Enterprises mapping agentic AI onto NIST SP 800-53 today find real, recurring control gaps concentrated in four families (Access Control, Identification and Authentication, Audit and Accountability, and Supply Chain Risk Management) because the catalogue's implementation guidance assumes human-operated, deterministic systems rather than autonomous agents that hold delegated credentials, can be steered by untrusted input, and depend on a model-and-tool supply chain; NIST's COSAiS project (Control Overlays for Securing AI Systems) is writing single-agent and multi-agent overlays to close the gap, but finalized agent-specific guidance is not expected before 2027, so the interim burden is on the enterprise to identify the touched controls, document where standard guidance does not fit the agent case, and record compensating controls.

Anchored on (a) NIST SP 800-53 Rev 5 (Security and Privacy Controls for Information Systems and Organizations) and its control families AC/IA/AU/SR, a pre-cutoff, durable fact; (b) NIST CSRC COSAiS project at csrc.nist.gov/projects/cosais (Control Overlays for Securing AI Systems), described scope includes a single-agent overlay (autonomous decision-making, contextual reasoning, planning) and a multi-agent overlay (cooperative systems, inter-agent trust, lateral movement), with annotated outlines and use-case materials published; (c) Cloud Security Alliance Labs research notes (Apr 2026) on the NIST AI agent listening sessions and the expectation that finalized guidance is unlikely before 2027. SOFT-SOURCING / VERIFY-BEFORE-PUBLISH FLAG: drafted 30 May 2026 against research post the author's Jan-2026 cutoff. DURABLE core: SP 800-53 exists with these control families, and the structural reasons agents underspecify against them (delegated authority, non-human identity, reasoning-not-events audit, model/tool provenance) are sound. VERIFIED 2026-05-30 via WebFetch of csrc.nist.gov/projects/cosais: the COSAiS project exists and is developing five use-case overlays including 'Using AI Agent Systems – Single Agent' and '– Multi-Agent', built on SP 800-53 (plus SP 800-218A, draft AI 800-1, AI 100-2e2025); a concept paper opened for comment 14 Aug 2025 and an annotated outline (Predictive AI) circulated as a discussion draft 8 Jan 2026 with feedback due 13 Feb 2026 — confirming drafts-circulating, not-final status. STILL AN EXPECTATION (Peter to treat as such): the 'not before 2027' finalization timing is CSA-Labs analyst tracking, not a NIST commitment; the page gives no final date, and the concept-to-annotated-outline cadence in early 2026 makes a 2026 finalization implausible, which supports the framing. The four-families (AC/IA/AU/SR) gap characterisation is attributed in the piece to practitioner analysis, not asserted as NIST's own enumeration. 90-day review cadence (28 Aug 2026). Trigger conditions: (1) NIST publishing a draft/final overlay moves claim toward gap-being-closed (strengthen); (2) a published agent-security incident attributable to one of the four families gives precedent; (3) FedRAMP/sector rule requiring agent-specific controls before overlays land intensifies the interim-burden point. Sibling AM-192 (iso-42001-enterprise-ai-vendor-checkpoint) is the management-system-layer companion; nist-ai-rmf-agentic-ai-mapping is the risk-framework layer.