@portll/cobolwork 0.5.0 → 0.7.0

package/rules/compliance-nist80053.json

@@ -388,6 +388,19 @@
     "quote": "Protect the {{ insert: param, sc-08_odp }} of transmitted information."
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-new-password",
+   "framework": "nist-800-53r5",
+   "clause": "IA-5",
+   "title": "Authenticator Management",
+   "rationale": "The rule reports: Credential pattern: cics new password. That is authenticator content established in a file rather than managed, which is what this control governs.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Establishing initial authenticator content for any authenticators issued by the organization"
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "cics-protected-field-to-record-key",
@@ -1077,6 +1090,19 @@
     "quote": "Develop and document an inventory of system components"
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "credential-in-source",
+   "framework": "nist-800-53r5",
+   "clause": "IA-5",
+   "title": "Authenticator Management",
+   "rationale": "The rule reports: A credential is written into the source. That is authenticator content established in a file rather than managed, which is what this control governs.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Establishing initial authenticator content for any authenticators issued by the organization"
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "csd-defines-diagnostic-transaction",
@@ -1428,6 +1454,19 @@
     "quote": "Check the validity of the following information inputs"
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-queue-to-cics-dynamic-transfer",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: A CICS queue item decides which program CICS transfers to. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "file-record-to-cics-sysid",
@@ -1441,6 +1480,19 @@
     "quote": "Check the validity of the following information inputs"
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-queue-to-cics-sysid",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: A CICS queue item decides which region a CICS command is shipped to. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "file-record-to-cics-system-resource",
@@ -1454,6 +1506,19 @@
     "quote": "Check the validity of the following information inputs"
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-queue-to-cics-system-resource",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: A CICS queue item names the resource an EXEC CICS SET changes. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "file-record-to-dynamic-file-path",
@@ -1467,6 +1532,19 @@
     "quote": "Check the validity of the following information inputs"
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-queue-to-dynamic-file-path",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: A CICS queue item decides which file is opened. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "file-record-to-dynamic-program-load",
@@ -1480,6 +1558,19 @@
     "quote": "Check the validity of the following information inputs"
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-queue-to-dynamic-program-load",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: A CICS queue item decides which program is called. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "file-record-to-dynamic-sql",
@@ -1493,6 +1584,19 @@
     "quote": "Check the validity of the following information inputs"
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-queue-to-dynamic-sql",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: A CICS queue item reaches dynamic SQL. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "file-record-to-extrapartition-queue",
@@ -1506,6 +1610,19 @@
     "quote": "Monitor and control communications at the external managed interfaces to the system and at key internal managed interfaces within the system"
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-queue-to-extrapartition-queue",
+   "framework": "nist-800-53r5",
+   "clause": "SC-7",
+   "title": "Boundary Protection",
+   "rationale": "The rule reports: A CICS queue item is written to a transient-data queue that leaves the region. That is information crossing a managed interface through a channel the program opened itself, which this control requires be monitored and controlled.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Monitor and control communications at the external managed interfaces to the system and at key internal managed interfaces within the system"
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "file-record-to-http-header",
@@ -1519,6 +1636,19 @@
     "quote": "Check the validity of the following information inputs"
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-queue-to-http-header",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: A CICS queue item is written into a header of the response. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "file-record-to-internal-reader",
@@ -1532,6 +1662,19 @@
     "quote": "Check the validity of the following information inputs"
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-queue-to-internal-reader",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: A CICS queue item is written into a job the internal reader submits. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "file-record-to-message-queue",
@@ -1545,6 +1688,19 @@
     "quote": "Monitor and control communications at the external managed interfaces to the system and at key internal managed interfaces within the system"
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-queue-to-message-queue",
+   "framework": "nist-800-53r5",
+   "clause": "SC-7",
+   "title": "Boundary Protection",
+   "rationale": "The rule reports: A CICS queue item is put on a message queue. That is information crossing a managed interface through a channel the program opened itself, which this control requires be monitored and controlled.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Monitor and control communications at the external managed interfaces to the system and at key internal managed interfaces within the system"
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "file-record-to-os-command",
@@ -1558,6 +1714,19 @@
     "quote": "Check the validity of the following information inputs"
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-queue-to-os-command",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: A CICS queue item reaches an operating-system command routine. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "file-record-to-outbound-host",
@@ -1571,6 +1740,19 @@
     "quote": "Check the validity of the following information inputs"
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-queue-to-outbound-host",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: A CICS queue item decides the host or path this program sends a request to. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "file-record-to-outbound-http",
@@ -1584,6 +1766,19 @@
     "quote": "Monitor and control communications at the external managed interfaces to the system and at key internal managed interfaces within the system"
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-queue-to-outbound-http",
+   "framework": "nist-800-53r5",
+   "clause": "SC-7",
+   "title": "Boundary Protection",
+   "rationale": "The rule reports: A CICS queue item is sent to a remote server over HTTP. That is information crossing a managed interface through a channel the program opened itself, which this control requires be monitored and controlled.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Monitor and control communications at the external managed interfaces to the system and at key internal managed interfaces within the system"
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "file-record-to-queue-name",
@@ -1597,6 +1792,19 @@
     "quote": "Check the validity of the following information inputs"
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-queue-to-queue-name",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: A CICS queue item names the queue a command reads, writes or deletes. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "file-record-to-socket-send",
@@ -1610,6 +1818,19 @@
     "quote": "Monitor and control communications at the external managed interfaces to the system and at key internal managed interfaces within the system"
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-queue-to-socket-send",
+   "framework": "nist-800-53r5",
+   "clause": "SC-7",
+   "title": "Boundary Protection",
+   "rationale": "The rule reports: A CICS queue item is written to a network socket. That is information crossing a managed interface through a channel the program opened itself, which this control requires be monitored and controlled.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Monitor and control communications at the external managed interfaces to the system and at key internal managed interfaces within the system"
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "file-record-to-web-response",
@@ -1623,6 +1844,19 @@
     "quote": "Check the validity of the following information inputs"
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-queue-to-web-response",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: A CICS queue item is written into the response this program returns. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "hidden-payload-in-identification-area",
@@ -1707,13 +1941,26 @@
    "framework": "nist-800-53r5",
    "clause": "AC-6",
    "title": "Least Privilege",
-   "rationale": "The rule reports: Assembler source switches to PSW key zero or supervisor state. That is authority granted or exercised beyond what the task requires, which this control exists to prevent.",
+   "rationale": "The rule reports: Assembler source switches to PSW key zero, another system key, or supervisor state. That is authority granted or exercised beyond what the task requires, which this control exists to prevent.",
    "source": {
     "doc": "nist80053",
     "retrieved": "2026-09-20",
     "quote": "Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks."
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "hlasm-runtime-module-name",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: Assembler source loads or calls a module whose name it reads from storage at run time. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "icsf-fixed-initialization-vector",
@@ -1766,6 +2013,32 @@
     "quote": "Check the validity of the following information inputs"
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "input-causes-hang",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: An input the program accepts keeps a loop running past the statement limit that stands in for its time limit (S322). That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "input-selects-program",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: An input the program accepts chooses the program a CALL loads. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "input-causes-abend-s0c4",
@@ -2468,6 +2741,19 @@
     "quote": "Check the validity of the following information inputs"
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "racf-command-new-password",
+   "framework": "nist-800-53r5",
+   "clause": "IA-5",
+   "title": "Authenticator Management",
+   "rationale": "The rule reports: Credential pattern: racf command new password. That is authenticator content established in a file rather than managed, which is what this control governs.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Establishing initial authenticator content for any authenticators issued by the organization"
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "racf-command-password",
@@ -2585,6 +2871,19 @@
     "quote": "Develop and document an inventory of system components"
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "tso-logon-new-password",
+   "framework": "nist-800-53r5",
+   "clause": "IA-5",
+   "title": "Authenticator Management",
+   "rationale": "The rule reports: Credential pattern: tso logon new password. That is authenticator content established in a file rather than managed, which is what this control governs.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Establishing initial authenticator content for any authenticators issued by the organization"
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "tso-logon-password",
@@ -2831,6 +3130,263 @@
     "retrieved": "2026-09-20",
     "quote": "Establishing initial authenticator content for any authenticators issued by the organization"
    }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "db2-exit-routine-declared",
+   "framework": "nist-800-53r5",
+   "clause": "CM-8",
+   "title": "System Component Inventory",
+   "rationale": "The rule reports: A table names an exit routine that runs inside Db2. That is a component the inventory does not accurately account for, which this control requires be documented.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Develop and document an inventory of system components"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "db2-external-routine",
+   "framework": "nist-800-53r5",
+   "clause": "CM-8",
+   "title": "System Component Inventory",
+   "rationale": "The rule reports: A procedure or function runs an external load module. That is a component the inventory does not accurately account for, which this control requires be documented.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Develop and document an inventory of system components"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "db2-grant-to-public",
+   "framework": "nist-800-53r5",
+   "clause": "AC-6",
+   "title": "Least Privilege",
+   "rationale": "The rule reports: A GRANT gives privileges to PUBLIC, every authorization ID. That is authority granted or exercised beyond what the task requires, which this control exists to prevent.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks."
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "db2-grant-with-grant-option",
+   "framework": "nist-800-53r5",
+   "clause": "AC-6",
+   "title": "Least Privilege",
+   "rationale": "The rule reports: WITH GRANT OPTION lets the grantee grant the privilege to others. That is authority granted or exercised beyond what the task requires, which this control exists to prevent.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks."
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "db2-system-authority-granted",
+   "framework": "nist-800-53r5",
+   "clause": "AC-6",
+   "title": "Least Privilege",
+   "rationale": "The rule reports: A system or database authority is granted. That is authority granted or exercised beyond what the task requires, which this control exists to prevent.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks."
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "ims-definition-inconsistent",
+   "framework": "nist-800-53r5",
+   "clause": "SI-2",
+   "title": "Flaw Remediation",
+   "rationale": "The rule reports: A DBD or PSB holds what DBDGEN, PSBGEN or ACBGEN refuses. That is a known system flaw present in the build, which this control requires be identified, reported and corrected.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Identify, report, and correct system flaws"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "ims-pcb-procopt-all",
+   "framework": "nist-800-53r5",
+   "clause": "AC-6",
+   "title": "Least Privilege",
+   "rationale": "The rule reports: A database PCB lets the program get, insert, replace and delete its sensitive segments. That is authority granted or exercised beyond what the task requires, which this control exists to prevent.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks."
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "ims-senseg-unknown-segment",
+   "framework": "nist-800-53r5",
+   "clause": "SI-2",
+   "title": "Flaw Remediation",
+   "rationale": "The rule reports: A SENSEG names a segment its PCB's DBD does not define, which ends the program with abend U0914. That is a known system flaw present in the build, which this control requires be identified, reported and corrected.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Identify, report, and correct system flaws"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "pli-based-storage-addressing",
+   "framework": "nist-800-53r5",
+   "clause": "CM-8",
+   "title": "System Component Inventory",
+   "rationale": "The rule reports: A program addresses storage through a pointer, so data flow through it is not followed. That is a component the inventory does not accurately account for, which this control requires be documented.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Develop and document an inventory of system components"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "pli-entry-variable-call",
+   "framework": "nist-800-53r5",
+   "clause": "CM-8",
+   "title": "System Component Inventory",
+   "rationale": "The rule reports: A CALL through an entry variable dispatches to a procedure chosen at run time, so the callee is not known statically. That is a component the inventory does not accurately account for, which this control requires be documented.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Develop and document an inventory of system components"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "pli-error-condition-ignored",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: An ON unit for a condition does nothing with it, so the condition is silently ignored. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "pli-fetch-title-variable",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: A FETCH whose TITLE is not a literal names the module to load at run time. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "pli-preprocessor-in-use",
+   "framework": "nist-800-53r5",
+   "clause": "CM-8",
+   "title": "System Component Inventory",
+   "rationale": "The rule reports: A program uses PL/I preprocessor directives, so the source text is not the code that is compiled. That is a component the inventory does not accurately account for, which this control requires be documented.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Develop and document an inventory of system components"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "ims-procopt-broader-than-used",
+   "framework": "nist-800-53r5",
+   "clause": "AC-6",
+   "title": "Least Privilege",
+   "rationale": "The rule reports: A PSB grants a processing option that no DL/I call of the program it is named for uses. That is authority granted or exercised beyond what the task requires, which this control exists to prevent.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks."
+   }
+  }
+ ],
+ "evidence": [
+  {
+   "kind": "evidence",
+   "evidenceId": "journal-records",
+   "tools": [
+    "cobolwork",
+    "ironwork"
+   ],
+   "framework": "nist-800-53r5",
+   "clause": "AU-3",
+   "title": "Content of Audit Records",
+   "rationale": "The evidence is a run journal's records, one per event: what ran and with which arguments, the inputs and DD files it read, the programs it called, where data left it, and how and when it ended. Each record establishes what kind of event occurred, when, where and with what outcome, which is the content this control requires of an audit record.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Ensure that audit records contain information that establishes the following:"
+   }
+  },
+  {
+   "kind": "evidence",
+   "evidenceId": "journal-chain",
+   "tools": [
+    "cobolwork",
+    "ironwork"
+   ],
+   "framework": "nist-800-53r5",
+   "clause": "AU-9(3)",
+   "title": "Cryptographic Protection",
+   "rationale": "The evidence is the SHA-256 chain through each run journal and the ledger that names every run, which `cobolwork evidence verify` recomputes, so a record changed, removed or reordered after it was written is found. That is a cryptographic mechanism over the audit records, through which a change to one after it was written is detected, which is the integrity this enhancement requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Implement cryptographic mechanisms to protect the integrity of audit information and audit tools."
+   }
+  },
+  {
+   "kind": "evidence",
+   "evidenceId": "provenance",
+   "tools": [
+    "cobolwork",
+    "ironwork"
+   ],
+   "framework": "nist-800-53r5",
+   "clause": "SR-4",
+   "title": "Provenance",
+   "rationale": "The evidence is the in-toto SLSA provenance statement of a run, naming its output and the sources it was built from by digest, the tool, and the tip of its journal. That documents the provenance of the output, the sources it came from and the tool that made it, which this control requires be kept valid.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Document, monitor, and maintain valid provenance of the following systems, system components, and associated data"
+   }
+  },
+  {
+   "kind": "evidence",
+   "evidenceId": "options-in-force",
+   "tools": [
+    "ironwork"
+   ],
+   "framework": "nist-800-53r5",
+   "clause": "CM-6",
+   "title": "Configuration Settings",
+   "rationale": "The evidence is the options a compile or run used, its compliance level and dialect among them, in the provenance statement's optionsInForce and the journal's open record. That documents the configuration settings in force for each compile and run, against which the settings an organisation established can be checked.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Establish and document configuration settings for components employed within the system that reflect the most restrictive mode consistent with operational requirements"
+   }
+  }
+ ],
+ "unmappedEvidence": [
+  {
+   "evidenceId": "assumptions-register",
+   "why": "The register records how a compiler resolves what its language leaves open. SA-5 asks for administrator documentation of secure configuration and use, and CM-6 for settings an organisation chooses; neither is about an implementation's own design choices, and mapping to either would be a near miss."
   }
  ]
 }