Which statement about SP 800-53 Appendix J is correct?

• A. Privacy and security are complementary and mutually reinforcing
• B. Appendix J complements security controls in Appendix F
• C. Privacy control families are the same as those in the FEA Security and Privacy Profile, V3, Sept 2010
• D. Appendix J is based on a framework for encryption standards

Answer: (A)

Privacy and security work together in SP 800-53 Appendix J. This part of the standard treats privacy controls as being supported by, and dependent on, the security controls already in place. When security controls—like access control, authentication, encryption, auditing, and data integrity—are solid, they create the conditions that protect individuals’ information and preserve privacy. At the same time, privacy requirements—such as limiting data collection, specifying purpose and retention, obtaining consent, and ensuring data accuracy—shape how those security controls are configured and applied. The result is a relationship where strong security enables privacy protections and privacy needs influence security implementations, making them complementary and mutually reinforcing. It isn’t about a specific crosswalk to a different appendix or a separate encryption framework; it’s about the integrated, reinforcing nature of privacy and security.