# MITRE ATT&CK Enterprise v20.0 and NIST SP 800-53

Every technique and sub-technique in MITRE ATT&CK Enterprise v20.0, with the NIST SP 800-53 Rev 5 controls that the Center for Threat-Informed Defense (CTID) maps to each as mitigating it.

## Counts
- Techniques and sub-techniques: 706 (227 techniques, 479 sub-techniques) in 15 tactics.
- With at least one SP 800-53 control in CTID's mapping: 466 (66%). This describes the mapping, not how well anyone defends against a technique.
- Marked non-mappable by CTID, meaning no SP 800-53 control applies: 96.
- Not in CTID's mapping, being newer than ATT&CK 16.1 or left out: 144.
- Control and technique pairs: 5236, over 109 controls. Groups: 178. MITRE mitigations: 44. Detection strategies: 703.

## How to look things up
- One technique as a card: /attack/{id}.md, for example /attack/t1566.md or /attack/t1566.001.md
- One technique as JSON, with its controls, MITRE mitigations, detection strategies, groups and the patterns that include its controls: /api/v1/attack/techniques/{id}
- Techniques by tactic, by control or by CTID status: /api/v1/attack/techniques?tactic=TA0001, ?control=SI-04, ?ctid=non_mappable
- The techniques one control mitigates: /api/v1/controls/{id}?fields=attack
- The matrix for people, filterable by threat group and by pattern: /attack/

## Tactics (15)
- TA0043 Reconnaissance: 46 techniques and sub-techniques, 7 with a control
- TA0042 Resource Development: 51 techniques and sub-techniques, 0 with a control
- TA0001 Initial Access: 22 techniques and sub-techniques, 20 with a control
- TA0002 Execution: 66 techniques and sub-techniques, 55 with a control
- TA0003 Persistence: 113 techniques and sub-techniques, 95 with a control
- TA0004 Privilege Escalation: 96 techniques and sub-techniques, 81 with a control
- TA0005 Stealth: 151 techniques and sub-techniques, 104 with a control
- TA0112 Defense Impairment: 57 techniques and sub-techniques, 45 with a control
- TA0006 Credential Access: 68 techniques and sub-techniques, 63 with a control
- TA0007 Discovery: 49 techniques and sub-techniques, 15 with a control
- TA0008 Lateral Movement: 23 techniques and sub-techniques, 22 with a control
- TA0009 Collection: 41 techniques and sub-techniques, 27 with a control
- TA0011 Command and Control: 45 techniques and sub-techniques, 39 with a control
- TA0010 Exfiltration: 20 techniques and sub-techniques, 18 with a control
- TA0040 Impact: 33 techniques and sub-techniques, 26 with a control

## Sources and licences
- MITRE ATT&CK Enterprise v20.0 (2026-10-13), from MITRE's STIX data. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Terms: https://attack.mitre.org/resources/legal-and-branding/terms-of-use/
- CTID's mapping of NIST SP 800-53 Rev 5 to ATT&CK 16.1 (updated 04/16/2025), carried to v20.0 through MITRE's records of which techniques replaced which. CTID Mappings Explorer: © 2024 MITRE, Apache License 2.0.
- The data, with the method and the changes made: https://github.com/opensecurityarchitecture/osa-data/tree/main/data/mitre-attack
- Found an error? Open an issue at https://github.com/opensecurityarchitecture/osa-data/issues with the id, what OSA says and what the source says.