NIST COSAiS: SP 800-53 Control Overlays for AI Agents

NIST is drafting a second, distinct body of AI agent guidance alongside the AI Risk Management Framework (AI RMF): SP 800-53 control overlays specifically for agentic systems, developed under the AI Agent Standards Initiative and its COSAiS project. As of August 2026, none of it is final — every artifact below is a concept paper, discussion draft, or request for information, not a published standard.

This post covers that control-catalog track: what stage it's at, what it covers, and how it differs from the risk-framework guidance our NIST AI RMF for agents post already maps in depth.

What the AI Agent Standards Initiative is, and what stage it is at

The AI Agent Standards Initiative is NIST's federal standards-development effort aimed specifically at AI agents, running on a multi-year track toward a published standard. It published a concept paper in August 2025, followed by a discussion draft with an annotated outline in January 2026; full publication is targeted for late 2026 through 2027. As of August 2026, the Initiative has not published final control text — everything currently available is exploratory or draft material meant to shape the eventual standard, not to be implemented as-is.

COSAiS: overlays for five use cases, two of them agentic

COSAiS — Control Overlays for Securing AI Systems — is the specific NIST project, announced August 2025, developing SP 800-53 control overlays for five AI use cases. Two of those five are agentic: "Using AI Agent Systems (Single Agent)" and "Using AI Agent Systems (Multi-Agent)." An overlay, in SP 800-53 terms, is a tailored subset and interpretation of the existing federal control catalog for a specific technology or use case — it doesn't invent new controls from scratch so much as specify how the existing catalog applies to a new kind of system. As of August 2026, the agentic overlays are still discussion-draft material; no specific overlay control text or control IDs for either use case have been finalized, and none should be treated as settled guidance yet.

The single-agent/multi-agent split is worth noticing on its own, independent of what either overlay eventually says. It signals that NIST's working assumption is that the control problem for one autonomous system acting alone is not the same problem as the control problem for several agents interacting — a multi-agent deployment introduces coordination, delegation, and inter-agent trust questions that a single-agent overlay would not need to address. Teams running multi-agent architectures today have a reason to watch that overlay specifically, since it is the one most likely to eventually speak to controls like inter-agent authentication and bounded delegation that a single-agent control set has no occasion to cover.

Why a federal control catalog matters even if you're not a federal contractor

SP 800-53 is nominally a federal control catalog, developed for systems that must meet FISMA requirements, but its influence runs well past federal agencies. Commercial control frameworks and audit standards have historically drawn on SP 800-53's structure and control language, and organizations selling into regulated industries or the public sector often end up mapping their own controls to it regardless of their entity type. An agentic-systems overlay landing inside SP 800-53, even years before agencies fully implement it, is a preview of the control vocabulary — logging, identity, authorization boundaries — that private-sector audits and vendor questionnaires are likely to start borrowing from once it exists in a citable form.

The NCCoE February 2026 concept paper on identity and authorization

NIST's National Cybersecurity Center of Excellence (NCCoE) published a concept paper in February 2026 focused specifically on accelerating the adoption of software and AI agent identity and authorization. That the NCCoE opened a dedicated identity/authorization workstream — rather than folding the topic into the broader COSAiS overlay effort — signals that NIST treats agent identity as distinct enough to warrant its own concept paper, ahead of and feeding into the overlay control text. For engineering teams, this is the artifact to watch if your interest is specifically in how NIST is thinking about agent authentication, authorization, and delegation, as opposed to the wider agentic-system control set.

The 8 January 2026 Federal Register RFI and what it signals

NIST published a Federal Register request for information (RFI) on security considerations for AI agents on 8 January 2026. An RFI at this stage of a standards effort is NIST formally soliciting public and industry input before committing further detail to the draft — a data-gathering step, not a comment period on finished text. Its existence, alongside the concept paper, discussion draft, and NCCoE paper landing within a roughly six-month window from August 2025 through February 2026, is itself the signal: NIST moved AI agent security from a topic mentioned inside broader AI guidance to a dedicated, resourced standards track with its own publication schedule.

The federal timeline at a glance

Every artifact in this track is dated, and the dates matter more than any individual document's content while the work is still in draft form:

Read that sequence as a single federal standards program unfolding in stages — concept, public input, draft outline, a focused identity/authorization side paper — rather than as unrelated announcements: five distinct artifacts landed within roughly six months, from August 2025 through February 2026.

How this differs from the AI RMF — control catalog vs. risk framework

The AI RMF structures risk-management activities — Govern, Map, Measure, Manage — as a process an organization runs; COSAiS and the AI Agent Standards Initiative are building a control catalog — specific, auditable technical and procedural controls tied to SP 800-53, tailored for agentic use cases. Neither replaces the other, and most mature programs will eventually need both: the RMF answers "how do we structure our ongoing AI risk-management program," while COSAiS aims to answer "which specific controls do we implement for this single-agent or multi-agent deployment." Our NIST AI RMF for agents post covers the former in full — GOVERN/MAP/MEASURE/MANAGE mapped to agent deployments — and is the right starting point if a risk-management process, not a control list, is what you need today.

What to do while the overlays are still discussion drafts

Since the COSAiS overlays are not final as of August 2026, don't treat any specific control ID or overlay text you encounter in a draft or secondary summary as authoritative — draft language changes, and citing it as settled guidance to an auditor or customer is a claim you can't currently back. What you can do now, without waiting for final publication: map your agentic systems against the existing SP 800-53 catalog generally, since the overlays will specialize that base catalog rather than replace it; document agent identity and authorization decisions in the shape the NCCoE concept paper is already exploring — least-privilege scoping and continuous authorization rather than static, one-time grants; and track the Initiative's publication schedule so your control mapping is ready to update rather than rebuilt when the overlays land. Public-sector teams in particular should read this alongside AI agent governance in the public sector, since federal control-catalog work is the track most likely to become a procurement requirement first. For the broader control stack this eventually plugs into, see the AI governance guide.

Common questions

Is COSAiS a published NIST standard I can implement today? No. As of August 2026, COSAiS is at the discussion-draft stage. The concept paper was published August 2025, a discussion draft with an annotated outline followed in January 2026, and full publication is targeted for late 2026 through 2027 — none of that is final control text yet.

How is COSAiS different from the NIST AI RMF? The AI RMF (Govern, Map, Measure, Manage) is a risk-management process framework; COSAiS develops SP 800-53 control overlays — a catalog of specific, auditable controls — tailored for AI use cases, two of which (single-agent and multi-agent systems) are specifically agentic. They're complementary, not competing: one structures how you manage risk, the other specifies what to control.

What is an SP 800-53 overlay? A tailored subset and interpretation of the federal SP 800-53 control catalog for a specific technology or use case, rather than an entirely new set of controls. COSAiS is drafting overlays for five AI use cases, including single-agent and multi-agent systems.

Should I wait for the overlays to be finalized before building agent identity controls? No. The NCCoE's February 2026 concept paper on software and AI agent identity and authorization signals where this work is heading, but least-privilege access scoping and continuous authorization for agents are practices worth adopting now, independent of when the overlays are finalized.

Does the single-agent vs. multi-agent overlay split matter if I only run single-agent deployments today? It's still worth tracking both. Architectures shift, and a program that has already internalized the distinction NIST is drawing — that coordination and delegation between agents raise different control questions than a single agent acting alone — will have an easier time adapting if a multi-agent deployment enters the picture later than one that treated "agent controls" as a single undifferentiated category.