The scope of certification normally addresses all NIST SP _________ control families with the purpose of uncovering design, implementation, and operational flows in those controls. Response:

NIST SP 800-53, "Security and Privacy Controls for Information Systems and Organizations," defines the catalog of control families that are assessed during certification activities to ensure comprehensive coverage of security requirements.

NIST SP 800-37, "Risk Management Framework for Information Systems and Organizations," describes the RMF process, not the catalog of controls itself.

NIST SP 800-53A, "Assessing Security and Privacy Controls in Federal Information Systems and Organizations," provides assessment procedures for the controls listed in 800-53, but 800-53 itself contains the control families.

NIST SP 800-39, "Managing Information Security Risk: Organization, Mission, and System View," focuses on enterprise-wide risk management, not the specific control families.