VoltVerify™Compliance & Reliability Readiness PlatformVoltBreach

NIST · Shared reference library

NIST SP 800-53 Rev. 5 Common Control Library

Browse 1,193 controls and enhancements across 20 security and privacy families. Use the GovRAMP crosswalk to locate controls referenced by Security Snapshot, Core, and Moderate.

A shared catalog supports common-control planning; designation as a common, hybrid, or system-specific control depends on your organization’s implementation and inheritance decisions.

Sources and crosswalk scope

NIST OSCAL content 5.1.1+u4, retrieved 2026-09-18. GovRAMP Snapshot v1.4 and Core selection from Moderate v1.06 reference the December 2020 Rev. 5 text. Mappings establish exact identifier correspondence, not identical requirements, inherited implementation, or GovRAMP authorization. GovRAMP parameters and additional requirements remain authoritative for each program. Full Moderate, High, and other programs are not mapped here. Withdrawn controls are retained for reference.

Official pinned NIST source

SHA-256: 81cf2de45ede9aef3de7ce09d65ea9d32f662c483bbf916f6e346292b22f7763

GovRAMP readiness programsDownload GovRAMP crosswalk JSONManage organization crosswalk
Reset

8 matching controls · Page 1 of 1

Access Control · Enhancement

AC-3(10) · Audited Override of Access Control Mechanisms

View parent control
Control statement and discussion

NIST control statement

Employ an audited override of automated access control mechanisms under [Assignment: conditions] by [Assignment: roles].

Discussion

In certain situations, such as when there is a threat to human life or an event that threatens the organization’s ability to carry out critical missions or business functions, an override capability for access control mechanisms may be needed. Override conditions are defined by organizations and used only in those limited circumstances. Audit events are defined in [AU-2](#au-2) . Audit records are generated in [AU-12](#au-12).

GovRAMP crosswalk

Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.

Access Control · Enhancement

AC-4(26) · Audit Filtering Actions

View parent control
Control statement and discussion

NIST control statement

When transferring information between different security domains, record and audit content filtering actions and results for the information being filtered.

Discussion

Content filtering is the process of inspecting information as it traverses a cross-domain solution and determines if the information meets a predefined policy. Content filtering actions and the results of filtering actions are recorded for individual messages to ensure that the correct filter actions were applied. Content filter reports are used to assist in troubleshooting actions by, for example, determining why message content was modified and/or why it failed the filtering process. Audit events are defined in [AU-2](#au-2) . Audit records are generated in [AU-12](#au-12).

GovRAMP crosswalk

Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.

Audit and Accountability · Base control

AU-12 · Audit Record Generation

Control statement and discussion

NIST control statement

a. Provide audit record generation capability for the event types the system is capable of auditing as defined in [AU-2a](#au-2_smt.a) on [Assignment: system components]; b. Allow [Assignment: personnel or roles] to select the event types that are to be logged by specific components of the system; and c. Generate audit records for the event types defined in [AU-2c](#au-2_smt.c) that include the audit record content defined in [AU-3](#au-3).

Discussion

Audit records can be generated from many different system components. The event types specified in [AU-2d](#au-2_smt.d) are the event types for which audit logs are to be generated and are a subset of all event types for which the system can generate audit records.

GovRAMP crosswalk

Audit and Accountability · Enhancement

AU-12(1) · System-wide and Time-correlated Audit Trail

View parent control
Control statement and discussion

NIST control statement

Compile audit records from [Assignment: system components] into a system-wide (logical or physical) audit trail that is time-correlated to within [Assignment: level of tolerance].

Discussion

Audit trails are time-correlated if the time stamps in the individual audit records can be reliably related to the time stamps in other audit records to achieve a time ordering of the records within organizational tolerances.

GovRAMP crosswalk

Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.

Audit and Accountability · Enhancement

AU-12(2) · Standardized Formats

View parent control
Control statement and discussion

NIST control statement

Produce a system-wide (logical or physical) audit trail composed of audit records in a standardized format.

Discussion

Audit records that follow common standards promote interoperability and information exchange between devices and systems. Promoting interoperability and information exchange facilitates the production of event information that can be readily analyzed and correlated. If logging mechanisms do not conform to standardized formats, systems may convert individual audit records into standardized formats when compiling system-wide audit trails.

GovRAMP crosswalk

Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.

Audit and Accountability · Enhancement

AU-12(3) · Changes by Authorized Individuals

View parent control
Control statement and discussion

NIST control statement

Provide and implement the capability for [Assignment: individuals or roles] to change the logging to be performed on [Assignment: system components] based on [Assignment: selectable event criteria] within [Assignment: time thresholds].

Discussion

Permitting authorized individuals to make changes to system logging enables organizations to extend or limit logging as necessary to meet organizational requirements. Logging that is limited to conserve system resources may be extended (either temporarily or permanently) to address certain threat situations. In addition, logging may be limited to a specific set of event types to facilitate audit reduction, analysis, and reporting. Organizations can establish time thresholds in which logging actions are changed (e.g., near real-time, within minutes, or within hours).

GovRAMP crosswalk

Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.

Audit and Accountability · Enhancement

AU-12(4) · Query Parameter Audits of Personally Identifiable Information

View parent control
Control statement and discussion

NIST control statement

Provide and implement the capability for auditing the parameters of user query events for data sets containing personally identifiable information.

Discussion

Query parameters are explicit criteria that an individual or automated system submits to a system to retrieve data. Auditing of query parameters for datasets that contain personally identifiable information augments the capability of an organization to track and understand the access, usage, or sharing of personally identifiable information by authorized personnel.

GovRAMP crosswalk

Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.

System and Information Integrity · Base control

SI-12 · Information Management and Retention

Control statement and discussion

NIST control statement

Manage and retain information within the system and information output from the system in accordance with applicable laws, executive orders, directives, regulations, policies, standards, guidelines and operational requirements.

Discussion

Information management and retention requirements cover the full life cycle of information, in some cases extending beyond system disposal. Information to be retained may also include policies, procedures, plans, reports, data output from control implementation, and other types of administrative information. The National Archives and Records Administration (NARA) provides federal policy and guidance on records retention and schedules. If organizations have a records management office, consider coordinating with records management personnel. Records produced from the output of implemented controls that may require management and retention include, but are not limited to: All XX-1, [AC-6(9)](#ac-6.9), [AT-4](#at-4), [AU-12](#au-12), [CA-2](#ca-2), [CA-3](#ca-3), [CA-5](#ca-5), [CA-6](#ca-6), [CA-7](#ca-7), [CA-8](#ca-8), [CA-9](#ca-9), [CM-2](#cm-2), [CM-3](#cm-3), [CM-4](#cm-4), [CM-6](#cm-6), [CM-8](#cm-8), [CM-9](#cm-9), [CM-12](#cm-12), [CM-13](#cm-13), [CP-2](#cp-2), [IR-6](#ir-6), [IR-8](#ir-8), [MA-2](#ma-2), [MA-4](#ma-4), [PE-2](#pe-2), [PE-8](#pe-8), [PE-16](#pe-16), [PE-17](#pe-17), [PL-2](#pl-2), [PL-4](#pl-4), [PL-7](#pl-7), [PL-8](#pl-8), [PM-5](#pm-5), [PM-8](#pm-8), [PM-9](#pm-9), [PM-18](#pm-18), [PM-21](#pm-21), [PM-27](#pm-27), [PM-28](#pm-28), [PM-30](#pm-30), [PM-31](#pm-31), [PS-2](#ps-2), [PS-6](#ps-6), [PS-7](#ps-7), [PT-2](#pt-2), [PT-3](#pt-3), [PT-7](#pt-7), [RA-2](#ra-2), [RA-3](#ra-3), [RA-5](#ra-5), [RA-8](#ra-8), [SA-4](#sa-4), [SA-5](#sa-5), [SA-8](#sa-8), [SA-10](#sa-10), [SI-4](#si-4), [SR-2](#sr-2), [SR-4](#sr-4), [SR-8](#sr-8).

GovRAMP crosswalk