National Institute of Standards and Technology, Recommended Security Controls for Federal Information Systems (NIST Special Publication 800-53) (Rev. 3) (Aug. 2009) (full-text); Security and Privacy Controls for Federal Information Systems and Organizations (Rev. 4) (Apr. 2013) (full-text).