Controls sample
25 selected Rev. 5 controls with official identifiers, names, security baseline membership, editable ownership and status fields, implementation prompts, and evidence examples.
Free XLSX sample Independent field resource
NIST SP 800-53
Controls Field Kit.
Download a real 25-control implementation and evidence workbook for teams turning Rev. 5 controls into accountable infrastructure work across AWS, hybrid cloud, and enterprise environments.
.xlsx · 4 worksheets · 25 controls · no email required
The problem
A control catalog is not an implementation system.
NIST publishes the authoritative controls, assessment procedures, and baselines. The difficult part begins after the download: deciding what applies, assigning ownership, describing the real implementation, collecting evidence, and keeping gaps visible.
The free sample gives you that operating layer for 25 selected controls today. It does not replace the official publications, an assessor, or organization-specific tailoring. It gives control owners a cleaner place to start implementation, evidence collection, and remediation.
Inside the free sample
Four working sheets. No gated preview.
Open the file immediately, inspect the structure, and use it on a real review. Every worksheet is editable; examples are clearly separated from organization-specific claims.
Evidence checklist
20 practical evidence types with related controls, expected content, suggested owner, collection cadence, location, review status, and reviewer notes.
POA&M sample
A 50-row remediation register with risk and status fields, milestones, closure evidence, and live formulas for days open and days to target.
Start Here dashboard
A five-step usage guide, clear scope boundaries, official-source links, and live counts for implemented, in-progress, gap, and not-assessed controls.
Operating workflow
From baseline to evidence.
- 01 Select Choose the applicable Low, Moderate, or High baseline and record tailoring decisions.
- 02 Assign Give every applicable control an accountable owner and review frequency.
- 03 Describe Write the actual implementation—not an aspirational policy statement.
- 04 Evidence Link the configuration, report, ticket, log, test, or approval that supports the implementation.
- 05 Remediate Move gaps into a POA&M with milestones, target dates, and closure proof.
Built for
People accountable for infrastructure controls.
- Cloud and infrastructure engineers
- Security and compliance leads
- Control owners and evidence coordinators
- Small federal contractors building internal readiness
- Consultants who need a repeatable working structure
Not positioned as
A shortcut to certification.
- Not an official NIST product
- Not an audit, assessment, or authorization decision
- Not a guarantee of compliance, FedRAMP, FISMA, or an ATO
- Not a replacement for tailoring controls to your system and risk
- Not legal, regulatory, or procurement advice
Independent author
Tymur Chmeruk
Cloud Security & Infrastructure Engineer
The free sample and full kit are developed from an infrastructure operator’s perspective: AWS and hybrid environments, secure-by-default configuration, Terraform and CI/CD controls, vulnerability remediation, operational telemetry, and evidence that can be traced back to the system.
Tymur’s public profile documents 15+ years across enterprise, financial, cloud, network, and regulated operations. The product remains an independent resource under the tcinfra.dev personal brand.
View official profile →Download it. Open it. Decide.
Get the working 25-control XLSX now without an email gate. If the structure is useful and you want the complete catalog, deeper AWS and hybrid guidance, and reusable assessment prompts, request the full kit by email.
Direct download · No email required · No payment · [email protected]