NIST SP 800-53

1. Access Control

How the organization manages access to systems to ensure only authorized users have appropriate permissions

2. Awareness and Training

How the organization delivers privacy training to employees to raise awareness of risks and proper behaviors

3. Audit and Accountability

How the organization tracks and monitors system activities to detect and respond to security events

4. Assessment, Authorization, and Monitoring

How the organization assess security controls, authorizes systems for operation, and continuously monitors for threats

5. Configuration Management

How assets and software are securely configured and maintained to prevent vulnerabilities

6. Contingency Planning

How the organization prepares for and recovers from system outages and disasters

7. Identification and Authentication

How users and devices are identified and authenticated before accessing systems

8. Incident Response

How the organization prepares for, detects, responds to, and recovers from security incidents

9. Maintenance

How the organization ensures secure maintenance of hardware and software components

10. Media Protection

How information stored on Physical media is protected from unauthorized access or damage

11. Physical and Environmental Protection

How physical facilities and equipment are secured against unauthorized access or environmental hazards

12. Planning

How the organization manages information security planning and integrates it into business processes

13. Program Management

How the organization manages its overall information security and privacy program

14. Personnel Security

How employees and contractors are screened and managed to reduce insider threats

15. PII and Transparency

How PII is managed, processed, and protected with transparency

16. Risk Assessment

How the organization identifies and evaluates risks to its information systems and data

17. System and Services Acquisition

How systems and services are securely acquired, developed, and integrated

18. System and Communications Protection

How data is securely transmitted and protected during communication

19. System and Information Integrity

How the organization ensures the integrity of data and systems by detecting and correcting errors or malicious changes

20. Supply Chain Risk Management

How the organization manages risks related to its supply chain, including third-party vendors and service providers