bmad-plus 0.9.0 → 0.9.2

package/src/bmad-plus/packs/pack-shield/references/nist-800-53/assessment-rmf.md

@@ -1,349 +1,349 @@
-# NIST SP 800-53 — Assessment, RMF, ConMon, and Framework Mapping Reference
-
-## SP 800-53A Rev 5 — Assessment Procedures
-
-### Purpose
-
-SP 800-53A Rev 5 (January 2022) provides **assessment procedures** for every control in SP 800-53 Rev 5. Each procedure specifies:
-
-1. **Objectives** — what the assessment must determine
-2. **Methods** — Examine, Interview, or Test
-3. **Objects** — what to examine/interview/test
-
-### The Three Assessment Methods
-
-| Method | Description | Examples |
-|--------|-------------|---------|
-| **Examine** | Review artifacts and documentation | Policy documents, SSP, configuration files, system logs, architecture diagrams, audit records, training records |
-| **Interview** | Discuss implementation with personnel | ISSO, system owner, help desk, IT administrators, end users, senior leaders |
-| **Test** | Exercise mechanisms directly | Vulnerability scans, penetration tests, configuration checks, firewall rule reviews, backup restoration tests |
-
-### Assessment Depth
-
-| Depth | Description | When Used |
-|-------|-------------|----------|
-| **Basic** | Check for existence of controls | Initial assessments; Low impact systems |
-| **Focused** | Evaluate implementation | Most common approach |
-| **Comprehensive** | Thorough, in-depth assessment | High impact systems; 3PAO assessments |
-
-### Security Assessment Report (SAR) Structure
-
-The SAR documents assessment results:
-
-1. **Executive Summary** — High-level findings and authorization recommendation
-2. **Assessment Scope** — Systems, components, controls assessed
-3. **Assessment Methodology** — Methods used, depth, timeframe
-4. **Findings** — Control-by-control results
-5. **Weaknesses and Deficiencies** — OTS (Other Than Satisfied) findings
-6. **Risk Exposure** — Risk ratings for identified weaknesses
-7. **Recommendations** — Remediation actions
-
-**Finding format:**
-```
-Control: AC-2(3)
-Objective: Determine if inactive accounts are disabled within the defined period.
-Status: Other Than Satisfied
-Finding: Audit of Active Directory accounts identified 47 accounts inactive for >120 days; 
-         ODV is 90 days. Automated account review process is not functioning correctly.
-Risk: Moderate — dormant accounts represent attack surface for credential-based attacks.
-Recommendation: Fix automated review process; immediately disable the 47 identified accounts.
-```
-
----
-
-## Plan of Action and Milestones (POA&M)
-
-### POA&M Purpose
-
-The POA&M (CA-5) is a living document tracking all security weaknesses found during assessments, continuous monitoring, and self-assessment. Required for all federal systems.
-
-### POA&M Required Fields
-
-| Field | Description |
-|-------|-------------|
-| POA&M ID | Unique identifier |
-| Weakness/Deficiency | Description of the finding |
-| Source | How discovered (scan, audit, assessment, pen test) |
-| Control ID | Related SP 800-53 control |
-| Risk Level | Critical / High / Moderate / Low |
-| Scheduled Completion Date | When remediation will be complete |
-| Milestone Description | Steps to remediate with dates |
-| Resources Required | Staff, tools, budget |
-| Status | Open / Completed / Delayed / Risk Accepted |
-
-### POA&M Timelines (FedRAMP Guidance)
-
-| Risk Level | Remediation Deadline |
-|-----------|---------------------|
-| Critical | 30 days |
-| High | 90 days |
-| Moderate | 180 days |
-| Low | 1 year |
-| Operational Requirement | Risk accepted; ISSO/SO signature required |
-
-### Risk Acceptance
-
-When a weakness cannot be remediated within the standard timeline:
-- Document a **Risk Acceptance** with business justification
-- ISSO and System Owner must sign off
-- Authorizing Official (AO) may need to approve for High/Critical
-- Review at each ConMon cycle
-- Cannot be risk-accepted indefinitely for High/Critical findings
-
----
-
-## Risk Management Framework (RMF) — SP 800-37 Rev 2
-
-### Step 1 — Prepare
-
-**Purpose:** Establish the organizational and system context for managing security and privacy risk.
-
-**Key tasks:**
-- Assign roles: Authorizing Official (AO), System Owner (SO), ISSO, Senior Agency IS Official (SAISO)
-- Develop or update organizational risk management strategy (PM-9)
-- Identify common controls (PM-10)
-- Conduct mission/business process analysis (PM-11)
-- Perform organization-level risk assessment (RA-3)
-- Establish information life cycle for the system
-
-**Output:** Risk management roles assigned; organization-level risk assessment completed; common control inventory established.
-
-### Step 2 — Categorize
-
-**Purpose:** Categorize the system and information processed, stored, and transmitted based on FIPS 199.
-
-**Key tasks:**
-- Describe the system (SSP Section 1 and 2)
-- Identify information types using SP 800-60
-- Determine impact levels for C, I, A
-- Determine overall system impact level (high-water mark)
-- Document in the Security Categorization document
-
-**Output:** System Security Categorization document (signed by AO and SO).
-
-### Step 3 — Select
-
-**Purpose:** Select, tailor, and document the controls for the system.
-
-**Key tasks:**
-- Select starting baseline from SP 800-53B (Low/Moderate/High)
-- Apply tailoring (common controls, scoping, ODVs, compensating controls)
-- Document all tailoring decisions in the SSP
-- Develop continuous monitoring strategy (CA-7)
-- Review and approve control selection (AO concurrence)
-
-**Output:** SSP with control selection; ConMon strategy.
-
-### Step 4 — Implement
-
-**Purpose:** Implement the controls and document how they are deployed in the operational environment.
-
-**Key tasks:**
-- Implement the selected controls
-- Document implementation in SSP (one narrative per control)
-- Document design and implementation information for developer controls (SA-4)
-- Identify and address supply chain risks (SR family)
-
-**Output:** Implemented controls; completed SSP implementation narratives.
-
-### Step 5 — Assess
-
-**Purpose:** Determine if the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting security and privacy requirements.
-
-**Key tasks:**
-- Develop Security Assessment Plan (SAP) using SP 800-53A
-- Select qualified assessors (independent for Moderate/High; 3PAO for FedRAMP)
-- Conduct assessments (examine, interview, test)
-- Document findings in SAR
-- Develop initial POA&M from SAR findings
-
-**Output:** SAP, SAR, initial POA&M.
-
-**Independence requirements:**
-- **Low systems:** Self-assessment permitted
-- **Moderate systems:** Independent assessor (different team from implementers)
-- **High systems / FedRAMP:** 3PAO required; must be accredited by A2LA/FedRAMP PMO
-
-### Step 6 — Authorize
-
-**Purpose:** Provide organizational accountability by requiring a senior official to determine if the security and privacy risk to organizational operations/assets is acceptable.
-
-**Authorization package contents:**
-1. System Security Plan (SSP)
-2. Security Assessment Report (SAR)
-3. Plan of Action and Milestones (POA&M)
-4. Executive Summary (for AO review)
-
-**Authorization decisions:**
-- **Authorization to Operate (ATO)** — risk is acceptable; typically granted for 3 years
-- **Common Control Authorization (CCA)** — for common control providers
-- **Denial of Authorization to Operate (DATO)** — risk is not acceptable; system must be shut down or remediated
-- **Authorization to Use (ATU)** — for external systems/services
-
-**Ongoing authorization:** Continuous authorization (preferred for Moderate/High) replaces periodic re-authorization with real-time risk management.
-
-### Step 7 — Monitor
-
-**Purpose:** Maintain ongoing situational awareness about the security and privacy posture of the system.
-
-**Key tasks:**
-- Implement ConMon strategy (CA-7)
-- Conduct ongoing assessments of selected controls
-- Respond to changes in system and threat environment
-- Report security status to AO
-- Update SSP, SAR, POA&M as changes occur
-- Conduct ongoing risk determination and acceptance
-
-**FedRAMP ConMon requirements:**
-- Monthly vulnerability scans (OS, databases, web apps)
-- Annual penetration test (conducted by 3PAO)
-- Monthly POA&M updates
-- Significant change request before major system changes
-- Annual security reviews
-
----
-
-## Continuous Monitoring (ConMon) Strategy
-
-### ConMon Frequencies (SP 800-137 / CA-7)
-
-| Activity | Recommended Frequency | FedRAMP Frequency |
-|----------|----------------------|------------------|
-| Vulnerability scans (OS) | Monthly | Monthly |
-| Vulnerability scans (Web app) | Monthly | Monthly |
-| Vulnerability scans (Database) | Monthly | Weekly |
-| Control assessments (selected) | Ongoing/quarterly | Annually |
-| Security awareness training | Annual | Annual |
-| Contingency plan testing | Annual | Annual |
-| Full control assessment | Every 3 years / at reauthorization | Annual (3PAO) |
-| Penetration testing | Annual (Moderate+) | Annual (3PAO) |
-
-### ConMon Automation
-
-Support tools for ConMon implementation:
-- **SCAP (Security Content Automation Protocol)** — standardized vulnerability scanning
-- **CVE/CVSS** — common vulnerability scoring
-- **OVAL/XCCDF** — configuration checking
-- **NVD (National Vulnerability Database)** — NIST vulnerability repository
-- **CDM (Continuous Diagnostics and Mitigation)** — DHS/CISA program for federal agencies
-- **OSCAL** — machine-readable security control documentation
-
----
-
-## OSCAL — Open Security Controls Assessment Language
-
-OSCAL (developed by NIST) provides machine-readable representations of SP 800-53 content:
-
-### OSCAL Layers
-
-| Layer | Purpose | Formats |
-|-------|---------|---------|
-| **Catalog** | Control definitions (SP 800-53 catalog) | JSON, XML, YAML |
-| **Profile** | Baseline selection and tailoring | JSON, XML, YAML |
-| **Component Definition** | Reusable component implementations | JSON, XML, YAML |
-| **System Security Plan** | SSP in machine-readable format | JSON, XML, YAML |
-| **Assessment Plan** | SAP in machine-readable format | JSON, XML, YAML |
-| **Assessment Results** | SAR findings in machine-readable format | JSON, XML, YAML |
-| **POA&M** | Plan of action in machine-readable format | JSON, XML, YAML |
-
-**FedRAMP OSCAL adoption:** FedRAMP has been moving toward OSCAL-based SSP submissions. Tools supporting OSCAL: Trestle (IBM), Xacta 360, Atlasity, Empower.
-
----
-
-## Cross-Framework Mapping
-
-### SP 800-53 Rev 5 → ISO 27001:2022
-
-| SP 800-53 Family | ISO 27001:2022 Annex A Controls |
-|-----------------|-------------------------------|
-| AC (Access Control) | 5.15–5.18 (Access, privilege), 8.2–8.5 |
-| AT (Awareness & Training) | 6.3 (Security awareness) |
-| AU (Audit) | 8.15 (Logging), 8.16 (Monitoring) |
-| CA (Assessment) | 5.35 (IS review), 5.36 (Compliance) |
-| CM (Config Mgmt) | 8.8–8.9 (Vulnerability, config), 8.32 |
-| CP (Contingency) | 5.29 (BCP), 8.13 (Backup) |
-| IA (Authentication) | 5.17 (Authentication), 8.5 (MFA) |
-| IR (Incident Response) | 5.24–5.28 (Incident management) |
-| PE (Physical) | 7.1–7.14 (Physical controls) |
-| RA (Risk Assessment) | 5.1 (Risk treatment), 6.1 (Risk process) |
-| SC (Comms Protection) | 5.14 (Transfer), 8.20–8.26 (Network) |
-| SI (Integrity) | 8.7 (Malware), 8.8 (Vulnerability), 8.19 |
-| SR (Supply Chain) | 5.19–5.22 (Supplier security) |
-
-### SP 800-53 Rev 5 → NIST CSF 2.0
-
-The CSF 2.0 (February 2024) maps to SP 800-53:
-
-| CSF Function | Key SP 800-53 Families |
-|-------------|----------------------|
-| **GV (Govern)** | PM, PL, AT, RA |
-| **ID (Identify)** | RA, CA, CM, PM |
-| **PR (Protect)** | AC, AT, CM, IA, MA, MP, PE, SC, SI, SR |
-| **DE (Detect)** | AU, CA, IR, RA, SI |
-| **RS (Respond)** | IR, CA |
-| **RC (Recover)** | CP, IR |
-
-Full mapping: SP 800-53B Appendix B provides CSF subcategory → SP 800-53 control mapping.
-
-### SP 800-53 Rev 5 → CMMC 2.0
-
-CMMC 2.0 is based on **NIST SP 800-171 Rev 2**, which derives from SP 800-53:
-
-| CMMC Level | SP 800-53 Basis |
-|-----------|----------------|
-| Level 1 (Foundational) | Subset of 800-171 practices (17 practices from FAR clause) |
-| Level 2 (Advanced) | Full SP 800-171 Rev 2 (110 practices = ~320 SP 800-53 controls) |
-| Level 3 (Expert) | SP 800-171 + selected SP 800-172 controls |
-
-SP 800-171 Appendix D provides the mapping from each 800-171 requirement to the SP 800-53 source controls.
-
-### SP 800-53 Rev 5 → FedRAMP
-
-FedRAMP uses the SP 800-53 Moderate or High baseline with overlay parameters:
-
-| FedRAMP Difference | Detail |
-|-------------------|--------|
-| Specific ODV values | Defined in FedRAMP baseline documentation |
-| Additional requirements | Incident reporting to US-CERT; 3PAO requirement |
-| Cryptography | FIPS 140-2/140-3 validated modules explicitly required |
-| ConMon | Specific monthly/annual frequencies required |
-| SSP format | FedRAMP SSP template must be used |
-| Authorization types | Agency ATO or JAB P-ATO |
-
----
-
-## Key Roles in the RMF / SP 800-53 Context
-
-| Role | Abbreviation | Responsibility |
-|------|-------------|---------------|
-| Authorizing Official | AO | Accepts risk; grants/denies ATO |
-| Authorizing Official Designated Representative | AODR | Acts on behalf of AO |
-| Chief Information Officer | CIO | Overall IT governance |
-| Senior Agency Information Security Official | SAISO | Agency-wide IS oversight |
-| Information System Security Officer | ISSO | Day-to-day security operations for system |
-| Information System Security Manager | ISSM | Manages multiple ISSOs |
-| System Owner | SO | Responsible for system operation |
-| Common Control Provider | CCP | Implements shared/inherited controls |
-| Security Control Assessor | SCA | Conducts independent assessment |
-| Privacy Officer / CPO | CPO | Privacy program lead |
-
----
-
-## Key NIST Publications Related to SP 800-53
-
-| Publication | Title | Role |
-|-------------|-------|------|
-| SP 800-53 Rev 5 | Security and Privacy Controls | Main control catalog |
-| SP 800-53A Rev 5 | Assessing Security and Privacy Controls | Assessment procedures |
-| SP 800-53B | Control Baselines | Baseline definitions |
-| SP 800-37 Rev 2 | Risk Management Framework | RMF steps |
-| SP 800-60 Vol I/II | Information Types / Impact Levels | Categorization guidance |
-| SP 800-30 Rev 1 | Risk Assessment | Risk assessment methodology |
-| SP 800-137A | ConMon | Continuous monitoring |
-| SP 800-63 Rev 3 | Digital Identity | Authentication assurance |
-| SP 800-82 Rev 3 | OT Security | ICS/SCADA guide |
-| SP 800-88 Rev 1 | Media Sanitization | Media disposal |
-| SP 800-115 | Security Testing | Penetration testing methodology |
-| FIPS 199 | Security Categorization | Impact level determination |
-| FIPS 200 | Minimum Security Requirements | Baseline requirement |
-| FIPS 140-3 | Cryptographic Modules | Cryptography standard |
+# NIST SP 800-53 — Assessment, RMF, ConMon, and Framework Mapping Reference
+
+## SP 800-53A Rev 5 — Assessment Procedures
+
+### Purpose
+
+SP 800-53A Rev 5 (January 2022) provides **assessment procedures** for every control in SP 800-53 Rev 5. Each procedure specifies:
+
+1. **Objectives** — what the assessment must determine
+2. **Methods** — Examine, Interview, or Test
+3. **Objects** — what to examine/interview/test
+
+### The Three Assessment Methods
+
+| Method | Description | Examples |
+|--------|-------------|---------|
+| **Examine** | Review artifacts and documentation | Policy documents, SSP, configuration files, system logs, architecture diagrams, audit records, training records |
+| **Interview** | Discuss implementation with personnel | ISSO, system owner, help desk, IT administrators, end users, senior leaders |
+| **Test** | Exercise mechanisms directly | Vulnerability scans, penetration tests, configuration checks, firewall rule reviews, backup restoration tests |
+
+### Assessment Depth
+
+| Depth | Description | When Used |
+|-------|-------------|----------|
+| **Basic** | Check for existence of controls | Initial assessments; Low impact systems |
+| **Focused** | Evaluate implementation | Most common approach |
+| **Comprehensive** | Thorough, in-depth assessment | High impact systems; 3PAO assessments |
+
+### Security Assessment Report (SAR) Structure
+
+The SAR documents assessment results:
+
+1. **Executive Summary** — High-level findings and authorization recommendation
+2. **Assessment Scope** — Systems, components, controls assessed
+3. **Assessment Methodology** — Methods used, depth, timeframe
+4. **Findings** — Control-by-control results
+5. **Weaknesses and Deficiencies** — OTS (Other Than Satisfied) findings
+6. **Risk Exposure** — Risk ratings for identified weaknesses
+7. **Recommendations** — Remediation actions
+
+**Finding format:**
+```
+Control: AC-2(3)
+Objective: Determine if inactive accounts are disabled within the defined period.
+Status: Other Than Satisfied
+Finding: Audit of Active Directory accounts identified 47 accounts inactive for >120 days; 
+         ODV is 90 days. Automated account review process is not functioning correctly.
+Risk: Moderate — dormant accounts represent attack surface for credential-based attacks.
+Recommendation: Fix automated review process; immediately disable the 47 identified accounts.
+```
+
+---
+
+## Plan of Action and Milestones (POA&M)
+
+### POA&M Purpose
+
+The POA&M (CA-5) is a living document tracking all security weaknesses found during assessments, continuous monitoring, and self-assessment. Required for all federal systems.
+
+### POA&M Required Fields
+
+| Field | Description |
+|-------|-------------|
+| POA&M ID | Unique identifier |
+| Weakness/Deficiency | Description of the finding |
+| Source | How discovered (scan, audit, assessment, pen test) |
+| Control ID | Related SP 800-53 control |
+| Risk Level | Critical / High / Moderate / Low |
+| Scheduled Completion Date | When remediation will be complete |
+| Milestone Description | Steps to remediate with dates |
+| Resources Required | Staff, tools, budget |
+| Status | Open / Completed / Delayed / Risk Accepted |
+
+### POA&M Timelines (FedRAMP Guidance)
+
+| Risk Level | Remediation Deadline |
+|-----------|---------------------|
+| Critical | 30 days |
+| High | 90 days |
+| Moderate | 180 days |
+| Low | 1 year |
+| Operational Requirement | Risk accepted; ISSO/SO signature required |
+
+### Risk Acceptance
+
+When a weakness cannot be remediated within the standard timeline:
+- Document a **Risk Acceptance** with business justification
+- ISSO and System Owner must sign off
+- Authorizing Official (AO) may need to approve for High/Critical
+- Review at each ConMon cycle
+- Cannot be risk-accepted indefinitely for High/Critical findings
+
+---
+
+## Risk Management Framework (RMF) — SP 800-37 Rev 2
+
+### Step 1 — Prepare
+
+**Purpose:** Establish the organizational and system context for managing security and privacy risk.
+
+**Key tasks:**
+- Assign roles: Authorizing Official (AO), System Owner (SO), ISSO, Senior Agency IS Official (SAISO)
+- Develop or update organizational risk management strategy (PM-9)
+- Identify common controls (PM-10)
+- Conduct mission/business process analysis (PM-11)
+- Perform organization-level risk assessment (RA-3)
+- Establish information life cycle for the system
+
+**Output:** Risk management roles assigned; organization-level risk assessment completed; common control inventory established.
+
+### Step 2 — Categorize
+
+**Purpose:** Categorize the system and information processed, stored, and transmitted based on FIPS 199.
+
+**Key tasks:**
+- Describe the system (SSP Section 1 and 2)
+- Identify information types using SP 800-60
+- Determine impact levels for C, I, A
+- Determine overall system impact level (high-water mark)
+- Document in the Security Categorization document
+
+**Output:** System Security Categorization document (signed by AO and SO).
+
+### Step 3 — Select
+
+**Purpose:** Select, tailor, and document the controls for the system.
+
+**Key tasks:**
+- Select starting baseline from SP 800-53B (Low/Moderate/High)
+- Apply tailoring (common controls, scoping, ODVs, compensating controls)
+- Document all tailoring decisions in the SSP
+- Develop continuous monitoring strategy (CA-7)
+- Review and approve control selection (AO concurrence)
+
+**Output:** SSP with control selection; ConMon strategy.
+
+### Step 4 — Implement
+
+**Purpose:** Implement the controls and document how they are deployed in the operational environment.
+
+**Key tasks:**
+- Implement the selected controls
+- Document implementation in SSP (one narrative per control)
+- Document design and implementation information for developer controls (SA-4)
+- Identify and address supply chain risks (SR family)
+
+**Output:** Implemented controls; completed SSP implementation narratives.
+
+### Step 5 — Assess
+
+**Purpose:** Determine if the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting security and privacy requirements.
+
+**Key tasks:**
+- Develop Security Assessment Plan (SAP) using SP 800-53A
+- Select qualified assessors (independent for Moderate/High; 3PAO for FedRAMP)
+- Conduct assessments (examine, interview, test)
+- Document findings in SAR
+- Develop initial POA&M from SAR findings
+
+**Output:** SAP, SAR, initial POA&M.
+
+**Independence requirements:**
+- **Low systems:** Self-assessment permitted
+- **Moderate systems:** Independent assessor (different team from implementers)
+- **High systems / FedRAMP:** 3PAO required; must be accredited by A2LA/FedRAMP PMO
+
+### Step 6 — Authorize
+
+**Purpose:** Provide organizational accountability by requiring a senior official to determine if the security and privacy risk to organizational operations/assets is acceptable.
+
+**Authorization package contents:**
+1. System Security Plan (SSP)
+2. Security Assessment Report (SAR)
+3. Plan of Action and Milestones (POA&M)
+4. Executive Summary (for AO review)
+
+**Authorization decisions:**
+- **Authorization to Operate (ATO)** — risk is acceptable; typically granted for 3 years
+- **Common Control Authorization (CCA)** — for common control providers
+- **Denial of Authorization to Operate (DATO)** — risk is not acceptable; system must be shut down or remediated
+- **Authorization to Use (ATU)** — for external systems/services
+
+**Ongoing authorization:** Continuous authorization (preferred for Moderate/High) replaces periodic re-authorization with real-time risk management.
+
+### Step 7 — Monitor
+
+**Purpose:** Maintain ongoing situational awareness about the security and privacy posture of the system.
+
+**Key tasks:**
+- Implement ConMon strategy (CA-7)
+- Conduct ongoing assessments of selected controls
+- Respond to changes in system and threat environment
+- Report security status to AO
+- Update SSP, SAR, POA&M as changes occur
+- Conduct ongoing risk determination and acceptance
+
+**FedRAMP ConMon requirements:**
+- Monthly vulnerability scans (OS, databases, web apps)
+- Annual penetration test (conducted by 3PAO)
+- Monthly POA&M updates
+- Significant change request before major system changes
+- Annual security reviews
+
+---
+
+## Continuous Monitoring (ConMon) Strategy
+
+### ConMon Frequencies (SP 800-137 / CA-7)
+
+| Activity | Recommended Frequency | FedRAMP Frequency |
+|----------|----------------------|------------------|
+| Vulnerability scans (OS) | Monthly | Monthly |
+| Vulnerability scans (Web app) | Monthly | Monthly |
+| Vulnerability scans (Database) | Monthly | Weekly |
+| Control assessments (selected) | Ongoing/quarterly | Annually |
+| Security awareness training | Annual | Annual |
+| Contingency plan testing | Annual | Annual |
+| Full control assessment | Every 3 years / at reauthorization | Annual (3PAO) |
+| Penetration testing | Annual (Moderate+) | Annual (3PAO) |
+
+### ConMon Automation
+
+Support tools for ConMon implementation:
+- **SCAP (Security Content Automation Protocol)** — standardized vulnerability scanning
+- **CVE/CVSS** — common vulnerability scoring
+- **OVAL/XCCDF** — configuration checking
+- **NVD (National Vulnerability Database)** — NIST vulnerability repository
+- **CDM (Continuous Diagnostics and Mitigation)** — DHS/CISA program for federal agencies
+- **OSCAL** — machine-readable security control documentation
+
+---
+
+## OSCAL — Open Security Controls Assessment Language
+
+OSCAL (developed by NIST) provides machine-readable representations of SP 800-53 content:
+
+### OSCAL Layers
+
+| Layer | Purpose | Formats |
+|-------|---------|---------|
+| **Catalog** | Control definitions (SP 800-53 catalog) | JSON, XML, YAML |
+| **Profile** | Baseline selection and tailoring | JSON, XML, YAML |
+| **Component Definition** | Reusable component implementations | JSON, XML, YAML |
+| **System Security Plan** | SSP in machine-readable format | JSON, XML, YAML |
+| **Assessment Plan** | SAP in machine-readable format | JSON, XML, YAML |
+| **Assessment Results** | SAR findings in machine-readable format | JSON, XML, YAML |
+| **POA&M** | Plan of action in machine-readable format | JSON, XML, YAML |
+
+**FedRAMP OSCAL adoption:** FedRAMP has been moving toward OSCAL-based SSP submissions. Tools supporting OSCAL: Trestle (IBM), Xacta 360, Atlasity, Empower.
+
+---
+
+## Cross-Framework Mapping
+
+### SP 800-53 Rev 5 → ISO 27001:2022
+
+| SP 800-53 Family | ISO 27001:2022 Annex A Controls |
+|-----------------|-------------------------------|
+| AC (Access Control) | 5.15–5.18 (Access, privilege), 8.2–8.5 |
+| AT (Awareness & Training) | 6.3 (Security awareness) |
+| AU (Audit) | 8.15 (Logging), 8.16 (Monitoring) |
+| CA (Assessment) | 5.35 (IS review), 5.36 (Compliance) |
+| CM (Config Mgmt) | 8.8–8.9 (Vulnerability, config), 8.32 |
+| CP (Contingency) | 5.29 (BCP), 8.13 (Backup) |
+| IA (Authentication) | 5.17 (Authentication), 8.5 (MFA) |
+| IR (Incident Response) | 5.24–5.28 (Incident management) |
+| PE (Physical) | 7.1–7.14 (Physical controls) |
+| RA (Risk Assessment) | 5.1 (Risk treatment), 6.1 (Risk process) |
+| SC (Comms Protection) | 5.14 (Transfer), 8.20–8.26 (Network) |
+| SI (Integrity) | 8.7 (Malware), 8.8 (Vulnerability), 8.19 |
+| SR (Supply Chain) | 5.19–5.22 (Supplier security) |
+
+### SP 800-53 Rev 5 → NIST CSF 2.0
+
+The CSF 2.0 (February 2024) maps to SP 800-53:
+
+| CSF Function | Key SP 800-53 Families |
+|-------------|----------------------|
+| **GV (Govern)** | PM, PL, AT, RA |
+| **ID (Identify)** | RA, CA, CM, PM |
+| **PR (Protect)** | AC, AT, CM, IA, MA, MP, PE, SC, SI, SR |
+| **DE (Detect)** | AU, CA, IR, RA, SI |
+| **RS (Respond)** | IR, CA |
+| **RC (Recover)** | CP, IR |
+
+Full mapping: SP 800-53B Appendix B provides CSF subcategory → SP 800-53 control mapping.
+
+### SP 800-53 Rev 5 → CMMC 2.0
+
+CMMC 2.0 is based on **NIST SP 800-171 Rev 2**, which derives from SP 800-53:
+
+| CMMC Level | SP 800-53 Basis |
+|-----------|----------------|
+| Level 1 (Foundational) | Subset of 800-171 practices (17 practices from FAR clause) |
+| Level 2 (Advanced) | Full SP 800-171 Rev 2 (110 practices = ~320 SP 800-53 controls) |
+| Level 3 (Expert) | SP 800-171 + selected SP 800-172 controls |
+
+SP 800-171 Appendix D provides the mapping from each 800-171 requirement to the SP 800-53 source controls.
+
+### SP 800-53 Rev 5 → FedRAMP
+
+FedRAMP uses the SP 800-53 Moderate or High baseline with overlay parameters:
+
+| FedRAMP Difference | Detail |
+|-------------------|--------|
+| Specific ODV values | Defined in FedRAMP baseline documentation |
+| Additional requirements | Incident reporting to US-CERT; 3PAO requirement |
+| Cryptography | FIPS 140-2/140-3 validated modules explicitly required |
+| ConMon | Specific monthly/annual frequencies required |
+| SSP format | FedRAMP SSP template must be used |
+| Authorization types | Agency ATO or JAB P-ATO |
+
+---
+
+## Key Roles in the RMF / SP 800-53 Context
+
+| Role | Abbreviation | Responsibility |
+|------|-------------|---------------|
+| Authorizing Official | AO | Accepts risk; grants/denies ATO |
+| Authorizing Official Designated Representative | AODR | Acts on behalf of AO |
+| Chief Information Officer | CIO | Overall IT governance |
+| Senior Agency Information Security Official | SAISO | Agency-wide IS oversight |
+| Information System Security Officer | ISSO | Day-to-day security operations for system |
+| Information System Security Manager | ISSM | Manages multiple ISSOs |
+| System Owner | SO | Responsible for system operation |
+| Common Control Provider | CCP | Implements shared/inherited controls |
+| Security Control Assessor | SCA | Conducts independent assessment |
+| Privacy Officer / CPO | CPO | Privacy program lead |
+
+---
+
+## Key NIST Publications Related to SP 800-53
+
+| Publication | Title | Role |
+|-------------|-------|------|
+| SP 800-53 Rev 5 | Security and Privacy Controls | Main control catalog |
+| SP 800-53A Rev 5 | Assessing Security and Privacy Controls | Assessment procedures |
+| SP 800-53B | Control Baselines | Baseline definitions |
+| SP 800-37 Rev 2 | Risk Management Framework | RMF steps |
+| SP 800-60 Vol I/II | Information Types / Impact Levels | Categorization guidance |
+| SP 800-30 Rev 1 | Risk Assessment | Risk assessment methodology |
+| SP 800-137A | ConMon | Continuous monitoring |
+| SP 800-63 Rev 3 | Digital Identity | Authentication assurance |
+| SP 800-82 Rev 3 | OT Security | ICS/SCADA guide |
+| SP 800-88 Rev 1 | Media Sanitization | Media disposal |
+| SP 800-115 | Security Testing | Penetration testing methodology |
+| FIPS 199 | Security Categorization | Impact level determination |
+| FIPS 200 | Minimum Security Requirements | Baseline requirement |
+| FIPS 140-3 | Cryptographic Modules | Cryptography standard |