Learn: where a rule comes from

The ladder gives you the four words — standard, baseline, control, setting. This page answers the next question: who wrote the rulebook, and under whose authority. Every control on this site arrived by the same route. A law obliges somebody to act; a policy says what acting looks like; a framework structures the work; a catalogue holds the controls; a baseline picks the ones your kind of system gets; a setting is how one of them is enforced on a real device; and a check proves it was. Each step below names its publishers, with the address their own words live at and what it takes to read them.

The chain, in one picture

Law and contract what obliges anyone to do this at all
Policy what the government or agency directs, under that law
Framework how the work is structured: categorise, select, assess, authorise
Control catalogue the controls themselves, written once for everyone
Baseline the controls chosen for one kind of system
Configuration setting how a control is enforced on a real device
Check and evidence how conformance is expressed, measured and proved

Nothing is obliged to use the whole chain. A private business usually joins at the framework or the setting and has no policy rung at all; a DoD system has every rung and a second committee besides. That is what "normalised" means in practice, and the three traces below walk it.

Who publishes what, and for whom

The rows are the steps of the chain; the columns are who the publisher writes for. Reading across one row answers the question this page exists for: the same job, as NIST, DISA, NASA, CIS and the ACSC each answer it.

Which body publishes at each step of the chain, by who it writes for
Step	US federal civilianagencies under FISMA and OMB, and their cloud providers	US defenseDoD systems and national security systems	NASAan agency's own layer above NIST	Private businessadopted by contract or by choice, never by FISMA	Outside the USthe same job, done by another country's body
Law and contractwhat obliges anyone to do this at all	FISMA 2014	FISMA 2014 DFARS 252.204-7012	FISMA 2014	FAR 52.204-21 DFARS 252.204-7012	—
Policywhat the government or agency directs, under that law	OMB Circular A-130 CISA directives	DoDI 8500.01 and 8510.01 CNSS policy	OMB Circular A-130 NPR 2810.1	—	—
Frameworkhow the work is structured: categorise, select, assess, authorise	FIPS 199 and FIPS 200 NIST SP 800-37 (RMF)NIST CSF 2.0	FIPS 199 and FIPS 200 NIST SP 800-37 (RMF)CMMC	FIPS 199 and FIPS 200 NIST SP 800-37 (RMF)	NIST CSF 2.0 CMMC CIS Critical Security Controls ISO/IEC 27001 and 27002	NIST CSF 2.0 CIS Critical Security Controls ISO/IEC 27001 and 27002 Essential Eight and the ISM Cyber Assessment Framework
Control cataloguethe controls themselves, written once for everyone	NIST SP 800-53 NIST SP 800-53A	NIST SP 800-53 NIST SP 800-53A NIST SP 800-171	NIST SP 800-53 NIST SP 800-53A	NIST SP 800-171	—
Baselinethe controls chosen for one kind of system	NIST SP 800-53B FedRAMP baselines macOS Security Compliance Project	CNSSI 1253 DISA Security Requirements Guides macOS Security Compliance Project	NIST SP 800-53B NASA-SPEC-2600 (ASCS)macOS Security Compliance Project	FedRAMP baselines macOS Security Compliance Project	—
Configuration settinghow a control is enforced on a real device	DISA STIGs DISA STIG GPO package DISA STIG Intune package Microsoft security baselines CIS Benchmarks NSA Cybersecurity Information Sheets	DISA STIGs DISA STIG GPO package DISA STIG Intune package Microsoft security baselines NSA Cybersecurity Information Sheets	DISA STIGs Microsoft security baselines CIS Benchmarks	DISA STIGs Microsoft security baselines CIS Benchmarks NSA Cybersecurity Information Sheets	CIS Benchmarks
Check and evidencehow conformance is expressed, measured and proved	Control Correlation Identifiers OSCAL SCAP and the National Checklist Program CSET (CISA's assessment tool)	Control Correlation Identifiers OSCAL SCAP and the National Checklist Program	Control Correlation Identifiers OSCAL SCAP and the National Checklist Program	OSCAL SCAP and the National Checklist Program CSET (CISA's assessment tool)	—

The same control, traced three ways

One control — a device that locks itself after a period of inactivity — carried down three different ladders. The control barely changes. Everything above and below it does.

A federal civilian system

The plain FISMA chain: obliged by statute, categorised, baselined, enforced, assessed.

Law and contract FISMA 2014
The agency must run an information security programme, and NIST's standards are mandatory for this system.
Policy OMB Circular A-130
OMB tells the agency what that programme looks like and binds it to the NIST framework.
Framework FIPS 199 and FIPS 200
The system is categorised moderate for confidentiality, integrity and availability.
Control catalogue NIST SP 800-53
AC-11 Device Lock: prevent further access by initiating a device lock after a period of inactivity.
Baseline NIST SP 800-53B
The moderate baseline includes AC-11, and the agency's parameter sets the period at 15 minutes.
Configuration setting macOS Security Compliance Project
On macOS: a screensaver idle time of 900 seconds, with the lock delay at zero, in a configuration profile.
Check and evidence NIST SP 800-53A
The assessor examines the profile and tests a machine; the result goes in the assessment that supports the authorisation.

A DoD system

The same control, a different committee, and a rule concrete enough to run.

Law and contract FISMA 2014
FISMA applies, and for a national security system CNSS policy applies instead of the civilian line.
Policy DoDI 8500.01 and 8510.01
DoD adopts the RMF and puts DISA's content in force: the STIG is policy, not advice.
Framework NIST SP 800-37 (RMF)
Categorise, select, implement, assess, authorise, monitor — with an authorising official who signs.
Control catalogue CNSSI 1253
The 800-53 catalogue with the national security baselines and overlays applied, so the selected set differs from the civilian one.
Baseline DISA Security Requirements Guides
The Operating System SRG: the OS must initiate a session lock after a period of inactivity.
Configuration setting DISA STIGs
A named rule for this exact Windows release, CAT II, with check text and fix text — the registry value, and the command to set it.
Check and evidence Control Correlation Identifiers
The rule cites a CCI, the CCI points back at AC-11, and a scanner's XCCDF result rolls the finding up to the control.

A private business

Nothing here is obliged by FISMA. It arrives by contract, by market, or by choice.

Law and contract DFARS 252.204-7012
A defense contract flows SP 800-171 down — or no contract does, and everything below is voluntary.
Policy nobody
There is no rung here. No OMB circular reaches a private company; its own policy is the only policy.
Framework NIST CSF 2.0
CSF 2.0 organises the work by function, or CIS Controls prioritises it, or ISO 27001 certifies it — whichever the customer asks for.
Control catalogue NIST SP 800-171
3.1.10: use session lock with pattern-hiding displays to prevent access after a period of inactivity.
Baseline CIS Benchmarks
The CIS Benchmark for the platform, Level 1 for a workstation, Level 2 where the data warrants it.
Configuration setting Microsoft security baselines
The vendor's own baseline sets the machine inactivity limit, imported as a GPO or an Intune policy.
Check and evidence CMMC
A CMMC assessment, a customer's questionnaire, or an ISO audit — somebody outside the company asks for the evidence.

How they are normalised

Four mechanisms do nearly all the work of turning one body's rules into another's, and each one is public.

Control Correlation Identifiers — DISA breaks each NIST SP 800-53 control statement into single testable assertions and numbers them. A STIG rule cites the CCI, the CCI names the control, and a pile of findings about registry values becomes an answer about controls. This is the one joint that makes a DoD scan report legible to a civilian assessor.
OSCAL — a catalogue, a profile and a baseline as data rather than prose. A baseline becomes a document that says "this catalogue, these controls, these parameters", which a program resolves. It is how this instance reads 800-53 and 800-171 at all.
SCAP and the National Checklist Program — XCCDF for the checklist, OVAL for the test, and the National Checklist Program as the public shelf. The same STIG exists twice: as prose for a person and as content for a scanner.
macOS Security Compliance Project — the worked example. Each macOS rule carries its references to 800-53, 800-171, the STIG, CIS and CMMC at once, and the build emits whichever baseline you asked for. One rule, many citations: that is normalisation done at the source instead of afterwards.

And the two paths into private business

Nothing on this page obliges a company by itself. Federal rules reach private business two ways. By contract: DFARS 252.204-7012 flows NIST SP 800-171 down to every defense supplier, and CMMC audits it; FAR 52.204-21 sets a fifteen-requirement floor in almost every other federal contract. By market: FedRAMP baselines is met once and sold to every agency. Everything else — NIST CSF 2.0, CIS Critical Security Controls, ISO/IEC 27001 and 27002 — is adopted because a customer asked or because it is a good idea, and a company can leave at any time. Which of those applies to you is the first thing to settle, because it decides whether the rest of this page is a requirement or a reading list.

What this site does with all of it

One pipeline, the same for every publisher: fetch, keep the exact bytes, normalise into requirements or settings, diff field by field against the previous version, and record the publisher's own stated reason where there is one. So the change register can show a control before and after; Controls searches every tracked catalogue at once; and Baselines builds the strictest published set for a platform and lets you trim it. A machine-generated summary is always labelled as one, and never replaces the publisher's words.

Every body, with its source

4 of 35 publishers, at the Check and evidence step · show all

Check and evidencehow conformance is expressed, measured and proved

Control Correlation Identifiers

Check and evidence US defense US federal civilian NASA

DISA

A list that breaks each 800-53 control statement into single testable assertions, each with a CCI number that a STIG rule then cites.

The joint in the whole machine. A CCI is how 'this registry value' gets back to 'AC-11', and so how a pile of STIG findings becomes an answer about controls.

Derives from

NIST SP 800-53 (and further up: FISMA 2014, FIPS 199 and FIPS 200)

Feeds into

nothing here derives from it yet

Read it at

CCI list public

On this instance

2026-07-14 · 1 version held · every version and what changed loaded 17 Oct

OSCAL

Check and evidence US federal civilian US defense Private business NASA

NIST

The Open Security Controls Assessment Language: catalogues, profiles, baselines, implementation statements and assessment results as JSON, XML or YAML.

The format that makes any of this computable. A baseline as an OSCAL profile is a document that says 'this catalogue, these controls, these parameters' — which a program can resolve, and a person cannot be trusted to.

Derives from

NIST SP 800-53 (and further up: FISMA 2014, FIPS 199 and FIPS 200)

Feeds into

nothing here derives from it yet

Read it at

OSCAL public
NIST's OSCAL content public

SCAP and the National Checklist Program

Check and evidence US federal civilian US defense Private business NASA

NIST

XCCDF for the checklist, OVAL for the test, CPE for the product, and the NCP repository that holds the published checklists for each platform.

This is what a scanner reads. The same STIG exists as prose for a person and as SCAP content for a tool, and the NCP is the public shelf both come off.

Derives from

NIST SP 800-53 (and further up: FISMA 2014, FIPS 199 and FIPS 200)

Feeds into

nothing here derives from it yet

Read it at

National Checklist Program repository public
SCAP public

CSET (CISA's assessment tool)

Check and evidence US federal civilian Private business

CISA

A free self-assessment tool that walks an organisation through a chosen standard — CSF, 800-53, 800-171, CIS Controls, ICS standards — and reports the gaps.

The one entry here that is software rather than a document, and the easiest way for a small organisation to assess itself against a catalogue it did not write.

Derives from

NIST CSF 2.0, NIST SP 800-53, CIS Critical Security Controls (and further up: FISMA 2014, FIPS 199 and FIPS 200)

Feeds into

nothing here derives from it yet

Read it at

CSET public
cisagov/cset on GitHub public

Names that collide

Most of the difficulty in learning this field is that several different things share a name. Each reading below is real; none of them is the wrong answer, so the thing to do is say which one you mean.

CSET

NASA OCIO — the Cybersecurity Standards and Engineering Team, which writes NASA's own configuration specifications (the ASCS set). source agency sign-in
CISA — the Cyber Security Evaluation Tool, free software for assessing yourself against a chosen standard. source public
Georgetown University — the Center for Security and Emerging Technology, a policy research centre — no controls, no baselines. source public

FISMA, not FISA

FISMA — the Federal Information Security Modernization Act: the statute behind every federal control on this site. source public
FISA — the Foreign Intelligence Surveillance Act: surveillance authority law. It publishes no controls, baselines or standards, and nothing on this site derives from it. source public

CSI

NSA — a Cybersecurity Information Sheet: short hardening guidance on one subject. source public
CIS — the Center for Internet Security — the Controls and the Benchmarks. Easy to type as CSI and mean something else entirely. source public

NIST, CSRC and NVD

NIST — the institute itself, which publishes the standards. source public
CSRC — the Computer Security Resource Center: where the publications live. source public
NVD — the National Vulnerability Database: CVEs and their scores, run by NIST but nothing to do with the standards. source public

800-53, 800-53A, 800-53B

SP 800-53 — the control catalogue: what must be true. source public
SP 800-53A — the assessment procedures: how an assessor would be convinced. source public
SP 800-53B — the baselines: which controls a low, moderate or high system gets. source public

What this page is not

It is not legal advice, and it is not a compliance determination: whether a given system is obliged to meet a given baseline is a question for the people who authorise it. Every link here goes to a publisher's own address, and the access chip says what that publisher requires of a reader — this site adds no access to anything. Nothing restricted is reproduced here. For the vocabulary, see how to read this site; for what this instance is actually holding, All standards and the change register.