NIST, Security Self-Assessment Guide for Information Technology Systems (NIST Special Publication 800-26) (Nov. 2001) (full-text). NOTE: NIST Special Publication 800-26 was superseded by NIST Special Publication 800-53 (Rev. 3) and the NIST Special Publication 800-53A (Rev. 1). Agencies are required to use FIPS 200/NIST Special Publication 800-53 for the specification of security controls and NIST Special Publication 800-53A for the assessment of security control effectiveness.