CMMC

NIST SP 800‑53 R5 Control Families

This release includes a total of 1,189 controls, organized into 20 families:

1. Access Control
2. Awareness & Training
3. Audit & Accountability
4. Assessment, Authorization & Monitoring
5. Configuration Management
6. Contingency Planning
7. Identification & Authentication
8. Incident Response
9. Maintenance
10. Media Protection
11. Physical & Environmental Protection
12. Planning
13. Program Management
14. Personnel Security
15. Personally Identifiable Information (PII) Processing & Transparency
16. Risk Assessment
17. System & Services Acquisition
18. System & Communications Protection
19. System & Information Integrity
20. Supply Chain Risk Management

This count includes deprecated controls that have been removed or folded into others. Some controls are not categorized under baselines—low, moderate, high, or privacy—per NIST SP 800‑53B.

ComplianceForge provides full 1:1 mapping of all 20 families and their controls in its CDPP documentation.