What is a control family in NIST SP 800-53, and which of the following are examples?

• A. A single control with no grouping
• B. A group of related controls; examples include Access Control (AC), Audit and Accountability (AU), Configuration Management (CM).
• C. A risk assessment framework
• D. A type of vulnerability

Answer: (B)

Control families in NIST SP 800-53 are groups of related controls that address a specific security domain. They organize the catalog so you can apply a complete set of protections in an area like how access is controlled, how events are logged, or how system configurations are managed. Each family contains multiple controls (and sometimes enhancements) that work together to meet that domain’s objectives. The examples listed—Access Control, Audit and Accountability, and Configuration Management—are actual control families in the standard. They represent domains focused on who can access resources, how activities are recorded and auditable, and how configurations are managed, respectively. The other options don’t fit because a control family is about grouping related controls, not a single control, not a risk assessment framework, and not a vulnerability type.