@portll/cobolwork 0.0.1 → 0.2.76

package/rules/compliance-nist80053.json

@@ -0,0 +1,2134 @@
+{
+ "schemaVersion": 1,
+ "framework": "nist-800-53r5",
+ "instrument": "NIST SP 800-53 Rev. 5.2.0",
+ "source": "https://github.com/usnistgov/oscal-content (NIST_SP-800-53_rev5_catalog.json)",
+ "retrieved": "2026-09-20",
+ "verified": "Every quote was matched verbatim against the cited instrument. The choice of clause is a human judgement and has not been reviewed by a qualified assessor.",
+ "coverage": "Control statements only, from the OSCAL catalogue. Assessment procedures, control enhancements not listed here, and the parameter values an organisation chooses are outside it.",
+ "appliesToTool": [
+  {
+   "clause": "SA-11(1)",
+   "title": "Static Code Analysis",
+   "quote": "Require the developer of the system, system component, or system service to employ static code analysis tools to identify common flaws and document the results of the analysis."
+  }
+ ],
+ "unmapped": [
+  {
+   "ruleId": "recon-production-name-outside-production",
+   "why": "No control in SP 800-53 covers the disclosure of internal system naming in source. CM-8 is about maintaining an inventory, not about where its contents appear; SC-7 is about interfaces. Mapping to either would be a near miss."
+  },
+  {
+   "ruleId": "recon-routable-address-committed",
+   "why": "As above. The nearest control, SC-7, governs the interface rather than the disclosure of its address in a repository."
+  }
+ ],
+ "rows": [
+  {
+   "kind": "compliance",
+   "ruleId": "agent-directive-in-comment",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: A comment tells its reader to ignore instructions, or to fetch and run something. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "argv-or-env-to-arithmetic",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: Command-line or environment input reaches arithmetic on a decimal field, where bytes that are not digits abend the program. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "argv-or-env-to-cics-dynamic-transfer",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: Command-line or environment input decides which program CICS transfers to. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "argv-or-env-to-dynamic-file-path",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: Command-line or environment input decides which file is opened. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "argv-or-env-to-dynamic-program-load",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: Command-line or environment input decides which program is called. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "argv-or-env-to-dynamic-sql",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: Command-line or environment input reaches dynamic SQL. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "argv-or-env-to-internal-reader",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: Command-line or environment input is written into a job the internal reader submits. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "argv-or-env-to-loop-bound",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: Command-line or environment input decides how far a loop that subscripts a table runs. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "argv-or-env-to-occurs-depending-count",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: Command-line or environment input decides how many entries an OCCURS DEPENDING ON table holds. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "argv-or-env-to-os-command",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: Command-line or environment input reaches an operating-system command routine. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "argv-or-env-to-reference-modification",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: Command-line or environment input decides where a reference modification starts or how long it is. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "argv-or-env-to-subscript",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: Command-line or environment input is used as a subscript. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "bidi-or-invisible-characters",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: Characters that reorder or hide text appear in the source. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "build-pins-exploited-compiler",
+   "framework": "nist-800-53r5",
+   "clause": "SI-2",
+   "title": "Flaw Remediation",
+   "rationale": "The rule reports: The build pins a compiler version with a vulnerability CISA lists as known to be exploited. That is a known system flaw present in the build, which this control requires be identified, reported and corrected.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Identify, report, and correct system flaws"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "build-pins-exploited-component",
+   "framework": "nist-800-53r5",
+   "clause": "SI-2",
+   "title": "Flaw Remediation",
+   "rationale": "The rule reports: The build pins a component version with a vulnerability CISA lists as known to be exploited. That is a known system flaw present in the build, which this control requires be identified, reported and corrected.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Identify, report, and correct system flaws"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "build-pins-vulnerable-compiler",
+   "framework": "nist-800-53r5",
+   "clause": "SI-2",
+   "title": "Flaw Remediation",
+   "rationale": "The rule reports: The build pins a compiler version with a published advisory against it. That is a known system flaw present in the build, which this control requires be identified, reported and corrected.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Identify, report, and correct system flaws"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "build-pins-vulnerable-component",
+   "framework": "nist-800-53r5",
+   "clause": "SI-2",
+   "title": "Flaw Remediation",
+   "rationale": "The rule reports: The build pins a component version with a published advisory against it. That is a known system flaw present in the build, which this control requires be identified, reported and corrected.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Identify, report, and correct system flaws"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "call-parameter-exceeds-argument",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: A called program declares a parameter longer than the field its caller passes, reaching into the fields beside it. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "call-parameter-exceeds-caller-record",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: A called program declares a parameter longer than the whole record its caller passes. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-commarea-length-exceeds-area",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: A CICS call passes a length longer than the area it passes. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-commarea-length-exceeds-callee",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: A CICS call passes a length longer than the callee declares. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-commarea-without-length-check",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: A program reads its communication area without checking EIBCALEN. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-listener-accepts-cleartext",
+   "framework": "nist-800-53r5",
+   "clause": "SC-8",
+   "title": "Transmission Confidentiality and Integrity",
+   "rationale": "The rule reports: A CICS listener accepts connections without TLS. That is information crossing a network with nothing protecting it, which this control requires be protected in transit.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Protect the {{ insert: param, sc-08_odp }} of transmitted information."
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-protected-field-to-record-key",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: A field the map protects, which a modified 3270 client can change, decides which record the program reads or browses from. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-protected-field-to-record-update",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: A field the map protects, which a modified 3270 client can change, decides which record the program changes or deletes. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-signon-bypassed",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: A route reaches the program a sign-on grants without passing the password check. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-signon-password",
+   "framework": "nist-800-53r5",
+   "clause": "IA-5",
+   "title": "Authenticator Management",
+   "rationale": "The rule reports: Credential pattern: cics signon password. That is authenticator content established in a file rather than managed, which is what this control governs.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Establishing initial authenticator content for any authenticators issued by the organization"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-signon-says-which-half-failed",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: A sign-on answers a bad user and a bad password differently. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-terminal-to-arithmetic",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: Terminal input reaches arithmetic on a decimal field, where bytes that are not digits abend the program. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-terminal-to-cics-dynamic-transfer",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: Terminal input decides which program CICS transfers to. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-terminal-to-dynamic-file-path",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: Terminal input decides which file is opened. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-terminal-to-dynamic-program-load",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: Terminal input decides which program is called. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-terminal-to-dynamic-sql",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: Terminal input reaches dynamic SQL. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-terminal-to-http-header",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: Terminal input is written into a header of the response. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-terminal-to-internal-reader",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: Terminal input is written into a job the internal reader submits. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-terminal-to-log",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: Terminal input is written to a log unchecked, where control characters in it can start a line the program did not write. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-terminal-to-loop-bound",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: Terminal input decides how far a loop that subscripts a table runs. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-terminal-to-occurs-depending-count",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: Terminal input decides how many entries an OCCURS DEPENDING ON table holds. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-terminal-to-os-command",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: Terminal input reaches an operating-system command routine. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-terminal-to-outbound-host",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: Terminal input decides the host or path this program sends a request to. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-terminal-to-queue-name",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: Terminal input names the queue a command reads, writes or deletes. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-terminal-to-reference-modification",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: Terminal input decides where a reference modification starts or how long it is. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-terminal-to-subscript",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: Terminal input is used as a subscript. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-terminal-to-web-response",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: Terminal input is written into the response this program returns. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-transfer-to-variable-program",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: CICS transfers control to a program named by a variable. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-web-to-arithmetic",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: Web input reaches arithmetic on a decimal field, where bytes that are not digits abend the program. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-web-to-cics-dynamic-transfer",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: Web input decides which program CICS transfers to. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-web-to-dynamic-file-path",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: Web input decides which file is opened. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-web-to-dynamic-program-load",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: Web input decides which program is called. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-web-to-dynamic-sql",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: Web input reaches dynamic SQL. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-web-to-http-header",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: Web input is written into a header of the response. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-web-to-internal-reader",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: Web input is written into a job the internal reader submits. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-web-to-log",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: Web request data is written to a log unchecked, where control characters in it can start a line the program did not write. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-web-to-loop-bound",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: Web input decides how far a loop that subscripts a table runs. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-web-to-occurs-depending-count",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: Web input decides how many entries an OCCURS DEPENDING ON table holds. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-web-to-os-command",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: Web input reaches an operating-system command routine. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-web-to-outbound-host",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: Web input decides the host or path this program sends a request to. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-web-to-queue-name",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: Web input names the queue a command reads, writes or deletes. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-web-to-reference-modification",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: Web input decides where a reference modification starts or how long it is. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-web-to-subscript",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: Web input is used as a subscript. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-web-to-web-response",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: Web input is written into the response this program returns. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "cobol-value-credential",
+   "framework": "nist-800-53r5",
+   "clause": "IA-5",
+   "title": "Authenticator Management",
+   "rationale": "The rule reports: Credential pattern: cobol value credential. That is authenticator content established in a file rather than managed, which is what this control governs.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Establishing initial authenticator content for any authenticators issued by the organization"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "compile-undefined-name",
+   "framework": "nist-800-53r5",
+   "clause": "CM-8",
+   "title": "System Component Inventory",
+   "rationale": "The rule reports: A program uses names that nothing it declares or copies defines, so it cannot compile. That is a component the inventory does not accurately account for, which this control requires be documented.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Develop and document an inventory of system components"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "copybook-shadowed",
+   "framework": "nist-800-53r5",
+   "clause": "CM-8",
+   "title": "System Component Inventory",
+   "rationale": "The rule reports: Two copybooks with different contents answer to the same name, and programs resolve it to different files. That is a component the inventory does not accurately account for, which this control requires be documented.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Develop and document an inventory of system components"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "copybook-shadows-system",
+   "framework": "nist-800-53r5",
+   "clause": "CM-8",
+   "title": "System Component Inventory",
+   "rationale": "The rule reports: A copybook in the repository has the name of a system copybook, and is found before it. That is a component the inventory does not accurately account for, which this control requires be documented.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Develop and document an inventory of system components"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "csd-defines-diagnostic-transaction",
+   "framework": "nist-800-53r5",
+   "clause": "AC-6",
+   "title": "Least Privilege",
+   "rationale": "The rule reports: A definition in this repository installs one of the CICS diagnostic transactions. That is authority granted or exercised beyond what the task requires, which this control exists to prevent.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks."
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "csd-transaction-without-command-security",
+   "framework": "nist-800-53r5",
+   "clause": "AC-6",
+   "title": "Least Privilege",
+   "rationale": "The rule reports: A transaction whose program issues system commands runs without command security. That is authority granted or exercised beyond what the task requires, which this control exists to prevent.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks."
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "database-to-cics-dynamic-transfer",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: A database value decides which program CICS transfers to. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "database-to-dynamic-file-path",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: A database value decides which file is opened. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "database-to-dynamic-program-load",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: A database value decides which program is called. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "database-to-dynamic-sql",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: A database value reaches dynamic SQL. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "database-to-extrapartition-queue",
+   "framework": "nist-800-53r5",
+   "clause": "SC-7",
+   "title": "Boundary Protection",
+   "rationale": "The rule reports: A database value is written to a transient-data queue that leaves the region. That is information crossing a managed interface through a channel the program opened itself, which this control requires be monitored and controlled.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Monitor and control communications at the external managed interfaces to the system and at key internal managed interfaces within the system"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "database-to-http-header",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: A database value is written into a header of the response. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "database-to-internal-reader",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: A database value is written into a job the internal reader submits. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "database-to-message-queue",
+   "framework": "nist-800-53r5",
+   "clause": "SC-7",
+   "title": "Boundary Protection",
+   "rationale": "The rule reports: A database value is put on a message queue. That is information crossing a managed interface through a channel the program opened itself, which this control requires be monitored and controlled.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Monitor and control communications at the external managed interfaces to the system and at key internal managed interfaces within the system"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "database-to-os-command",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: A database value reaches an operating-system command routine. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "database-to-outbound-host",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: A database value decides the host or path this program sends a request to. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "database-to-outbound-http",
+   "framework": "nist-800-53r5",
+   "clause": "SC-7",
+   "title": "Boundary Protection",
+   "rationale": "The rule reports: A database value is sent to a remote server over HTTP. That is information crossing a managed interface through a channel the program opened itself, which this control requires be monitored and controlled.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Monitor and control communications at the external managed interfaces to the system and at key internal managed interfaces within the system"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "database-to-queue-name",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: A database value names the queue a command reads, writes or deletes. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "database-to-socket-send",
+   "framework": "nist-800-53r5",
+   "clause": "SC-7",
+   "title": "Boundary Protection",
+   "rationale": "The rule reports: A database value is written to a network socket. That is information crossing a managed interface through a channel the program opened itself, which this control requires be monitored and controlled.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Monitor and control communications at the external managed interfaces to the system and at key internal managed interfaces within the system"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "database-to-web-response",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: A database value is written into the response this program returns. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "diff-interface-layout-changed",
+   "framework": "nist-800-53r5",
+   "clause": "CM-3",
+   "title": "Configuration Change Control",
+   "rationale": "The rule reports: A record this program passes to or receives from another program changed size or position. That is the security impact of a proposed change, which this control requires be considered explicitly before the change is approved.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Review proposed configuration-controlled changes to the system and approve or disapprove such changes with explicit consideration for security and privacy impact analyses"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "diff-layout-changed",
+   "framework": "nist-800-53r5",
+   "clause": "CM-3",
+   "title": "Configuration Change Control",
+   "rationale": "The rule reports: Fields in this program changed size or position. That is the security impact of a proposed change, which this control requires be considered explicitly before the change is approved.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Review proposed configuration-controlled changes to the system and approve or disapprove such changes with explicit consideration for security and privacy impact analyses"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "diff-layout-changed-unedited-program",
+   "framework": "nist-800-53r5",
+   "clause": "CM-3",
+   "title": "Configuration Change Control",
+   "rationale": "The rule reports: Fields in this program changed size or position although its own source did not change. That is the security impact of a proposed change, which this control requires be considered explicitly before the change is approved.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Review proposed configuration-controlled changes to the system and approve or disapprove such changes with explicit consideration for security and privacy impact analyses"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "diff-new-call-target",
+   "framework": "nist-800-53r5",
+   "clause": "CM-3",
+   "title": "Configuration Change Control",
+   "rationale": "The rule reports: The change makes this program call or transfer to a program it did not before. That is the security impact of a proposed change, which this control requires be considered explicitly before the change is approved.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Review proposed configuration-controlled changes to the system and approve or disapprove such changes with explicit consideration for security and privacy impact analyses"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "diff-new-dynamic-call",
+   "framework": "nist-800-53r5",
+   "clause": "CM-3",
+   "title": "Configuration Change Control",
+   "rationale": "The rule reports: The change adds a call or transfer whose target is a variable. That is the security impact of a proposed change, which this control requires be considered explicitly before the change is approved.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Review proposed configuration-controlled changes to the system and approve or disapprove such changes with explicit consideration for security and privacy impact analyses"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "display-echoes-a-credential",
+   "framework": "nist-800-53r5",
+   "clause": "SI-11",
+   "title": "Error Handling",
+   "rationale": "The rule reports: A program displays a credential back to the terminal or HTTP request that supplied it. That is the system emitting information that could be exploited, to a destination read by people the record was never for, which this control requires it not do.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Generate error messages that provide information necessary for corrective actions without revealing information that could be exploited"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "embedded-sql-connect-password",
+   "framework": "nist-800-53r5",
+   "clause": "IA-5",
+   "title": "Authenticator Management",
+   "rationale": "The rule reports: Credential pattern: embedded sql connect password. That is authenticator content established in a file rather than managed, which is what this control governs.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Establishing initial authenticator content for any authenticators issued by the organization"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "encoded-blob",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: A long encoded run sits in a comment or literal. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "file-record-to-cics-dynamic-transfer",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: A file record decides which program CICS transfers to. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "file-record-to-dynamic-file-path",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: A file record decides which file is opened. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "file-record-to-dynamic-program-load",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: A file record decides which program is called. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "file-record-to-dynamic-sql",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: A file record reaches dynamic SQL. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "file-record-to-extrapartition-queue",
+   "framework": "nist-800-53r5",
+   "clause": "SC-7",
+   "title": "Boundary Protection",
+   "rationale": "The rule reports: A file record is written to a transient-data queue that leaves the region. That is information crossing a managed interface through a channel the program opened itself, which this control requires be monitored and controlled.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Monitor and control communications at the external managed interfaces to the system and at key internal managed interfaces within the system"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "file-record-to-http-header",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: A file record is written into a header of the response. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "file-record-to-internal-reader",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: A file record is written into a job the internal reader submits. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "file-record-to-message-queue",
+   "framework": "nist-800-53r5",
+   "clause": "SC-7",
+   "title": "Boundary Protection",
+   "rationale": "The rule reports: A file record is put on a message queue. That is information crossing a managed interface through a channel the program opened itself, which this control requires be monitored and controlled.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Monitor and control communications at the external managed interfaces to the system and at key internal managed interfaces within the system"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "file-record-to-os-command",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: A file record reaches an operating-system command routine. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "file-record-to-outbound-host",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: A file record decides the host or path this program sends a request to. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "file-record-to-outbound-http",
+   "framework": "nist-800-53r5",
+   "clause": "SC-7",
+   "title": "Boundary Protection",
+   "rationale": "The rule reports: A file record is sent to a remote server over HTTP. That is information crossing a managed interface through a channel the program opened itself, which this control requires be monitored and controlled.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Monitor and control communications at the external managed interfaces to the system and at key internal managed interfaces within the system"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "file-record-to-queue-name",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: A file record names the queue a command reads, writes or deletes. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "file-record-to-socket-send",
+   "framework": "nist-800-53r5",
+   "clause": "SC-7",
+   "title": "Boundary Protection",
+   "rationale": "The rule reports: A file record is written to a network socket. That is information crossing a managed interface through a channel the program opened itself, which this control requires be monitored and controlled.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Monitor and control communications at the external managed interfaces to the system and at key internal managed interfaces within the system"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "file-record-to-web-response",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: A file record is written into the response this program returns. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "hidden-payload-in-identification-area",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: Columns 73 to 80, which the compiler ignores, carry a payload rather than a change tag. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "hidden-payload-in-sequence-area",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: The sequence area carries varying text rather than line numbers or a change tag. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "jcl-dlm-hides-instream",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: In-stream data uses a non-default delimiter, so it does not end where a line-by-line reader expects. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "jcl-exec-pgm-unresolved",
+   "framework": "nist-800-53r5",
+   "clause": "CM-8",
+   "title": "System Component Inventory",
+   "rationale": "The rule reports: A step runs a program that is neither a system utility nor defined by any source in this tree. That is a component the inventory does not accurately account for, which this control requires be documented.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Develop and document an inventory of system components"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "jcl-ftp-cleartext",
+   "framework": "nist-800-53r5",
+   "clause": "IA-5(1)",
+   "title": "Password-based Authentication",
+   "rationale": "The rule reports: A step runs FTP with no TLS option on its PARM or in its in-stream configuration, so its logon and data cross the network in cleartext. That is a password sent over a channel with no cryptographic protection, which this control does not allow.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Transmit passwords only over cryptographically-protected channels"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "jcl-ftp-sends-production-dataset",
+   "framework": "nist-800-53r5",
+   "clause": "SC-7",
+   "title": "Boundary Protection",
+   "rationale": "The rule reports: A step sends a dataset the estate calls production off the system by FTP. That is information crossing a managed interface through a channel the program opened itself, which this control requires be monitored and controlled.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Monitor and control communications at the external managed interfaces to the system and at key internal managed interfaces within the system"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "jcl-instream-credential",
+   "framework": "nist-800-53r5",
+   "clause": "IA-5",
+   "title": "Authenticator Management",
+   "rationale": "The rule reports: A password or pass phrase is set in in-stream job data. That is authenticator content established in a file rather than managed, which is what this control governs.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Establishing initial authenticator content for any authenticators issued by the organization"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "jcl-instream-destructive",
+   "framework": "nist-800-53r5",
+   "clause": "AC-6",
+   "title": "Least Privilege",
+   "rationale": "The rule reports: In-stream job data deletes or overwrites a catalogued dataset. That is authority granted or exercised beyond what the task requires, which this control exists to prevent.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks."
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "jcl-instream-security-command",
+   "framework": "nist-800-53r5",
+   "clause": "AC-6",
+   "title": "Least Privilege",
+   "rationale": "The rule reports: In-stream job data issues security product commands that grant or alter authority. That is authority granted or exercised beyond what the task requires, which this control exists to prevent.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks."
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "jcl-instream-to-arithmetic",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: In-stream job data reaches arithmetic on a decimal field, where bytes that are not digits abend the program. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "jcl-instream-to-cics-dynamic-transfer",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: In-stream job data decides which program CICS transfers to. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "jcl-instream-to-dynamic-file-path",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: In-stream job data decides which file is opened. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "jcl-instream-to-dynamic-program-load",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: In-stream job data decides which program is called. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "jcl-instream-to-dynamic-sql",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: In-stream job data reaches dynamic SQL. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "jcl-instream-to-internal-reader",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: In-stream job data is written into a job the internal reader submits. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "jcl-instream-to-loop-bound",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: In-stream job data decides how far a loop that subscripts a table runs. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "jcl-instream-to-occurs-depending-count",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: In-stream job data decides how many entries an OCCURS DEPENDING ON table holds. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "jcl-instream-to-os-command",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: In-stream job data reaches an operating-system command routine. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "jcl-instream-to-reference-modification",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: In-stream job data decides where a reference modification starts or how long it is. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "jcl-instream-to-subscript",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: In-stream job data is used as a subscript. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "jcl-parm-is-an-entry-point",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: A step passes PARM= to a program in this tree, which the flow rules follow as an untrusted source. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "jcl-parm-to-arithmetic",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: A JCL PARM reaches arithmetic on a decimal field, where bytes that are not digits abend the program. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "jcl-parm-to-cics-dynamic-transfer",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: A JCL PARM decides which program CICS transfers to. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "jcl-parm-to-dynamic-file-path",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: A JCL PARM decides which file is opened. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "jcl-parm-to-dynamic-program-load",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: A JCL PARM decides which program is called. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "jcl-parm-to-dynamic-sql",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: A JCL PARM reaches dynamic SQL. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "jcl-parm-to-internal-reader",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: A JCL PARM is written into a job the internal reader submits. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "jcl-parm-to-loop-bound",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: A JCL PARM decides how far a loop that subscripts a table runs. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "jcl-parm-to-occurs-depending-count",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: A JCL PARM decides how many entries an OCCURS DEPENDING ON table holds. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "jcl-parm-to-os-command",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: A JCL PARM reaches an operating-system command routine. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "jcl-parm-to-reference-modification",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: A JCL PARM decides where a reference modification starts or how long it is. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "jcl-parm-to-subscript",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: A JCL PARM is used as a subscript. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "jcl-racf-password",
+   "framework": "nist-800-53r5",
+   "clause": "IA-5",
+   "title": "Authenticator Management",
+   "rationale": "The rule reports: Credential pattern: jcl racf password. That is authenticator content established in a file rather than managed, which is what this control governs.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Establishing initial authenticator content for any authenticators issued by the organization"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "job-loads-from-an-authorised-library",
+   "framework": "nist-800-53r5",
+   "clause": "AC-6",
+   "title": "Least Privilege",
+   "rationale": "The rule reports: A job loads from a library the estate calls authorised. That is authority granted or exercised beyond what the task requires, which this control exists to prevent.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks."
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "job-reaches-unix-system-services",
+   "framework": "nist-800-53r5",
+   "clause": "AC-6",
+   "title": "Least Privilege",
+   "rationale": "The rule reports: A job runs a shell through UNIX System Services. That is authority granted or exercised beyond what the task requires, which this control exists to prevent.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks."
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "job-runs-under-another-user",
+   "framework": "nist-800-53r5",
+   "clause": "AC-6",
+   "title": "Least Privilege",
+   "rationale": "The rule reports: A job names the user it runs as. That is authority granted or exercised beyond what the task requires, which this control exists to prevent.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks."
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "job-unloads-the-security-database",
+   "framework": "nist-800-53r5",
+   "clause": "AC-6",
+   "title": "Least Privilege",
+   "rationale": "The rule reports: A job unloads the security database. That is authority granted or exercised beyond what the task requires, which this control exists to prevent.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks."
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "job-writes-diagnostic-output-unrestricted",
+   "framework": "nist-800-53r5",
+   "clause": "AC-6",
+   "title": "Least Privilege",
+   "rationale": "The rule reports: A job writes a dump, trace, log or unload to a dataset the estate has not called restricted. That is authority granted or exercised beyond what the task requires, which this control exists to prevent.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks."
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "log-writes-a-credential",
+   "framework": "nist-800-53r5",
+   "clause": "SI-11",
+   "title": "Error Handling",
+   "rationale": "The rule reports: A program writes a field named as a credential into a log. That is the system emitting information that could be exploited, to a destination read by people the record was never for, which this control requires it not do.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Generate error messages that provide information necessary for corrective actions without revealing information that could be exploited"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "log-writes-personal-data",
+   "framework": "nist-800-53r5",
+   "clause": "SI-11",
+   "title": "Error Handling",
+   "rationale": "The rule reports: A program writes a field named as personal data into a log. That is the system emitting information that could be exploited, to a destination read by people the record was never for, which this control requires it not do.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Generate error messages that provide information necessary for corrective actions without revealing information that could be exploited"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "opaque-altered-control-flow",
+   "framework": "nist-800-53r5",
+   "clause": "CM-8",
+   "title": "System Component Inventory",
+   "rationale": "The rule reports: A program changes where a GO TO goes at run time, so its control flow is not followed. That is a component the inventory does not accurately account for, which this control requires be documented.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Develop and document an inventory of system components"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "opaque-alternate-entry",
+   "framework": "nist-800-53r5",
+   "clause": "CM-8",
+   "title": "System Component Inventory",
+   "rationale": "The rule reports: A program declares an alternate entry point, which the flow rules do not start from. That is a component the inventory does not accurately account for, which this control requires be documented.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Develop and document an inventory of system components"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "opaque-pointer-addressing",
+   "framework": "nist-800-53r5",
+   "clause": "CM-8",
+   "title": "System Component Inventory",
+   "rationale": "The rule reports: A program addresses storage through a pointer, so data flow through it is not followed. That is a component the inventory does not accurately account for, which this control requires be documented.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Develop and document an inventory of system components"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "opaque-procedure-pointer",
+   "framework": "nist-800-53r5",
+   "clause": "CM-8",
+   "title": "System Component Inventory",
+   "rationale": "The rule reports: A program calls through a procedure pointer, so the callee is not known statically. That is a component the inventory does not accurately account for, which this control requires be documented.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Develop and document an inventory of system components"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "program-without-entry",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: Nothing in this tree starts this program: no transaction, job step or program reaches it. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "racf-command-password",
+   "framework": "nist-800-53r5",
+   "clause": "IA-5",
+   "title": "Authenticator Management",
+   "rationale": "The rule reports: Credential pattern: racf command password. That is authenticator content established in a file rather than managed, which is what this control governs.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Establishing initial authenticator content for any authenticators issued by the organization"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "recon-nonproduction-job-reads-production-dataset",
+   "framework": "nist-800-53r5",
+   "clause": "SA-3(2)",
+   "title": "Use of Live or Operational Data",
+   "rationale": "The rule reports: A job the estate calls non-production reads a production dataset. That is live data put to use outside production, which this control requires be approved, documented and controlled.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Approve, document, and control the use of live data in preproduction environments for the system, system component, or system service"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "recon-nonproduction-job-writes-production-dataset",
+   "framework": "nist-800-53r5",
+   "clause": "AC-6",
+   "title": "Least Privilege",
+   "rationale": "The rule reports: A job the estate calls non-production creates, extends, overwrites or deletes a production dataset. That is authority granted or exercised beyond what the task requires, which this control exists to prevent.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks."
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "site-declares-vulnerable-runtime",
+   "framework": "nist-800-53r5",
+   "clause": "SI-2",
+   "title": "Flaw Remediation",
+   "rationale": "The rule reports: The estate declares a runtime version with a published advisory against it. That is a known system flaw present in the build, which this control requires be identified, reported and corrected.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Identify, report, and correct system flaws"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "system-response-to-http-header",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: A response code or SQL error the system set is sent in a response header. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "system-response-to-web-response",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: A response code or SQL error the system set is sent in a web response. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "tso-logon-password",
+   "framework": "nist-800-53r5",
+   "clause": "IA-5",
+   "title": "Authenticator Management",
+   "rationale": "The rule reports: Credential pattern: tso logon password. That is authenticator content established in a file rather than managed, which is what this control governs.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Establishing initial authenticator content for any authenticators issued by the organization"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "vendor-privileged-command",
+   "framework": "nist-800-53r5",
+   "clause": "AC-6",
+   "title": "Least Privilege",
+   "rationale": "The rule reports: A job issues a vendor product command that creates, grants or alters authority. That is authority granted or exercised beyond what the task requires, which this control exists to prevent.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks."
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "web-cookie-without-secure-attributes",
+   "framework": "nist-800-53r5",
+   "clause": "SC-23",
+   "title": "Session Authenticity",
+   "rationale": "The rule reports: A program sets a cookie without the attributes that keep it off a cleartext hop. That is a session another origin can frame, keep a handle on or read off a cleartext hop, which is the authenticity of the session this control requires be protected.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Protect the authenticity of communications sessions."
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "web-link-opens-without-noopener",
+   "framework": "nist-800-53r5",
+   "clause": "SC-23",
+   "title": "Session Authenticity",
+   "rationale": "The rule reports: A program writes a link that opens a new window with a handle back to this one. That is a session another origin can frame, keep a handle on or read off a cleartext hop, which is the authenticity of the session this control requires be protected.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Protect the authenticity of communications sessions."
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "web-request-changes-state-without-a-token",
+   "framework": "nist-800-53r5",
+   "clause": "SC-23",
+   "title": "Session Authenticity",
+   "rationale": "The rule reports: A program changes state on a web request without comparing anything the browser could not forge. That is a session another origin can frame, keep a handle on or read off a cleartext hop, which is the authenticity of the session this control requires be protected.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Protect the authenticity of communications sessions."
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "web-response-tells-the-caller-what-it-runs",
+   "framework": "nist-800-53r5",
+   "clause": "SC-23",
+   "title": "Session Authenticity",
+   "rationale": "The rule reports: A program writes a header naming the software behind it. That is a session another origin can frame, keep a handle on or read off a cleartext hop, which is the authenticity of the session this control requires be protected.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Protect the authenticity of communications sessions."
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "web-response-without-protective-headers",
+   "framework": "nist-800-53r5",
+   "clause": "SC-23",
+   "title": "Session Authenticity",
+   "rationale": "The rule reports: A program sends HTML without the headers that say who may frame or reinterpret it. That is a session another origin can frame, keep a handle on or read off a cleartext hop, which is the authenticity of the session this control requires be protected.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Protect the authenticity of communications sessions."
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "web-uri-carries-a-credential",
+   "framework": "nist-800-53r5",
+   "clause": "SC-23",
+   "title": "Session Authenticity",
+   "rationale": "The rule reports: A program puts a credential in a URI rather than in the request body. That is a session another origin can frame, keep a handle on or read off a cleartext hop, which is the authenticity of the session this control requires be protected.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Protect the authenticity of communications sessions."
+   }
+  }
+ ]
+}