of systems and system components can make substitutions easier to detect and therefore limit damage.

GovRAMP crosswalk

Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.

Supply Chain Risk Management · Base control

SR-10 · Inspection of Systems or Components

Control statement and discussion

NIST control statement

Inspect the following systems or system components [Selection (one-or-more): at random; at [Assignment: frequency] ; upon [Assignment: indications of need for inspection] ] to detect tampering: [Assignment: systems or system components].

Discussion

The inspection of systems or systems components for tamper resistance and detection addresses physical and logical tampering and is applied to systems and system components removed from organization-controlled areas. Indications of a need for inspection include changes in packaging, specifications, factory location, or entity in which the part is purchased, and when individuals return from travel to high-risk locations.

GovRAMP crosswalk

Supply Chain Risk Management · Base control

SR-11 · Component Authenticity

Control statement and discussion

NIST control statement

a. Develop and implement anti-counterfeit policy and procedures that include the means to detect and prevent counterfeit components from entering the system; and b. Report counterfeit system components to [Selection (one-or-more): source of counterfeit component; [Assignment: external reporting organizations] ; [Assignment: personnel or roles] ].

Discussion

Sources of counterfeit components include manufacturers, developers, vendors, and contractors. Anti-counterfeiting policies and procedures support tamper resistance and provide a level of protection against the introduction of malicious code. External reporting organizations include CISA.

GovRAMP crosswalk

Supply Chain Risk Management · Enhancement

SR-11(1) · Anti-counterfeit Training

View parent control
Control statement and discussion

NIST control statement

Train [Assignment: personnel or roles] to detect counterfeit system components (including hardware, software, and firmware).

Discussion

None.

GovRAMP crosswalk

Supply Chain Risk Management · Enhancement

SR-11(2) · Configuration Control for Component Service and Repair

View parent control
Control statement and discussion

NIST control statement

Maintain configuration control over the following system components awaiting service or repair and serviced or repaired components awaiting return to service: [Assignment: system components].

Discussion

None.

GovRAMP crosswalk

Supply Chain Risk Management · Enhancement

SR-11(3) · Anti-counterfeit Scanning

View parent control
Control statement and discussion

NIST control statement

Scan for counterfeit system components [Assignment: frequency].

Discussion

The type of component determines the type of scanning to be conducted (e.g., web application scanning if the component is a web application).

GovRAMP crosswalk

Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.

Supply Chain Risk Management · Base control

SR-12 · Component Disposal

Control statement and discussion

NIST control statement

Dispose of [Assignment: data, documentation, tools, or system components] using the following techniques and methods: [Assignment: techniques and methods].

Discussion

Data, documentation, tools, or system components can be disposed of at any time during the system development life cycle (not only in the disposal or retirement phase of the life cycle). For example, disposal can occur during research and development, design, prototyping, or operations/maintenance and include methods such as disk cleaning, removal of cryptographic keys, partial reuse of components. Opportunities for compromise during disposal affect physical and logical data, including system documentation in paper-based or digital files; shipping and delivery documentation; memory sticks with software code; or complete routers or servers that include permanent media, which contain sensitive or proprietary information. Additionally, proper disposal of system components helps to prevent such components from entering the gray market.

GovRAMP crosswalk