Learn: where a rule comes from

The chain, in one picture

1. Law and contract what obliges anyone to do this at all
2. Policy what the government or agency directs, under that law
3. Framework how the work is structured: categorise, select, assess, authorise
4. Control catalogue the controls themselves, written once for everyone
5. Baseline the controls chosen for one kind of system
6. Configuration setting how a control is enforced on a real device
7. Check and evidence how conformance is expressed, measured and proved

Nothing is obliged to use the whole chain. A private business usually joins at the framework or the setting and has no policy rung at all; a DoD system has every rung and a second committee besides. That is what "normalised" means in practice, and the three traces below walk it.

How they are normalised

Four mechanisms do nearly all the work of turning one body's rules into another's, and each one is public.

• Control Correlation Identifiers — DISA breaks each NIST SP 800-53 control statement into single testable assertions and numbers them. A STIG rule cites the CCI, the CCI names the control, and a pile of findings about registry values becomes an answer about controls. This is the one joint that makes a DoD scan report legible to a civilian assessor.
• OSCAL — a catalogue, a profile and a baseline as data rather than prose. A baseline becomes a document that says "this catalogue, these controls, these parameters", which a program resolves. It is how this instance reads 800-53 and 800-171 at all.
• SCAP and the National Checklist Program — XCCDF for the checklist, OVAL for the test, and the National Checklist Program as the public shelf. The same STIG exists twice: as prose for a person and as content for a scanner.
• macOS Security Compliance Project — the worked example. Each macOS rule carries its references to 800-53, 800-171, the STIG, CIS and CMMC at once, and the build emits whichever baseline you asked for. One rule, many citations: that is normalisation done at the source instead of afterwards.

And the two paths into private business

Nothing on this page obliges a company by itself. Federal rules reach private business two ways. By contract: DFARS 252.204-7012 flows NIST SP 800-171 down to every defense supplier, and CMMC audits it; FAR 52.204-21 sets a fifteen-requirement floor in almost every other federal contract. By market: FedRAMP baselines is met once and sold to every agency. Everything else — NIST CSF 2.0, CIS Critical Security Controls, ISO/IEC 27001 and 27002 — is adopted because a customer asked or because it is a good idea, and a company can leave at any time. Which of those applies to you is the first thing to settle, because it decides whether the rest of this page is a requirement or a reading list.

What this site does with all of it

One pipeline, the same for every publisher: fetch, keep the exact bytes, normalise into requirements or settings, diff field by field against the previous version, and record the publisher's own stated reason where there is one. So the change register can show a control before and after; Controls searches every tracked catalogue at once; and Baselines builds the strictest published set for a platform and lets you trim it. A machine-generated summary is always labelled as one, and never replaces the publisher's words.

Names that collide

Most of the difficulty in learning this field is that several different things share a name. Each reading below is real; none of them is the wrong answer, so the thing to do is say which one you mean.

CSET

• NASA OCIO — the Cybersecurity Standards and Engineering Team, which writes NASA's own configuration specifications (the ASCS set). source agency sign-in
• CISA — the Cyber Security Evaluation Tool, free software for assessing yourself against a chosen standard. source public
• Georgetown University — the Center for Security and Emerging Technology, a policy research centre — no controls, no baselines. source public

FISMA, not FISA

• FISMA — the Federal Information Security Modernization Act: the statute behind every federal control on this site. source public
• FISA — the Foreign Intelligence Surveillance Act: surveillance authority law. It publishes no controls, baselines or standards, and nothing on this site derives from it. source public

CSI

• NSA — a Cybersecurity Information Sheet: short hardening guidance on one subject. source public
• CIS — the Center for Internet Security — the Controls and the Benchmarks. Easy to type as CSI and mean something else entirely. source public

NIST, CSRC and NVD

• NIST — the institute itself, which publishes the standards. source public
• CSRC — the Computer Security Resource Center: where the publications live. source public
• NVD — the National Vulnerability Database: CVEs and their scores, run by NIST but nothing to do with the standards. source public

800-53, 800-53A, 800-53B

• SP 800-53 — the control catalogue: what must be true. source public
• SP 800-53A — the assessment procedures: how an assessor would be convinced. source public
• SP 800-53B — the baselines: which controls a low, moderate or high system gets. source public

What this page is not

It is not legal advice, and it is not a compliance determination: whether a given system is obliged to meet a given baseline is a question for the people who authorise it. Every link here goes to a publisher's own address, and the access chip says what that publisher requires of a reader — this site adds no access to anything. Nothing restricted is reproduced here. For the vocabulary, see how to read this site; for what this instance is actually holding, All standards and the change register.