Learn: where a rule comes from
The ladder gives you the four words — standard, baseline, control, setting. This page answers the next question: who wrote the rulebook, and under whose authority. Every control on this site arrived by the same route. A law obliges somebody to act; a policy says what acting looks like; a framework structures the work; a catalogue holds the controls; a baseline picks the ones your kind of system gets; a setting is how one of them is enforced on a real device; and a check proves it was. Each step below names its publishers, with the address their own words live at and what it takes to read them.
The chain, in one picture
- Law and contract what obliges anyone to do this at all
- Policy what the government or agency directs, under that law
- Framework how the work is structured: categorise, select, assess, authorise
- Control catalogue the controls themselves, written once for everyone
- Baseline the controls chosen for one kind of system
- Configuration setting how a control is enforced on a real device
- Check and evidence how conformance is expressed, measured and proved
Nothing is obliged to use the whole chain. A private business usually joins at the framework or the setting and has no policy rung at all; a DoD system has every rung and a second committee besides. That is what "normalised" means in practice, and the three traces below walk it.
Who publishes what, and for whom
The rows are the steps of the chain; the columns are who the publisher writes for. Reading across one row answers the question this page exists for: the same job, as NIST, DISA, NASA, CIS and the ACSC each answer it. Showing US defense alone.
| Step | US defenseDoD systems and national security systems |
|---|---|
| Law and contractwhat obliges anyone to do this at all | FISMA 2014DFARS 252.204-7012 |
| Policywhat the government or agency directs, under that law | DoDI 8500.01 and 8510.01CNSS policy |
| Frameworkhow the work is structured: categorise, select, assess, authorise | FIPS 199 and FIPS 200NIST SP 800-37 (RMF)CMMC |
| Control cataloguethe controls themselves, written once for everyone | NIST SP 800-53NIST SP 800-53ANIST SP 800-171 |
| Baselinethe controls chosen for one kind of system | CNSSI 1253DISA Security Requirements GuidesmacOS Security Compliance Project |
| Configuration settinghow a control is enforced on a real device | DISA STIGsDISA STIG GPO packageDISA STIG Intune packageMicrosoft security baselinesNSA Cybersecurity Information Sheets |
| Check and evidencehow conformance is expressed, measured and proved | Control Correlation IdentifiersOSCALSCAP and the National Checklist Program |
The same control, traced three ways
One control — a device that locks itself after a period of inactivity — carried down three different ladders. The control barely changes. Everything above and below it does.
A DoD system
The same control, a different committee, and a rule concrete enough to run.
-
Law and contract FISMA 2014
FISMA applies, and for a national security system CNSS policy applies instead of the civilian line.
-
Policy DoDI 8500.01 and 8510.01
DoD adopts the RMF and puts DISA's content in force: the STIG is policy, not advice.
-
Framework NIST SP 800-37 (RMF)
Categorise, select, implement, assess, authorise, monitor — with an authorising official who signs.
-
Control catalogue CNSSI 1253
The 800-53 catalogue with the national security baselines and overlays applied, so the selected set differs from the civilian one.
-
Baseline DISA Security Requirements Guides
The Operating System SRG: the OS must initiate a session lock after a period of inactivity.
-
Configuration setting DISA STIGs
A named rule for this exact Windows release, CAT II, with check text and fix text — the registry value, and the command to set it.
-
Check and evidence Control Correlation Identifiers
The rule cites a CCI, the CCI points back at AC-11, and a scanner's XCCDF result rolls the finding up to the control.
How they are normalised
Four mechanisms do nearly all the work of turning one body's rules into another's, and each one is public.
- Control Correlation Identifiers — DISA breaks each NIST SP 800-53 control statement into single testable assertions and numbers them. A STIG rule cites the CCI, the CCI names the control, and a pile of findings about registry values becomes an answer about controls. This is the one joint that makes a DoD scan report legible to a civilian assessor.
- OSCAL — a catalogue, a profile and a baseline as data rather than prose. A baseline becomes a document that says "this catalogue, these controls, these parameters", which a program resolves. It is how this instance reads 800-53 and 800-171 at all.
- SCAP and the National Checklist Program — XCCDF for the checklist, OVAL for the test, and the National Checklist Program as the public shelf. The same STIG exists twice: as prose for a person and as content for a scanner.
- macOS Security Compliance Project — the worked example. Each macOS rule carries its references to 800-53, 800-171, the STIG, CIS and CMMC at once, and the build emits whichever baseline you asked for. One rule, many citations: that is normalisation done at the source instead of afterwards.
And the two paths into private business
Nothing on this page obliges a company by itself. Federal rules reach private business two ways. By contract: DFARS 252.204-7012 flows NIST SP 800-171 down to every defense supplier, and CMMC audits it; FAR 52.204-21 sets a fifteen-requirement floor in almost every other federal contract. By market: FedRAMP baselines is met once and sold to every agency. Everything else — NIST CSF 2.0, CIS Critical Security Controls, ISO/IEC 27001 and 27002 — is adopted because a customer asked or because it is a good idea, and a company can leave at any time. Which of those applies to you is the first thing to settle, because it decides whether the rest of this page is a requirement or a reading list.
What this site does with all of it
One pipeline, the same for every publisher: fetch, keep the exact bytes, normalise into requirements or settings, diff field by field against the previous version, and record the publisher's own stated reason where there is one. So the change register can show a control before and after; Controls searches every tracked catalogue at once; and Baselines builds the strictest published set for a platform and lets you trim it. A machine-generated summary is always labelled as one, and never replaces the publisher's words.
Every body, with its source
21 of 35 publishers, writing for US defense · show all
US Congress (44 U.S.C. ch. 35)
The statute that makes every federal agency run an information security programme, and makes NIST's standards mandatory for the systems it covers.
This is the root of nearly every rule on this site. A federal control exists because FISMA says the agency must have one, not because a vendor recommends it.
- Derives from
- nothing on this page — it is a root
- Feeds into
- OMB Circular A-130, CISA directives, DoDI 8500.01 and 8510.01, NPR 2810.1, FIPS 199 and FIPS 200, NIST SP 800-37 (RMF), NIST SP 800-53
- Read it at
- The Act (S.2521, 113th Congress) public
- NIST's FISMA background public
US Department of Defense (DFARS)
The defense contract clause that flows NIST SP 800-171 down to any contractor holding controlled unclassified information, with incident reporting attached.
This clause is why a machine shop in Ohio has to care about a NIST publication. It is the normalisation path from federal rules to private business.
- Derives from
- nothing on this page — it is a root
- Feeds into
- CMMC, NIST SP 800-171
- Read it at
- DFARS 252.204-7012 public
US Department of Defense CIO
DoD's cybersecurity instruction and its adoption of the Risk Management Framework, which together put DISA's content in force across the department.
A STIG is not advice inside the DoD; it is policy, through these two instructions.
- Derives from
- FISMA 2014, CNSS policy
- Feeds into
- DISA Security Requirements Guides
- Read it at
- DoD issuances (8500 series) public
Committee on National Security Systems
The policy and instruction set for national security systems — classified and intelligence systems — above and apart from the civilian FISMA line.
This is why DoD and intelligence baselines differ from a civilian agency's: a different committee decides, and it adds overlays civilian systems never see.
- Derives from
- nothing on this page — it is a root
- Feeds into
- DoDI 8500.01 and 8510.01, CNSSI 1253
- Read it at
- CNSS issuances public some instructions are restricted; the index is public
NIST
FIPS 199 categorises a system low, moderate or high against confidentiality, integrity and availability; FIPS 200 sets the minimum requirements that follow.
The hinge of the whole federal chain: the category a system is given here is what decides which baseline it gets later.
- Derives from
- FISMA 2014
- Feeds into
- NIST SP 800-37 (RMF), NIST SP 800-53, NIST SP 800-53B
- Read it at
NIST
The Risk Management Framework: seven steps from preparing and categorising through selecting, implementing, assessing, authorising and monitoring controls.
The framework is the verb and the catalogue is the noun. RMF is how a control gets selected, assessed and signed off by somebody with a name.
- Derives from
- FISMA 2014, OMB Circular A-130, FIPS 199 and FIPS 200
- Feeds into
- nothing here derives from it yet
- Read it at
- SP 800-37 Rev. 2 public
US Department of Defense CIO
Cybersecurity Maturity Model Certification: the assessment and certification programme that turns SP 800-171 from a promise in a contract into an audited level.
The answer to 'who checks?' in private business. Level 2 is the SP 800-171 requirement set, assessed by a third party rather than self-attested.
- Derives from
- DFARS 252.204-7012, NIST SP 800-171 (and further up: NIST SP 800-53B, NIST SP 800-53, FIPS 199 and FIPS 200, FISMA 2014)
- Feeds into
- nothing here derives from it yet
- Read it at
- CMMC at DoD CIO public
NIST
The control catalogue: roughly a thousand controls and enhancements in twenty families, each a statement of what must be true, with discussion and related controls.
The single most derived-from document in this whole registry. STIGs, FedRAMP, 800-171, CNSSI 1253, the mSCP and NASA's own specifications all cut their rules out of this one.
- Derives from
- FISMA 2014, FIPS 199 and FIPS 200
- Feeds into
- NIST SP 800-53A, NIST SP 800-53B, CNSSI 1253, DISA Security Requirements Guides, NASA-SPEC-2600 (ASCS), macOS Security Compliance Project, Control Correlation Identifiers, OSCAL, SCAP and the National Checklist Program, CSET (CISA's assessment tool)
- Read it at
- SP 800-53 Rev. 5 public
- Release search (the controls themselves) public
- OSCAL content on GitHub public the machine-readable catalogue this instance reads
- On this instance
- 5.2.0 · 4 versions held · every version and what changed loaded Fri 23 Oct
NIST
The assessment procedures for the catalogue: for each control, what an assessor examines, interviews and tests.
The half of the catalogue people forget. A control says what must be true; 800-53A says what would convince somebody that it is.
- Derives from
- NIST SP 800-53 (and further up: FISMA 2014, FIPS 199 and FIPS 200)
- Feeds into
- nothing here derives from it yet
- Read it at
- SP 800-53A Rev. 5 public
- On this instance
- tracked as a source, nothing loaded yet
NIST
The requirements for protecting controlled unclassified information in systems that are not federal — tailored out of the moderate baseline, with the federal-only parts removed.
This is the normalisation, written down: SP 800-53 for government, SP 800-171 for everyone the government buys from. CMMC Level 2 is this set.
- Derives from
- NIST SP 800-53B, DFARS 252.204-7012 (and further up: NIST SP 800-53, FIPS 199 and FIPS 200, FISMA 2014)
- Feeds into
- CMMC, macOS Security Compliance Project
- Read it at
- SP 800-171 Rev. 3 public
- SP 800-171A (assessment) public
- On this instance
- OSCAL 1.1.0 · 2 versions held · every version and what changed loaded Fri 23 Oct
Committee on National Security Systems
Security categorisation and control selection for national security systems: the 800-53 catalogue with its own baselines and overlays.
The fork in the road. Two systems can hold the same data and get different control sets, because one is a national security system and the other is not.
- Derives from
- NIST SP 800-53, CNSS policy (and further up: FISMA 2014, FIPS 199 and FIPS 200)
- Feeds into
- DISA Security Requirements Guides, macOS Security Compliance Project
- Read it at
- CNSS instructions public
DISA (Defense Information Systems Agency)
Technology-class requirements — an operating system SRG, a web server SRG, a mobile policy SRG — written from the catalogue but not yet about any one product.
The missing middle most people skip. An SRG is where 'AC-11 Device Lock' becomes 'an operating system must lock after 15 minutes', before any vendor is named.
- Derives from
- NIST SP 800-53, CNSSI 1253, DoDI 8500.01 and 8510.01 (and further up: FISMA 2014, FIPS 199 and FIPS 200, CNSS policy)
- Feeds into
- DISA STIGs
- Read it at
- SRGs and STIGs public
NIST, with DISA, NASA and the Los Alamos National Laboratory
One rule set per macOS release, each rule carrying its references to 800-53, 800-171, the STIG, CIS and CMMC, from which any of those baselines can be generated.
The cleanest answer on this page to 'how are these normalised?'. One rule, many citations, and a build step that emits whichever baseline you asked for.
- Derives from
- NIST SP 800-53, NIST SP 800-171, CIS Benchmarks, DISA STIGs, CNSSI 1253 (and further up: FISMA 2014, FIPS 199 and FIPS 200, NIST SP 800-53B, DFARS 252.204-7012, CIS Critical Security Controls, DISA Security Requirements Guides, CNSS policy, DoDI 8500.01 and 8510.01)
- Feeds into
- nothing here derives from it yet
- Read it at
- macos_security on GitHub public
- On this instance
- iOS 26 Guidance, Revision 3.0 (6262df0) · 3 versions held · every version and what changed loaded 20 Oct
DISA (Defense Information Systems Agency)
Security Technical Implementation Guides: per-product rules, each with a severity (CAT I, II, III), the exact check text and the exact fix text.
The most concrete rung there is, and the reason this site exists. A STIG rule tells you the command to run, which no catalogue ever does — and because it is free and public, it is read far outside the DoD.
- Derives from
- DISA Security Requirements Guides (and further up: NIST SP 800-53, CNSSI 1253, DoDI 8500.01 and 8510.01, FISMA 2014, FIPS 199 and FIPS 200, CNSS policy)
- Feeds into
- NASA-SPEC-2600 (ASCS), macOS Security Compliance Project, DISA STIG GPO package, DISA STIG Intune package
- Read it at
- STIG downloads public
- STIG Viewer and tools public
- On this instance
- V1R1 · 19 versions held · every version and what changed loaded 20 Oct
DISA
The same STIG rules as Windows Group Policy objects, ready to import into a domain.
A rung below the rule: the policy file that actually sets the registry value the rule asks about.
- Derives from
- DISA STIGs (and further up: DISA Security Requirements Guides, NIST SP 800-53, CNSSI 1253, DoDI 8500.01 and 8510.01, FISMA 2014, FIPS 199 and FIPS 200, CNSS policy)
- Feeds into
- nothing here derives from it yet
- Read it at
- GPO package public
- On this instance
- October 2026 · 1 version held · every version and what changed loaded 17 Oct
DISA
The STIG rules expressed as Microsoft Intune settings-catalogue policies, for devices managed from the cloud rather than a domain.
The same control, the same rule, a third shape — which is what a configuration setting being platform-specific actually means in practice.
- Derives from
- DISA STIGs (and further up: DISA Security Requirements Guides, NIST SP 800-53, CNSSI 1253, DoDI 8500.01 and 8510.01, FISMA 2014, FIPS 199 and FIPS 200, CNSS policy)
- Feeds into
- nothing here derives from it yet
- Read it at
- STIG downloads public
- On this instance
- October 2026 · 1 version held · every version and what changed loaded 17 Oct
Microsoft
The vendor's own recommended settings for each Windows and Office release, shipped as GPO backups and policy rules in the Security Compliance Toolkit.
The vendor is a publisher too, and often the first one: Microsoft's baseline for a new Windows release lands months before the STIG for it does.
- Derives from
- nothing on this page — it is a root
- Feeds into
- nothing here derives from it yet
- Read it at
- Windows security baselines public
- Security Compliance Toolkit public what this instance reads
- On this instance
- v2 · 10 versions held · every version and what changed loaded 15 Oct
NSA Cybersecurity Information Sheets
Configuration settingUS defenseUS federal civilianPrivate businessUS National Security Agency
Short, specific hardening guidance on one subject at a time — network infrastructure, Kubernetes, PowerShell, cloud identity — often with other countries' agencies as co-signers.
The gap-filler. When something new needs hardening and no catalogue or benchmark covers it yet, this is usually the first public guidance to exist.
- Derives from
- nothing on this page — it is a root
- Feeds into
- nothing here derives from it yet
- Read it at
- Advisories and guidance public
DISA
A list that breaks each 800-53 control statement into single testable assertions, each with a CCI number that a STIG rule then cites.
The joint in the whole machine. A CCI is how 'this registry value' gets back to 'AC-11', and so how a pile of STIG findings becomes an answer about controls.
- Derives from
- NIST SP 800-53 (and further up: FISMA 2014, FIPS 199 and FIPS 200)
- Feeds into
- nothing here derives from it yet
- Read it at
- CCI list public
- On this instance
- 2026-07-14 · 1 version held · every version and what changed loaded 17 Oct
NIST
The Open Security Controls Assessment Language: catalogues, profiles, baselines, implementation statements and assessment results as JSON, XML or YAML.
The format that makes any of this computable. A baseline as an OSCAL profile is a document that says 'this catalogue, these controls, these parameters' — which a program can resolve, and a person cannot be trusted to.
- Derives from
- NIST SP 800-53 (and further up: FISMA 2014, FIPS 199 and FIPS 200)
- Feeds into
- nothing here derives from it yet
- Read it at
- OSCAL public
- NIST's OSCAL content public
SCAP and the National Checklist Program
Check and evidenceUS federal civilianUS defensePrivate businessNASANIST
XCCDF for the checklist, OVAL for the test, CPE for the product, and the NCP repository that holds the published checklists for each platform.
This is what a scanner reads. The same STIG exists as prose for a person and as SCAP content for a tool, and the NCP is the public shelf both come off.
- Derives from
- NIST SP 800-53 (and further up: FISMA 2014, FIPS 199 and FIPS 200)
- Feeds into
- nothing here derives from it yet
- Read it at
- National Checklist Program repository public
- SCAP public
Names that collide
Most of the difficulty in learning this field is that several different things share a name. Each reading below is real; none of them is the wrong answer, so the thing to do is say which one you mean.
- CSET
- NASA OCIO — the Cybersecurity Standards and Engineering Team, which writes NASA's own configuration specifications (the ASCS set). source agency sign-in
- CISA — the Cyber Security Evaluation Tool, free software for assessing yourself against a chosen standard. source public
- Georgetown University — the Center for Security and Emerging Technology, a policy research centre — no controls, no baselines. source public
- FISMA, not FISA
- FISMA — the Federal Information Security Modernization Act: the statute behind every federal control on this site. source public
- FISA — the Foreign Intelligence Surveillance Act: surveillance authority law. It publishes no controls, baselines or standards, and nothing on this site derives from it. source public
- CSI
- NIST, CSRC and NVD
- 800-53, 800-53A, 800-53B
What this page is not
It is not legal advice, and it is not a compliance determination: whether a given system is obliged to meet a given baseline is a question for the people who authorise it. Every link here goes to a publisher's own address, and the access chip says what that publisher requires of a reader — this site adds no access to anything. Nothing restricted is reproduced here. For the vocabulary, see how to read this site; for what this instance is actually holding, All standards and the change register.