Tracked standards
Every release of each standard is kept as a snapshot. Two snapshots of the same document give a change list: each control or setting before and after, what changed, and the publisher's stated reason.
-
Ad canaries (EasyList)202610271405 · 2026-10-27
Twelve ad domains derived from EasyList: of the rules that block a domain outright (||domain^, with or without $third-party), the twelve whose names hash lowest under SHA-256, so nobody chose them and the set moves only when the list drops one or gains a name that hashes lower. The network check (M12.3) resolves them through the LAN resolver and does nothing else with them. Checked weekly; the list itself moves several times a day.
-
AdFection / Candiru DNS blocklist (Zero Breach)2026-10-18 (7253316) · 2026-10-18
The plain-domain export of the indicator list (291 domains when added), the form a Pi-hole or AdGuard Home takes as an adlist: one requirement per domain, so a release shows which domains came and went.
-
AdFection / Candiru ad blocklist (Zero Breach)2026-10-18 (7253316) · 2026-10-18
The Adblock Plus, uBlock Origin and AdGuard export of the same indicators, one ||domain^ rule each, for a browser blocker's custom list.
-
AdFection / Candiru indicators (Zero Breach)2026-10-18 (7253316) · 2026-10-18
The AdFection / Candiru indicator list: every domain, address and file hash with its tier (command-and-control, validator, ad delivery, historical, sample, abused driver), its confidence and the report it was read from, one line each. The current commit is read from the GitHub API, and the commit's first line is the release's reason. Indicators are quoted, never fetched and never linked.
-
CIS Benchmarks (manual upload)Waiting for your first upload
Registration-walled PDFs; upload your copy and diff locally.
-
ComplianceAsCode/contentNo snapshot yet
Open STIG/CIS profiles; git history is the diff.
-
DISA Control Correlation Identifiers (CCI)2026-07-14 · 2026-07-15
The CCI list DISA publishes: each identifier's definition and its index into NIST SP 800-53 Revisions 4 and 5. It is the join between every STIG rule and the Register's control pages. Found through the STIG library listing, so an unchanged list costs one small request.
-
DISA STIG GPO package checklistsOctober 2026 · 2026-10-16
The checklists in DISA's GPO package: for every rule of each STIG it provides policies for, DISA's own verdict on whether its GPO and Intune policies set it or it is outside their scope. The GPO backups themselves are not parsed. Found through the STIG library listing ("Group Policy Objects (GPOs) - <month>").
-
DISA STIG Intune policy packageOctober 2026 · 2026-10-16
The settings-catalog policies DISA ships for its STIGs (Windows 11 and 10, Edge, Chrome, Defender, the firewall, Microsoft 365 Apps), one setting per row with its value, diffed package by package. Found through the STIG library listing ("Intune Policy - <month>"), so an unchanged package costs one small request.
-
DISA STIG libraryV1R1 · 2026-10-13
The STIG document library, read through the site's own Apex listing call. Only the STIGs on your watchlist (kind "baseline", a name such as "Windows Server 2025") or the default set are downloaded: Windows 11, Windows Server 2025 and 2022, Red Hat Enterprise Linux 9 and 10, Ubuntu 24.04 and 22.04, Apple macOS 26 and 15, Apple iOS/iPadOS 27 and 26, Google Android 17 and 16, Samsung Android 17 and 16 with Knox, Microsoft Edge, Google Chrome, Mozilla Firefox, Cisco IOS XE Router, Application Security and Development. Each release is diffed rule by rule.
-
FedRAMP Consolidated Rules (2026)2026.10.13.01 · 2026-10-13
FRR rules, KSI indicators, FRD definitions and CTL parameter selections, each with FedRAMP's dated change notes. Published at https://github.com/FedRAMP/rules.
-
Malware canaries (URLhaus)2026-10-21 13:58 UTC · 2026-10-21
Twelve malware-hosting names derived from URLhaus's host file (the hosts of malware URLs online right now, the list a Pi-hole takes): registrable names only (two labels once a leading www. is dropped; no addresses, no subdomains of shared platforms), the twelve that hash lowest. Checked daily because the host file turns over as sites go offline.
-
Microsoft Security Baselines (SCT)v2 · 2026-10-08
Every "Security Baseline" zip in the Security Compliance Toolkit, diffed setting by setting from its .PolicyRules file (registry values, security template lines, audit subcategories). Licence: Microsoft; snapshots stay local.
-
NASA Cybersecurity Policy Reference (OCIO/CSET)as of 2026-09-15 · 2026-09-15
The quarterly reference from NASA OCIO's Cybersecurity Policy Team: directives, advisory implementing instructions, handbooks, NASA standards (including NASA-SPEC-2600, the enumeration of ASCS cybersecurity requirements), memoranda, and the FIPS and NIST documents NASA cites, each row diffed between editions. The per-OS ASCS standards live on cset.nasa.gov behind a NASA sign-in and are not public; this list is the public knowledge of them.
-
NIST PIV and digital identitySP 800-63C-4 · 2025-07-31
FIPS 201-3 and the PIV special publications (SP 800-73-5 parts 1 to 3, 76-2, 78-5, 79-2, 85A-4, 87r2, 96, 116r1, 156, 157r1 draft, 217 draft, IR 7863) and the SP 800-63-4 Digital Identity Guidelines, each read from its CSRC page and diffed section by section when a revision is published. The first fetch also loads the revision each one superseded, so the first diff is real.
-
NIST SP 800-171 Rev 3 (CUI; CMMC Level 2)OSCAL 1.1.0 · 2026-10-22
The 97 security requirements for protecting Controlled Unclassified Information, with their assessment objectives and organization-defined parameters; requirements withdrawn from Revision 2 are kept as withdrawn. Versions are NIST's OSCAL conversions of Revision 3 (the publication dates from May 2024); tracking starts at OSCAL 1.1.0 because 1.0.0 left 29 statements empty, so a diff against it would show a conversion fix as a change to the publication.
-
NIST SP 800-53 (controls)5.2.0 · 2026-10-22
The OSCAL catalog NIST publishes, which carries both the 800-53 controls and the 800-53A assessment objectives. Current Release 5.2.0 (2025-08-27). History is loaded from the same repository's commits.
-
NIST SP 800-53A (assessment)No snapshot yet
Folded into the 800-53 catalog, which carries the assessment objectives; shown there as the assessment text of each control.
-
NIST SP 800-53B (baselines)5.2.0 · 2026-10-22
The Low, Moderate, High and Privacy baseline profiles. Each release is diffed as control membership: which controls joined or left a baseline.
-
NIST macOS Security Compliance ProjectTahoe Guidance, Revision 3.0 (cf656e8) · 2026-06-25
One branch per Apple release (tahoe and sequoia for macOS, ios_26 for iOS and iPadOS; a watchlist entry of kind "baseline" written "mscp: <branch>" follows others). Every rule with its check, fix, configuration-profile payload keys, severity and its SP 800-53 r5, 800-171 r3, CCI, STIG and CIS references; which baselines (800-53 High, DISA STIG, CIS Level 1 and 2, CMMC) list it. The branch's current commit is read from the GitHub API, so an unchanged branch costs one small request.
-
NIST platform security: roots of trust, firmware and secure enclavesIR 8320D (Draft) · 2023-02-23
FIPS 140-3, SP 800-147 and 147B (BIOS protection), 800-193 (platform firmware resiliency), 800-124r2 (mobile devices), 800-219r1 (macOS Security Compliance Project), 800-57 Part 1 (key management) and IR 8320, 8320A, 8320B and 8320D (hardware-enabled security, confidential computing), each read from its CSRC page and diffed section by section when a revision is published.
-
Phishing canaries (OpenPhish)No snapshot yet
Twelve phishing hosts derived from the OpenPhish Community Feed (refreshed every twelve hours) the same way as the malware canaries: registrable names only, the twelve that hash lowest; each entry keeps the origin alone, never a path. OpenPhish's terms forbid showing any part of the feed to third parties, so this source is restricted: the signed-in owner sees the names, a visitor sees the versions and counts only, and the API and MCP tools return neither. Registered off until the owner turns it on from the Sources page.
-
Tracker canaries (EasyPrivacy)202610271409 · 2026-10-27
Twelve tracker domains derived from EasyPrivacy the same way as the ad canaries: the outright domain rules whose names hash lowest. Resolved by the network check, never loaded. Checked weekly.