Which regulation defines security and privacy controls for Federal information systems and organizations?

HIPAA (Health Insurance Portability and Accountability Act) governs the privacy and security of protected health information in the healthcare sector, not federal information systems broadly.

EU Safe Harbor was a framework governing personal data transfers between the European Union and the United States for commercial entities, and has since been invalidated and replaced.

PCI-DSS (Payment Card Industry Data Security Standard) is an industry-specific standard for organizations that handle payment card data, not a federal government security control framework.

NIST SP 800-53 was developed by the National Institute of Standards and Technology specifically to provide a comprehensive catalog of security and privacy controls for federal agencies and information systems, as mandated by FISMA. It defines control families covering areas such as access control, incident response, and risk assessment, and applies directly to federal organizations and their contractors.