A NIST SP 800-53 baseline is the starting set of controls for a system. Pick Low and you implement one set. Pick High and you implement a much larger one, with stronger enhancements. The choice shapes your workload more than almost any other early decision, so it is worth understanding how it is made.
The short version: you rarely choose a baseline directly. You categorize the system, and the categorization selects the baseline. This article covers how that categorization works, who gets to make the call, and where teams go wrong. Adjusting the baseline afterward is tailoring, which is a separate step.
What a baseline is
NIST SP 800-53B, the companion to the Rev. 5 catalog, defines four baselines:
Low, Moderate, and High security baselines. Each is a set of controls and control enhancements chosen from the catalog for systems at that impact level. Higher baselines add controls and enhancements to what the lower ones contain.
A privacy baseline. One set, applied to systems that process personally identifiable information, whatever their security impact level. It is not a fourth tier above High. It is selected alongside a security baseline.
A baseline is a starting point, not a finished control set. 800-53B expects you to tailor it. It also does not fill in parameter values, so a baseline tells you to implement AC-7 but not how many failed logons to allow.
If you are new to the catalog's structure, start with how the control families work.
Categorization comes first
The method comes from two federal standards and one NIST guide.
List the information types the system handles. Case records, payment data, user credentials, audit logs, and so on. NIST SP 800-60 offers a catalog of information types with provisional impact levels, which is a useful prompt even when your types do not match it exactly.
Rate each type against three security objectives. FIPS 199 asks what the potential impact would be from a loss of confidentiality, integrity, or availability. Each is rated low, moderate, or high.
Roll the ratings up to the system. FIPS 200 applies a high-water mark: the system's impact level is the highest rating across all three objectives and all information types.
Select the matching baseline. A moderate-impact system starts from the Moderate baseline.
The FIPS 199 definitions are worth reading in the original. In summary, low means a limited adverse effect on operations, assets, or individuals. Moderate means a serious adverse effect. High means a severe or catastrophic one. Most argument happens at the boundary between "limited" and "serious."
The high-water mark is blunt by design. A system rated moderate for confidentiality and integrity but low for availability is a moderate system. One high rating anywhere makes the whole system high.
A worked categorization
Say a 60-person SaaS company offers a case management tool to a civilian agency. The system handles three information types.
| Information type | Confidentiality | Integrity | Availability |
|---|---|---|---|
| Case records containing PII | Moderate | Moderate | Low |
| User account and authentication data | Moderate | Moderate | Low |
| Audit logs | Low | Moderate | Low |
Disclosure of case records could seriously harm the people named in them, so confidentiality is moderate. Tampering with case records or credentials could seriously harm agency operations, so integrity is moderate. The agency can work from paper for a period if the tool is down, so availability is low. The high-water mark is moderate, and the Moderate baseline applies. Because the system processes PII, the privacy baseline applies too.
The table is not the deliverable. The rationale under each rating is. An authorizing official who disagrees with a rating will challenge the reasoning, so write down why each cell says what it says.
Who actually makes the decision
Categorization is rarely yours alone. Who decides depends on why you are using 800-53 at all.
A federal agency system. The agency categorizes the system as part of the Categorize step of the Risk Management Framework in NIST SP 800-37 Rev. 2, and an agency official approves it.
A cloud service seeking FedRAMP authorization. The program publishes its own baselines, built on 800-53 with assigned parameter values. The impact level follows from the data agencies will put in the service. See our FedRAMP framework page for the program's structure.
A national security system. These use CNSSI 1253 rather than the 800-53B selection approach. CNSSI 1253 keeps a separate impact value for each security objective instead of collapsing them into one high-water mark.
A contractor handling controlled unclassified information. Your contract usually points you at NIST SP 800-171, whose requirements were derived from the 800-53 Moderate baseline. You do not select an 800-53 baseline in that case.
A commercial organization adopting 800-53 voluntarily. You decide. Use the same FIPS 199 method, because it gives you a defensible record, and tie the ratings to your risk register.
Common categorization mistakes
Over-categorizing to be safe. High is not a safer answer, it is a more expensive one, and an unjustified High rating spends effort on controls the system does not need. Categorization should follow impact, not anxiety.
Under-categorizing to save work. The reverse is worse. A Low rating for a system holding sensitive PII will not survive review, and recategorizing later means implementing the missing controls under time pressure.
Underrating integrity. Teams think hard about confidentiality and availability and assume integrity is low. For systems that hold records others rely on, such as case data, financial transactions, or configuration that drives other systems, unauthorized modification is often the most serious harm.
Ignoring aggregation. One record may carry limited impact. A system holding many of them, or combining data sets, can carry far more. Rate the information as the system actually holds it.
Categorizing the company instead of the system. Impact levels attach to a defined system with a boundary. A company can run a Moderate system and a Low system side by side. Draw the boundary first.
Forgetting what depends on you. If other systems consume your outputs, a loss of integrity or availability in yours may cause harm in theirs. That belongs in the rating.
After the baseline
Once the baseline is selected, three things follow.
Tailor it. Remove controls that genuinely do not apply, with rationale, designate inherited controls, and add any the risk assessment calls for.
Assign parameter values. Every bracketed parameter in the selected controls needs a value, from your program or from your own policy.
Revisit the categorization when the system changes. New information types, new users, or new interconnections can move the high-water mark.
Treat a change in impact level as a significant change. Moving from Low to Moderate adds controls and enhancements across most families, and the plan, the assessment, and the authorization all need to catch up. It is far cheaper to spot that early, when the change is proposed, than at the next assessment.
Keep the categorization record with your system security plan. Every later decision about scope and controls traces back to it, and reviewers will ask for it.
How TrustLynce helps
TrustLynce keeps your categorization rationale alongside the risk register, so impact ratings and the risks that justify them stay in one place. Selected baseline controls are tracked with owners and parameter values. See risk management.