Rev. 5 migration
Map the eMASS authorization record onto NIST SP 800-53 Rev. 5, review the material deltas, and approve the Rev. 5 narrative and SLCM frequency for each affected control.
Data as of23 Aug 2026
Rev. 4-to-Rev. 5 crosswalk deltas
The authoritative change register from the local crosswalk, independent of the uploaded eMASS record. Use it to confirm which Rev. 5 controls changed materially, which are new, and which were withdrawn.
0 of 85 in view drafted
85 migration deltas
| Expand | Rev. 5 control | Delta | Type | Migration action |
|---|---|---|---|---|
| AT-02(05) | Literacy Training and Awareness | Advanced Persistent Threat New control enhancement | New in Rev. 5Review required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | |
| AT-03(05) | Role-Based Training | Processing Personally Identifiable Information New control enhancement · Adds to Privacy Control Baseline (SP 800-53B) | New in Rev. 5Review required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | |
| AT-06 | Training Feedback New base control | ChangedReview required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | no CSD heading matched | |
| CM-03(07) | Configuration Change Control | Review System Changes New control enhancement | New in Rev. 5Review required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | no CSD heading matched | |
| CM-07(09) | Least Functionality | Prohibiting the Use of Unauthorized Hardware New control enhancement | New in Rev. 5Review required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | no CSD heading matched | |
| CM-12 | Information Location New base control · Adds to M and H Security Control Baselines (SP 800-53B) | ChangedReview required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | multiple CSD headings matched; owner review required | |
| CM-12(01) | Information Location | Automated Tools to Support Information Location New control enhancement · Adds to M and H Security Control Baselines (SP 800-53B) | New in Rev. 5Review required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | |
| CP-09(08) | System Backup | Cryptographic Protection New control enhancement · Adds to M and H Security Control Baselines (SP 800-53B) | New in Rev. 5Review required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | |
| IA-04(09) | Identifier Management | Attribute Maintenance and Protection New control enhancement | New in Rev. 5Review required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | |
| IA-09 | Service Identification and Authentication Changes control text · Changes parameter · Removes parameter · Changes discussion | ChangedReview required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | |
| IA-11 | Re-Authentication Changes control text · Changes discussion · Adds to L, M, and H Security Control Baselines (SP 800-53B) | ChangedReview required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | |
| IA-12 | Identity Proofing New base control · Adds to M and H Security Control Baselines (SP 800-53B) | ChangedReview required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | multiple CSD headings matched; owner review required | |
| IA-12(01) | Identity Proofing | Supervisor Authorization New control enhancement | New in Rev. 5Review required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | multiple CSD headings matched; owner review required | |
| IR-02(03) | Incident Response Training | Breach New control enhancement · Adds to Privacy Control Baseline (SP 800-53B) | New in Rev. 5Review required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | no CSD heading matched | |
| IR-04(12) | Incident Handling | Malicious Code and Forensic Analysis New control enhancement | New in Rev. 5Review required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | no CSD heading matched | |
| IR-04(13) | Incident Handling | Behavior Analysis New control enhancement | New in Rev. 5Review required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | no CSD heading matched | |
| IR-04(14) | Incident Handling | Security Operations Center New control enhancement | New in Rev. 5Review required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | no CSD heading matched | |
| IR-05(01) | Incident Monitoring | Automated Tracking, Data Collection, and Analysis Adds parameter · Changes control text · Changes discussion | ChangedReview required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | no CSD heading matched | |
| IR-06(03) | Incident Reporting | Supply Chain Coordination Changes title · Changes control text · Changes discussion · Adds to M and H Security Control Baselines (SP 800-53B) | ChangedReview required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | no CSD heading matched | |
| IR-08(01) | Incident Response Plan | Breaches New control enhancement · Adds to Privacy Control Baseline (SP 800-53B) | New in Rev. 5Review required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | no CSD heading matched | |
| MA-03(05) | Maintenance Tools | Execution with Privilege New control enhancement | New in Rev. 5Review required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | |
| MA-03(06) | Maintenance Tools | Software Updates and Patches New control enhancement | New in Rev. 5Review required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | |
| MA-04(01) | Nonlocal Maintenance | Logging and Review Changes title · Changes control text · Adds discussion | ChangedReview required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | no CSD heading matched | |
| PE-08(03) | Visitor Access Records | Limit Personally Identifiable Information Elements New control enhancement · Adds to Privacy Control Baseline (SP 800-53B) | New in Rev. 5Review required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | |
| PE-23 | Facility Location New base control | ChangedReview required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | |
| PL-07 | Concept of Operations Changes title · Changes control text · Changes discussion | ChangedReview required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | |
| PL-10 | Baseline Selection New base control | ChangedReview required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | |
| PL-11 | Baseline Tailoring New base control | ChangedReview required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | |
| PM-05(01) | System Inventory | Inventory of Personally Identifiable Information New control enhancement · Adds to Privacy Control Baseline (SP 800-53B) | New in Rev. 5Review required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | no CSD heading matched | |
| PM-07(01) | Enterprise Architecture | Offloading New control enhancement | New in Rev. 5Review required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | no CSD heading matched | |
| PM-16(01) | Threat Awareness Program | Automated Means for Sharing Threat Intelligence New control enhancement | New in Rev. 5Review required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | |
| PM-17 | Protecting Controlled Unclassified Information On External Systems New base control · Adds to Privacy Control Baseline (SP 800-53B) | ChangedReview required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | |
| PM-18 | Privacy Program Plan New base control · Adds to Privacy Control Baseline (SP 800-53B) | ChangedReview required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | |
| PM-19 | Privacy Program Leadership Role New base control · Adds to Privacy Control Baseline (SP 800-53B) | ChangedReview required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | |
| PM-20 | Dissemination of Privacy Program Information New base control · Adds to Privacy Control Baseline (SP 800-53B) | ChangedReview required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | multiple CSD headings matched; owner review required | |
| PM-20(01) | Dissemination of Privacy Program Information | Privacy Policies on Websites, Applications, and Digital Services New control enhancement · Adds to Privacy Control Baseline (SP 800-53B) | New in Rev. 5Review required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | |
| PM-21 | Accounting of Disclosures New base control · Adds to Privacy Control Baseline (SP 800-53B) | ChangedReview required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | |
| PM-22 | Personally Identifiable Information Quality Management New base control · Adds to Privacy Control Baseline (SP 800-53B) | ChangedReview required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | |
| PM-23 | Data Governance Body New base control | ChangedReview required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | |
| PM-24 | Data Integrity Board New base control · Adds to Privacy Control Baseline (SP 800-53B) | ChangedReview required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | |
| PM-25 | Minimization of Personally Identifiable Information Used In Testing, Training, and Research New base control · Adds to Privacy Control Baseline (SP 800-53B) | ChangedReview required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | |
| PM-26 | Complaint Management New base control · Adds to Privacy Control Baseline (SP 800-53B) | ChangedReview required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | |
| PM-27 | Privacy Reporting New base control · Adds to Privacy Control Baseline (SP 800-53B) | ChangedReview required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | |
| PM-28 | Risk Framing New base control · Adds to Privacy Control Baseline (SP 800-53B) | ChangedReview required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | |
| PM-29 | Risk Management Program Leadership Roles New base control | ChangedReview required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | |
| PM-30 | Supply Chain Risk Management Strategy New base control | ChangedReview required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | multiple CSD headings matched; owner review required | |
| PM-30(01) | Supply Chain Risk Management Strategy | Suppliers of Critical or Mission-Essential Items New control enhancement | New in Rev. 5Review required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | |
| PM-31 | Continuous Monitoring Strategy New base control · Adds to Privacy Control Baseline (SP 800-53B) | ChangedReview required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | |
| PM-32 | Purposing New base control | ChangedReview required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | |
| PS-03(04) | Personnel Screening | Citizenship Requirements New control enhancement | New in Rev. 5Review required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | |
| PS-09 | Position Descriptions New base control · Adds to L, M, and H Security Control Baselines (SP 800-53B) | ChangedReview required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | |
| RA-03(01) | Risk Assessment | Supply Chain Risk Assessment New control enhancement · Adds to L, M, and H Security Control Baselines (SP 800-53B) | New in Rev. 5Review required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | no CSD heading matched | |
| RA-03(02) | Risk Assessment | Use of All-Source Intelligence New control enhancement | New in Rev. 5Review required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | no CSD heading matched | |
| RA-03(03) | Risk Assessment | Dynamic Threat Awareness New control enhancement | New in Rev. 5Review required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | no CSD heading matched | |
| RA-05(11) | Vulnerability Monitoring and Scanning | Public Disclosure Program New control enhancement · Adds to L, M, and H Security Control Baselines (SP 800-53B) | New in Rev. 5Review required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | |
| RA-07 | Risk Response New base control · Adds to Privacy Control Baseline (SP 800-53B) · Adds to L, M, and H Security Control Baselines (SP 800-53B) | ChangedReview required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | |
| RA-10 | Threat Hunting New base control | ChangedReview required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | |
| SA-03(03) | System Development Life Cycle | Technology Refresh New control enhancement | New in Rev. 5Review required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | no CSD heading matched | |
| SA-08(33) | Security and Privacy Engineering Principles | Minimization New control enhancement · Adds to Privacy Control Baseline (SP 800-53B) | New in Rev. 5Review required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | no CSD heading matched | |
| SA-15(03) | Development Process, Standards, and Tools | Criticality Analysis Changes control text · Changes parameter · Changes discussion · Adds to M and H Security Control Baselines (SP 800-53B) | ChangedReview required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | no CSD heading matched | |
| SA-21 | Developer Screening Changes discussion · Adds to H Security Control Baseline (SP 800-53B) | ChangedReview required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | |
| SC-28(03) | Protection of Information At Rest | Cryptographic Keys New control enhancement | New in Rev. 5Review required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | no CSD heading matched | |
| SC-41 | Port and I/O Device Access Adds parameter | ChangedReview required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | no CSD heading matched | |
| SC-45 | System Time Synchronization New base control | ChangedReview required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | no CSD heading matched | |
| SI-02(04) | Flaw Remediation | Automated Patch Management Tools New control enhancement | New in Rev. 5Review required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | no CSD heading matched | |
| SI-04(24) | System Monitoring | Indicators of Compromise Adds parameter | ChangedReview required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | no CSD heading matched | |
| SI-07(09) | Software, Firmware, and Information Integrity | Verify Boot Process Changes parameter | ChangedReview required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | no CSD heading matched | |
| SI-07(10) | Software, Firmware, and Information Integrity | Protection of Boot Firmware Changes parameter | ChangedReview required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | no CSD heading matched | |
| SI-10(03) | Information Input Validation | Predictable Behavior Changes control text · Changes discussion | ChangedReview required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | |
| SI-10(06) | Information Input Validation | Injection Prevention New control enhancement | New in Rev. 5Review required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | |
| SI-12(03) | Information Management and Retention | Information Disposal New control enhancement · Adds to Privacy Control Baseline (SP 800-53B) | New in Rev. 5Review required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | |
| SR-01 | (Supply Chain Risk Management) Policy and Procedures New base control · Adds to L, M, and H Security Control Baselines (SP 800-53B) | ChangedReview required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | multiple CSD headings matched; owner review required | |
| SR-02 | Supply Chain Risk Management Plan New base control · Adds to L, M, and H Security Control Baselines (SP 800-53B) | ChangedReview required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | multiple CSD headings matched; owner review required | |
| SR-02(01) | Supply Chain Risk Management Plan | Establish SCRM Team New control enhancement · Adds to L, M, and H Security Control Baselines (SP 800-53B) | New in Rev. 5Review required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | |
| SR-03(02) | Supply Chain Controls and Processes | Limitation of Harm New control enhancement | New in Rev. 5Review required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | |
| SR-03(03) | Supply Chain Controls and Processes | Sub-tier Flow Down New control enhancement | New in Rev. 5Review required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | |
| SR-04 | Provenance New base control | ChangedReview required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | |
| SR-05 | Acquisition Strategies, Tools, and Methods New base control · Adds to L, M, and H Security Control Baselines (SP 800-53B) | ChangedReview required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | multiple CSD headings matched; owner review required | |
| SR-05(02) | Acquisition Strategies, Tools, and Methods | Assessments Prior to Selection, Acceptance, Modification, or Update New control enhancement | New in Rev. 5Review required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | |
| SR-06 | Supplier Assessments and Reviews New base control · Adds to M, and H Security Control Baselines (SP 800-53B) | ChangedReview required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | multiple CSD headings matched; owner review required | |
| SR-07 | Supply Chain Operations Security New base control | ChangedReview required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | |
| SR-08 | Notification Agreements New base control · Adds to L, M, and H Security Control Baselines (SP 800-53B) | ChangedReview required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | |
| SR-10 | Inspection of Systems or Components New base control · Adds to L, M, and H Security Control Baselines (SP 800-53B) | ChangedReview required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | |
| SR-11(02) | Component Authenticity | Configuration Control for Component Service and Repair New control enhancement · Adds to L, M, and H Security Control Baselines (SP 800-53B) | New in Rev. 5Review required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | no CSD heading matched | |
| SR-12 | Component Disposal New base control · Adds to L, M, and H Security Control Baselines (SP 800-53B) | ChangedReview required | Candidate narrative only; no Rev. 5 implementation status is asserted. | System-specific mechanism, evidence, SLCM method, metric, and reporting require approval. | no CSD heading matched |