User Intent	Framework	Reference Path
Security/privacy controls, control families, control baselines	SP 800-53 Rev 5	`references/800-53/`
Protecting Controlled Unclassified Information (CUI), CMMC	SP 800-171 Rev 3	`references/800-171/`
Assessment procedures, control testing, evidence	SP 800-53A Rev 5	`references/800-53a/`
Cybersecurity Framework, CSF functions, categories, subcategories	CSF 2.0	`references/csf/`
Risk Management Framework, authorization, ATO	SP 800-37 Rev 2	`references/800-37/`
Zero Trust Architecture, ZTA	SP 800-207	`references/800-207/`
Risk assessment, threat modeling	SP 800-30 Rev 1	`references/800-30/`
Incident response, handling, reporting	SP 800-61 Rev 3	`references/800-61/`
Digital identity, authentication, identity proofing	SP 800-63 Rev 4	`references/800-63/`
Supply chain risk management, C-SCRM	SP 800-161 Rev 1	`references/800-161/`
Cryptographic modules, security categorization, minimum security	FIPS	`references/fips/`
Cross-framework mappings, baselines, control relationships	Cross-References	`references/cross-references/`
Definitions, terms, acronyms	Glossary	`references/glossary.md`

SP 800-53 Rev 5 — Control Families Quick Reference

These are the 20 control families. Each has a dedicated reference file.

Code	Family	File	Controls
AC	Access Control	`references/800-53/ac.md`	AC-1 through AC-25
AT	Awareness and Training	`references/800-53/at.md`	AT-1 through AT-6
AU	Audit and Accountability	`references/800-53/au.md`	AU-1 through AU-16
CA	Assessment, Authorization, and Monitoring	`references/800-53/ca.md`	CA-1 through CA-9
CM	Configuration Management	`references/800-53/cm.md`	CM-1 through CM-14
CP	Contingency Planning	`references/800-53/cp.md`	CP-1 through CP-13
IA	Identification and Authentication	`references/800-53/ia.md`	IA-1 through IA-13
IR	Incident Response	`references/800-53/ir.md`	IR-1 through IR-10
MA	Maintenance	`references/800-53/ma.md`	MA-1 through MA-7
MP	Media Protection	`references/800-53/mp.md`	MP-1 through MP-8
PE	Physical and Environmental Protection	`references/800-53/pe.md`	PE-1 through PE-23
PL	Planning	`references/800-53/pl.md`	PL-1 through PL-11
PM	Program Management	`references/800-53/pm.md`	PM-1 through PM-32
PS	Personnel Security	`references/800-53/ps.md`	PS-1 through PS-9
PT	PII Processing and Transparency	`references/800-53/pt.md`	PT-1 through PT-8
RA	Risk Assessment	`references/800-53/ra.md`	RA-1 through RA-10
SA	System and Services Acquisition	`references/800-53/sa.md`	SA-1 through SA-23
SC	System and Communications Protection	`references/800-53/sc.md`	SC-1 through SC-51
SI	System and Information Integrity	`references/800-53/si.md`	SI-1 through SI-23
SR	Supply Chain Risk Management	`references/800-53/sr.md`	SR-1 through SR-12

CSF 2.0 — Functions Quick Reference

Function	Code	File	Focus
Govern	GV	`references/csf/govern.md`	Organizational context, strategy, policy, roles, oversight
Identify	ID	`references/csf/identify.md`	Asset management, risk assessment, improvement
Protect	PR	`references/csf/protect.md`	Access control, training, data security, platform security
Detect	DE	`references/csf/detect.md`	Continuous monitoring, adverse event analysis
Respond	RS	`references/csf/respond.md`	Incident management, analysis, mitigation, reporting
Recover	RC	`references/csf/recover.md`	Recovery planning, execution, communication

Common Tasks

Find controls for a specific topic

Identify the relevant control family from the table above
Load the family reference file (e.g., references/800-53/ac.md for Access Control)
Search for the specific control by ID or keyword

Compare FedRAMP baselines

Load references/cross-references/baselines.md
Look up Low, Moderate, or High baseline control selections
Cross-reference with specific control family files for details

Map 800-53 controls to CSF

Load references/cross-references/800-53-to-csf.md
Find the CSF function/category of interest
See which 800-53 controls implement that category

Map 800-53 to 800-171

Load references/cross-references/800-53-to-800-171.md
Find the 800-53 control of interest
See the corresponding 800-171 requirement (if any)

Look up related controls

Load the family reference file (e.g., references/800-53/ac.md)
Each non-withdrawn control has a **Related Controls:** line listing cross-references
These are sourced from the authoritative NIST OSCAL catalog

Check baseline applicability

Each non-withdrawn control has a **Baselines:** line showing Low, Moderate, and/or High
For a full listing: python scripts/lookup.py baseline moderate (or low, high)
Filter by family: python scripts/lookup.py baseline moderate AC
See also references/cross-references/baselines.md for FedRAMP details

Map CSF 2.0 to 800-53 controls

By function: python scripts/lookup.py map csf PR (shows all Protect mappings)
By category: python scripts/lookup.py map csf PR.AA (shows specific category)
Or load references/cross-references/800-53-to-csf.md directly

Look up assessment procedures

Identify the control from 800-53
Load the corresponding family file under references/800-53a/
Find the assessment objectives and methods

Understand a NIST term

Load references/glossary.md
Search for the term alphabetically

Cross-Framework Relationships

CSF 2.0 (strategic)
  └── SP 800-37 (RMF process)
       └── SP 800-53 Rev 5 (controls catalog)
            ├── SP 800-53A Rev 5 (assessment procedures)
            ├── SP 800-171 Rev 3 (CUI subset → CMMC)
            ├── SP 800-30 (risk assessment for control selection)
            └── FedRAMP Baselines (Low/Moderate/High selections)

Supporting Publications:
  ├── SP 800-207 (Zero Trust Architecture)
  ├── SP 800-61 (Incident Response)
  ├── SP 800-63 (Digital Identity)
  ├── SP 800-161 (Supply Chain Risk)
  └── FIPS 140-3, 199, 200 (foundational standards)

Usage Notes

Control IDs follow the pattern: {FAMILY}-{NUMBER} (e.g., AC-2, SI-4)
Enhancements append a parenthetical: AC-2(1), SI-4(5)
Baselines: Low ⊂ Moderate ⊂ High (each higher baseline includes all controls from lower ones). Each control in 800-53 files has a **Baselines:** tag showing which baselines include it.
Related Controls: Every non-withdrawn control has a **Related Controls:** line sourced from the NIST OSCAL catalog.
800-171 requirements map to a subset of 800-53 Moderate baseline controls
CSF categories use dot notation: GV.OC-01, PR.AC-01
OSCAL (Open Security Controls Assessment Language) provides machine-readable versions of these frameworks

Data Sources

Reference content is derived from:

Dataset: ethanolivertroy/nist-cybersecurity-training (530,912 structured examples from 596 NIST publications)
Raw PDFs: ethanolivertroy/nist-publications-raw (596 PDFs, 2 GB)
NIST OSCAL: Official machine-readable catalogs for 800-53, 800-171, and FedRAMP baselines

nist-cybersecurity-skills

NIST Cybersecurity Skills

Framework Routing