NIST SP 800-53 Control Mapping
The 134 settings of the Windows hardening baseline in my windows-hardening (opens in a new tab) toolkit, mapped to NIST SP 800-53 Revision 5, Release 5.2.0. Control text comes from NIST's machine-readable catalog at the current release rather than from the Revision 5 PDF, which predates Releases 5.1.1 and 5.2.0.
What it finds:
28 settings the baseline declines to apply, each with the control objective the exclusion protects. Section 8 (opens in a new tab)
Nine settings carry a cost alongside their benefit. For six, the cost falls on another control objective, and for three, on a capability no control covers. Section 7 (opens in a new tab)
Only 25 of the 134 assignments fall on controls a system implements on its own. NIST designates 64 as organization-implemented, so a device configuration can support those objectives but never satisfy them alone. Section 6.1 (opens in a new tab)
21 settings do not take effect on a current Windows 11 device, so coverage is read against the configuration being assessed. Section 6.2 (opens in a new tab)