← Home / ATT&CK

MITRE ATT&CK and SP 800-53

Every technique and sub-technique in MITRE ATT&CK Enterprise v20.0, with the NIST SP 800-53 controls that the Center for Threat-Informed Defense (CTID) maps to each. Colour shows how many controls the mapping relates to a technique. That describes the mapping, not how well any organisation defends against the technique.

Choose a threat group to see the techniques MITRE records it using, or open a technique for its controls, MITRE's mitigations and detection strategies, the groups that use it and the OSA patterns that include its controls.

706
techniques and sub-techniques (227 and 479)
466 (66%)
with at least one SP 800-53 control in CTID's mapping
96
that CTID marks non-mappable: no SP 800-53 control applies
144
not in CTID's mapping, which is for ATT&CK 16.1
6 or more controls3 to 51 or 2CTID: no control appliesNot in CTID's mapping

Open a tactic to see its techniques.

Sources. MITRE ATT&CK Enterprise v20.0 (2026-10-13), from MITRE's STIX data. CTID Mappings Explorer, NIST SP 800-53 Rev 5 to ATT&CK 16.1 (updated 04/16/2025), carried to v20.0 through MITRE's records of which techniques replaced which. Both are generated into osa-data, data/mitre-attack, where the method and the changes are listed. About this data and what the figures mean.

© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Terms of use. CTID's mapping: © 2024 MITRE, Apache License 2.0.