icdev 0.0.3__py3-none-any.whl

context/compliance/control_crosswalk.json

@@ -0,0 +1,1914 @@
+{
+  "metadata": {
+    "title": "Unified Control Framework Crosswalk",
+    "source": "NIST SP 800-53 Rev 5, FedRAMP Rev 5, NIST SP 800-171 Rev 2, CMMC v2.0, DISA STIGs",
+    "classification": "CUI // SP-CTI",
+    "version": "1.0",
+    "last_updated": "2026-02-15",
+    "description": "Cross-framework control mapping enabling single implementation to satisfy multiple compliance requirements"
+  },
+  "frameworks_mapped": [
+    "nist_800_53",
+    "fedramp_moderate",
+    "fedramp_high",
+    "nist_800_171",
+    "cmmc_level_2",
+    "cmmc_level_3"
+  ],
+  "families": [
+    {"code": "AC", "name": "Access Control"},
+    {"code": "AT", "name": "Awareness and Training"},
+    {"code": "AU", "name": "Audit and Accountability"},
+    {"code": "CA", "name": "Assessment, Authorization, and Monitoring"},
+    {"code": "CM", "name": "Configuration Management"},
+    {"code": "CP", "name": "Contingency Planning"},
+    {"code": "IA", "name": "Identification and Authentication"},
+    {"code": "IR", "name": "Incident Response"},
+    {"code": "MA", "name": "Maintenance"},
+    {"code": "MP", "name": "Media Protection"},
+    {"code": "PE", "name": "Physical and Environmental Protection"},
+    {"code": "PL", "name": "Planning"},
+    {"code": "PM", "name": "Program Management"},
+    {"code": "PS", "name": "Personnel Security"},
+    {"code": "PT", "name": "PII Processing and Transparency"},
+    {"code": "RA", "name": "Risk Assessment"},
+    {"code": "SA", "name": "System and Services Acquisition"},
+    {"code": "SC", "name": "System and Communications Protection"},
+    {"code": "SI", "name": "System and Information Integrity"},
+    {"code": "SR", "name": "Supply Chain Risk Management"}
+  ],
+  "crosswalk": [
+    {
+      "nist_800_53": "AC-1",
+      "title": "Policy and Procedures",
+      "family": "AC",
+      "priority": "P1",
+      "description": "Develop, document, and disseminate access control policy and procedures.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": null,
+      "cmmc_level_2": null,
+      "cmmc_level_3": null,
+      "stig_rules": ["SV-86473r1_rule", "SV-86475r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "AC-2",
+      "title": "Account Management",
+      "family": "AC",
+      "priority": "P1",
+      "description": "Manage system accounts including establishing, activating, modifying, reviewing, disabling, and removing accounts.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.1.1",
+      "cmmc_level_2": "AC.L2-3.1.1",
+      "cmmc_level_3": "AC.L2-3.1.1",
+      "stig_rules": ["SV-86477r1_rule", "SV-86479r1_rule", "SV-86481r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "AC-3",
+      "title": "Access Enforcement",
+      "family": "AC",
+      "priority": "P1",
+      "description": "Enforce approved authorizations for logical access to information and system resources.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.1.2",
+      "cmmc_level_2": "AC.L2-3.1.2",
+      "cmmc_level_3": "AC.L2-3.1.2",
+      "stig_rules": ["SV-86483r1_rule", "SV-86485r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "AC-4",
+      "title": "Information Flow Enforcement",
+      "family": "AC",
+      "priority": "P1",
+      "description": "Enforce approved authorizations for controlling the flow of information within the system and between systems.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.1.3",
+      "cmmc_level_2": "AC.L2-3.1.3",
+      "cmmc_level_3": "AC.L3-3.1.3e",
+      "stig_rules": ["SV-86487r1_rule", "SV-86489r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "AC-5",
+      "title": "Separation of Duties",
+      "family": "AC",
+      "priority": "P1",
+      "description": "Separate duties of individuals to reduce the risk of malevolent activity.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.1.4",
+      "cmmc_level_2": "AC.L2-3.1.4",
+      "cmmc_level_3": "AC.L2-3.1.4",
+      "stig_rules": ["SV-86491r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "AC-6",
+      "title": "Least Privilege",
+      "family": "AC",
+      "priority": "P1",
+      "description": "Employ the principle of least privilege, allowing only authorized accesses necessary to accomplish assigned tasks.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.1.5",
+      "cmmc_level_2": "AC.L2-3.1.5",
+      "cmmc_level_3": "AC.L3-3.1.5e",
+      "stig_rules": ["SV-86493r1_rule", "SV-86495r1_rule", "SV-86497r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "AC-7",
+      "title": "Unsuccessful Logon Attempts",
+      "family": "AC",
+      "priority": "P1",
+      "description": "Enforce a limit of consecutive invalid logon attempts within a time period and automatically lock the account.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.1.8",
+      "cmmc_level_2": "AC.L2-3.1.8",
+      "cmmc_level_3": "AC.L2-3.1.8",
+      "stig_rules": ["SV-86499r1_rule", "SV-86501r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "AC-8",
+      "title": "System Use Notification",
+      "family": "AC",
+      "priority": "P1",
+      "description": "Display system use notification message or banner before granting access.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.1.9",
+      "cmmc_level_2": "AC.L2-3.1.9",
+      "cmmc_level_3": "AC.L2-3.1.9",
+      "stig_rules": ["SV-86503r1_rule", "SV-86505r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "AC-11",
+      "title": "Device Lock",
+      "family": "AC",
+      "priority": "P3",
+      "description": "Prevent further access to the system by initiating a device lock after a period of inactivity.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.1.10",
+      "cmmc_level_2": "AC.L2-3.1.10",
+      "cmmc_level_3": "AC.L2-3.1.10",
+      "stig_rules": ["SV-86507r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "AC-12",
+      "title": "Session Termination",
+      "family": "AC",
+      "priority": "P2",
+      "description": "Automatically terminate a user session after organization-defined conditions or trigger events.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.1.11",
+      "cmmc_level_2": "AC.L2-3.1.11",
+      "cmmc_level_3": "AC.L2-3.1.11",
+      "stig_rules": ["SV-86509r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "AC-17",
+      "title": "Remote Access",
+      "family": "AC",
+      "priority": "P1",
+      "description": "Establish and document usage restrictions, configuration/connection requirements, and implementation guidance for remote access.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.1.12",
+      "cmmc_level_2": "AC.L2-3.1.12",
+      "cmmc_level_3": "AC.L2-3.1.12",
+      "stig_rules": ["SV-86511r1_rule", "SV-86513r1_rule", "SV-86515r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "AC-18",
+      "title": "Wireless Access",
+      "family": "AC",
+      "priority": "P1",
+      "description": "Establish configuration requirements, connection requirements, and implementation guidance for wireless access.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.1.16",
+      "cmmc_level_2": "AC.L2-3.1.16",
+      "cmmc_level_3": "AC.L2-3.1.16",
+      "stig_rules": ["SV-86517r1_rule", "SV-86519r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "AC-19",
+      "title": "Access Control for Mobile Devices",
+      "family": "AC",
+      "priority": "P1",
+      "description": "Establish configuration requirements, connection requirements, and implementation guidance for mobile devices.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.1.18",
+      "cmmc_level_2": "AC.L2-3.1.18",
+      "cmmc_level_3": "AC.L2-3.1.18",
+      "stig_rules": ["SV-86521r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "AC-20",
+      "title": "Use of External Systems",
+      "family": "AC",
+      "priority": "P1",
+      "description": "Establish terms and conditions for authorized individuals to access the system from external systems.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.1.20",
+      "cmmc_level_2": "AC.L2-3.1.20",
+      "cmmc_level_3": "AC.L2-3.1.20",
+      "stig_rules": ["SV-86523r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "AC-22",
+      "title": "Publicly Accessible Content",
+      "family": "AC",
+      "priority": "P3",
+      "description": "Designate individuals authorized to post information onto a publicly accessible system and review content for nonpublic information.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.1.22",
+      "cmmc_level_2": "AC.L2-3.1.22",
+      "cmmc_level_3": "AC.L2-3.1.22",
+      "stig_rules": ["SV-86525r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "AT-2",
+      "title": "Literacy Training and Awareness",
+      "family": "AT",
+      "priority": "P1",
+      "description": "Provide security and privacy literacy training to system users including insider threat awareness.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.2.1",
+      "cmmc_level_2": "AT.L2-3.2.1",
+      "cmmc_level_3": "AT.L2-3.2.1",
+      "stig_rules": ["SV-86527r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "AT-3",
+      "title": "Role-Based Training",
+      "family": "AT",
+      "priority": "P1",
+      "description": "Provide role-based security and privacy training to personnel with assigned security roles and responsibilities.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.2.2",
+      "cmmc_level_2": "AT.L2-3.2.2",
+      "cmmc_level_3": "AT.L2-3.2.2",
+      "stig_rules": ["SV-86529r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "AT-4",
+      "title": "Training Records",
+      "family": "AT",
+      "priority": "P3",
+      "description": "Document and monitor individual training activities including security and privacy training.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": null,
+      "cmmc_level_2": null,
+      "cmmc_level_3": null,
+      "stig_rules": ["SV-86531r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "AU-2",
+      "title": "Event Logging",
+      "family": "AU",
+      "priority": "P1",
+      "description": "Identify the types of events that the system is capable of logging in support of the audit function.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.3.1",
+      "cmmc_level_2": "AU.L2-3.3.1",
+      "cmmc_level_3": "AU.L2-3.3.1",
+      "stig_rules": ["SV-86533r1_rule", "SV-86535r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "AU-3",
+      "title": "Content of Audit Records",
+      "family": "AU",
+      "priority": "P1",
+      "description": "Ensure audit records contain information establishing what, when, where, source, outcome, and identity of event.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.3.1",
+      "cmmc_level_2": "AU.L2-3.3.1",
+      "cmmc_level_3": "AU.L2-3.3.1",
+      "stig_rules": ["SV-86537r1_rule", "SV-86539r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "AU-4",
+      "title": "Audit Log Storage Capacity",
+      "family": "AU",
+      "priority": "P1",
+      "description": "Allocate audit log storage capacity to accommodate anticipated audit log volume.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": null,
+      "cmmc_level_2": null,
+      "cmmc_level_3": null,
+      "stig_rules": ["SV-86541r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "AU-5",
+      "title": "Response to Audit Logging Process Failures",
+      "family": "AU",
+      "priority": "P1",
+      "description": "Alert designated personnel in the event of an audit logging process failure and take additional defined actions.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.3.4",
+      "cmmc_level_2": "AU.L2-3.3.4",
+      "cmmc_level_3": "AU.L2-3.3.4",
+      "stig_rules": ["SV-86543r1_rule", "SV-86545r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "AU-6",
+      "title": "Audit Record Review, Analysis, and Reporting",
+      "family": "AU",
+      "priority": "P1",
+      "description": "Review and analyze system audit records for indications of inappropriate or unusual activity.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.3.5",
+      "cmmc_level_2": "AU.L2-3.3.5",
+      "cmmc_level_3": "AU.L2-3.3.5",
+      "stig_rules": ["SV-86547r1_rule", "SV-86549r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "AU-7",
+      "title": "Audit Record Reduction and Report Generation",
+      "family": "AU",
+      "priority": "P3",
+      "description": "Provide and implement an audit record reduction and report generation capability.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.3.6",
+      "cmmc_level_2": "AU.L2-3.3.6",
+      "cmmc_level_3": "AU.L2-3.3.6",
+      "stig_rules": ["SV-86551r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "AU-8",
+      "title": "Time Stamps",
+      "family": "AU",
+      "priority": "P1",
+      "description": "Use internal system clocks to generate time stamps for audit records and synchronize with authoritative time source.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.3.7",
+      "cmmc_level_2": "AU.L2-3.3.7",
+      "cmmc_level_3": "AU.L2-3.3.7",
+      "stig_rules": ["SV-86553r1_rule", "SV-86555r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "AU-9",
+      "title": "Protection of Audit Information",
+      "family": "AU",
+      "priority": "P1",
+      "description": "Protect audit information and audit logging tools from unauthorized access, modification, and deletion.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.3.8",
+      "cmmc_level_2": "AU.L2-3.3.8",
+      "cmmc_level_3": "AU.L3-3.3.3e",
+      "stig_rules": ["SV-86557r1_rule", "SV-86559r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "AU-11",
+      "title": "Audit Record Retention",
+      "family": "AU",
+      "priority": "P3",
+      "description": "Retain audit records for an organization-defined time period to support after-the-fact investigations.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": null,
+      "cmmc_level_2": null,
+      "cmmc_level_3": null,
+      "stig_rules": ["SV-86561r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "AU-12",
+      "title": "Audit Record Generation",
+      "family": "AU",
+      "priority": "P1",
+      "description": "Provide audit record generation capability for the events identified in AU-2 at system components.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.3.2",
+      "cmmc_level_2": "AU.L2-3.3.2",
+      "cmmc_level_3": "AU.L2-3.3.2",
+      "stig_rules": ["SV-86563r1_rule", "SV-86565r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "CA-2",
+      "title": "Control Assessments",
+      "family": "CA",
+      "priority": "P2",
+      "description": "Assess security and privacy controls to determine effectiveness in application.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.12.1",
+      "cmmc_level_2": "CA.L2-3.12.1",
+      "cmmc_level_3": "CA.L2-3.12.1",
+      "stig_rules": ["SV-86567r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "CA-3",
+      "title": "Information Exchange",
+      "family": "CA",
+      "priority": "P1",
+      "description": "Approve and manage the exchange of information between the system and other systems using ISAs, MOUs, or similar agreements.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": null,
+      "cmmc_level_2": null,
+      "cmmc_level_3": null,
+      "stig_rules": ["SV-86569r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "CA-5",
+      "title": "Plan of Action and Milestones",
+      "family": "CA",
+      "priority": "P3",
+      "description": "Develop a plan of action and milestones for the system to document planned remedial actions.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.12.2",
+      "cmmc_level_2": "CA.L2-3.12.2",
+      "cmmc_level_3": "CA.L2-3.12.2",
+      "stig_rules": ["SV-86571r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "CA-6",
+      "title": "Authorization",
+      "family": "CA",
+      "priority": "P1",
+      "description": "Assign a senior official as the authorizing official for the system and ensure authorization before operations.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": null,
+      "cmmc_level_2": null,
+      "cmmc_level_3": null,
+      "stig_rules": ["SV-86573r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "CA-7",
+      "title": "Continuous Monitoring",
+      "family": "CA",
+      "priority": "P2",
+      "description": "Develop a system-level continuous monitoring strategy and implement continuous monitoring program.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.12.3",
+      "cmmc_level_2": "CA.L2-3.12.3",
+      "cmmc_level_3": "CA.L2-3.12.3",
+      "stig_rules": ["SV-86575r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "CA-8",
+      "title": "Penetration Testing",
+      "family": "CA",
+      "priority": "P2",
+      "description": "Conduct penetration testing at organization-defined frequency on organization-defined systems.",
+      "fedramp_moderate": false,
+      "fedramp_high": true,
+      "nist_800_171": null,
+      "cmmc_level_2": null,
+      "cmmc_level_3": "CA.L3-3.12.1e",
+      "stig_rules": ["SV-86577r1_rule"],
+      "il4_required": false,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "CM-2",
+      "title": "Baseline Configuration",
+      "family": "CM",
+      "priority": "P1",
+      "description": "Develop, document, and maintain a current baseline configuration of the system.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.4.1",
+      "cmmc_level_2": "CM.L2-3.4.1",
+      "cmmc_level_3": "CM.L2-3.4.1",
+      "stig_rules": ["SV-86579r1_rule", "SV-86581r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "CM-3",
+      "title": "Configuration Change Control",
+      "family": "CM",
+      "priority": "P1",
+      "description": "Determine and document the types of changes to the system that are configuration-controlled.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.4.3",
+      "cmmc_level_2": "CM.L2-3.4.3",
+      "cmmc_level_3": "CM.L3-3.4.1e",
+      "stig_rules": ["SV-86583r1_rule", "SV-86585r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "CM-4",
+      "title": "Impact Analyses",
+      "family": "CM",
+      "priority": "P2",
+      "description": "Analyze changes to the system to determine potential security and privacy impacts prior to change implementation.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.4.4",
+      "cmmc_level_2": "CM.L2-3.4.4",
+      "cmmc_level_3": "CM.L2-3.4.4",
+      "stig_rules": ["SV-86587r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "CM-5",
+      "title": "Access Restrictions for Change",
+      "family": "CM",
+      "priority": "P1",
+      "description": "Define, document, approve, and enforce physical and logical access restrictions associated with changes.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.4.5",
+      "cmmc_level_2": "CM.L2-3.4.5",
+      "cmmc_level_3": "CM.L2-3.4.5",
+      "stig_rules": ["SV-86589r1_rule", "SV-86591r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "CM-6",
+      "title": "Configuration Settings",
+      "family": "CM",
+      "priority": "P1",
+      "description": "Establish and document configuration settings for components reflecting the most restrictive mode consistent with requirements.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.4.2",
+      "cmmc_level_2": "CM.L2-3.4.2",
+      "cmmc_level_3": "CM.L2-3.4.2",
+      "stig_rules": ["SV-86593r1_rule", "SV-86595r1_rule", "SV-86597r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "CM-7",
+      "title": "Least Functionality",
+      "family": "CM",
+      "priority": "P1",
+      "description": "Configure the system to provide only mission-essential capabilities, restricting use of nonessential functions, ports, protocols, and services.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.4.6",
+      "cmmc_level_2": "CM.L2-3.4.6",
+      "cmmc_level_3": "CM.L2-3.4.6",
+      "stig_rules": ["SV-86599r1_rule", "SV-86601r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "CM-8",
+      "title": "System Component Inventory",
+      "family": "CM",
+      "priority": "P1",
+      "description": "Develop and document an inventory of system components that accurately reflects the system.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.4.1",
+      "cmmc_level_2": "CM.L2-3.4.1",
+      "cmmc_level_3": "CM.L3-3.4.2e",
+      "stig_rules": ["SV-86603r1_rule", "SV-86605r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "CM-11",
+      "title": "User-Installed Software",
+      "family": "CM",
+      "priority": "P1",
+      "description": "Establish and enforce a policy governing the installation of software by users.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.4.9",
+      "cmmc_level_2": "CM.L2-3.4.9",
+      "cmmc_level_3": "CM.L2-3.4.9",
+      "stig_rules": ["SV-86607r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "CP-1",
+      "title": "Policy and Procedures",
+      "family": "CP",
+      "priority": "P1",
+      "description": "Develop, document, and disseminate a contingency planning policy and procedures.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": null,
+      "cmmc_level_2": null,
+      "cmmc_level_3": null,
+      "stig_rules": ["SV-86609r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "CP-2",
+      "title": "Contingency Plan",
+      "family": "CP",
+      "priority": "P1",
+      "description": "Develop a contingency plan identifying essential missions, business functions, and associated contingency requirements.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": null,
+      "cmmc_level_2": null,
+      "cmmc_level_3": null,
+      "stig_rules": ["SV-86611r1_rule", "SV-86613r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "CP-4",
+      "title": "Contingency Plan Testing",
+      "family": "CP",
+      "priority": "P2",
+      "description": "Test the contingency plan using organization-defined tests to determine effectiveness and organizational readiness.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": null,
+      "cmmc_level_2": null,
+      "cmmc_level_3": null,
+      "stig_rules": ["SV-86614r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "CP-9",
+      "title": "System Backup",
+      "family": "CP",
+      "priority": "P1",
+      "description": "Conduct backups of user-level, system-level, and system documentation information.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.8.9",
+      "cmmc_level_2": "MP.L2-3.8.9",
+      "cmmc_level_3": "MP.L2-3.8.9",
+      "stig_rules": ["SV-86615r1_rule", "SV-86617r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "CP-10",
+      "title": "System Recovery and Reconstitution",
+      "family": "CP",
+      "priority": "P1",
+      "description": "Provide for the recovery and reconstitution of the system to a known state within defined time period.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": null,
+      "cmmc_level_2": null,
+      "cmmc_level_3": null,
+      "stig_rules": ["SV-86619r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "IA-2",
+      "title": "Identification and Authentication (Organizational Users)",
+      "family": "IA",
+      "priority": "P1",
+      "description": "Uniquely identify and authenticate organizational users and associate that identification with processes acting on their behalf.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.5.1",
+      "cmmc_level_2": "IA.L2-3.5.1",
+      "cmmc_level_3": "IA.L3-3.5.1e",
+      "stig_rules": ["SV-86621r1_rule", "SV-86623r1_rule", "SV-86625r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "IA-4",
+      "title": "Identifier Management",
+      "family": "IA",
+      "priority": "P1",
+      "description": "Manage system identifiers by receiving authorization, selecting, assigning, and preventing reuse.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.5.5",
+      "cmmc_level_2": "IA.L2-3.5.5",
+      "cmmc_level_3": "IA.L2-3.5.5",
+      "stig_rules": ["SV-86627r1_rule", "SV-86629r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "IA-5",
+      "title": "Authenticator Management",
+      "family": "IA",
+      "priority": "P1",
+      "description": "Manage system authenticators by verifying identity, establishing initial authenticator content, and ensuring administrative procedures are in place.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.5.2",
+      "cmmc_level_2": "IA.L2-3.5.2",
+      "cmmc_level_3": "IA.L3-3.5.3e",
+      "stig_rules": ["SV-86631r1_rule", "SV-86633r1_rule", "SV-86635r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "IA-6",
+      "title": "Authentication Feedback",
+      "family": "IA",
+      "priority": "P2",
+      "description": "Obscure feedback of authentication information during the authentication process.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.5.11",
+      "cmmc_level_2": "IA.L2-3.5.11",
+      "cmmc_level_3": "IA.L2-3.5.11",
+      "stig_rules": ["SV-86637r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "IA-8",
+      "title": "Identification and Authentication (Non-Organizational Users)",
+      "family": "IA",
+      "priority": "P1",
+      "description": "Uniquely identify and authenticate non-organizational users or processes acting on behalf of non-organizational users.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": null,
+      "cmmc_level_2": null,
+      "cmmc_level_3": null,
+      "stig_rules": ["SV-86639r1_rule", "SV-86641r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "IR-1",
+      "title": "Policy and Procedures",
+      "family": "IR",
+      "priority": "P1",
+      "description": "Develop, document, and disseminate an incident response policy and procedures.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": null,
+      "cmmc_level_2": null,
+      "cmmc_level_3": null,
+      "stig_rules": ["SV-86643r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "IR-2",
+      "title": "Incident Response Training",
+      "family": "IR",
+      "priority": "P2",
+      "description": "Provide incident response training to system users consistent with assigned roles and responsibilities.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.6.1",
+      "cmmc_level_2": "IR.L2-3.6.1",
+      "cmmc_level_3": "IR.L2-3.6.1",
+      "stig_rules": ["SV-86645r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "IR-3",
+      "title": "Incident Response Testing",
+      "family": "IR",
+      "priority": "P2",
+      "description": "Test the effectiveness of the incident response capability.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.6.3",
+      "cmmc_level_2": "IR.L2-3.6.3",
+      "cmmc_level_3": "IR.L2-3.6.3",
+      "stig_rules": ["SV-86647r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "IR-4",
+      "title": "Incident Handling",
+      "family": "IR",
+      "priority": "P1",
+      "description": "Implement an incident handling capability including preparation, detection, analysis, containment, eradication, and recovery.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.6.1",
+      "cmmc_level_2": "IR.L2-3.6.1",
+      "cmmc_level_3": "IR.L3-3.6.1e",
+      "stig_rules": ["SV-86649r1_rule", "SV-86651r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "IR-5",
+      "title": "Incident Monitoring",
+      "family": "IR",
+      "priority": "P1",
+      "description": "Track and document incidents on an ongoing basis.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.6.1",
+      "cmmc_level_2": "IR.L2-3.6.1",
+      "cmmc_level_3": "IR.L2-3.6.1",
+      "stig_rules": ["SV-86653r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "IR-6",
+      "title": "Incident Reporting",
+      "family": "IR",
+      "priority": "P1",
+      "description": "Require personnel to report suspected incidents to the organizational incident response capability.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.6.2",
+      "cmmc_level_2": "IR.L2-3.6.2",
+      "cmmc_level_3": "IR.L2-3.6.2",
+      "stig_rules": ["SV-86655r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "IR-7",
+      "title": "Incident Response Assistance",
+      "family": "IR",
+      "priority": "P2",
+      "description": "Provide an incident response support resource integral to the organizational incident response capability.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.6.1",
+      "cmmc_level_2": "IR.L2-3.6.1",
+      "cmmc_level_3": "IR.L3-3.6.2e",
+      "stig_rules": ["SV-86657r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "MA-2",
+      "title": "Controlled Maintenance",
+      "family": "MA",
+      "priority": "P2",
+      "description": "Schedule, document, and review records of maintenance, repair, and replacement on system components.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.7.1",
+      "cmmc_level_2": "MA.L2-3.7.1",
+      "cmmc_level_3": "MA.L2-3.7.1",
+      "stig_rules": ["SV-86659r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "MA-3",
+      "title": "Maintenance Tools",
+      "family": "MA",
+      "priority": "P3",
+      "description": "Approve, control, and monitor the use of system maintenance tools.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.7.2",
+      "cmmc_level_2": "MA.L2-3.7.2",
+      "cmmc_level_3": "MA.L2-3.7.2",
+      "stig_rules": ["SV-86661r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "MA-4",
+      "title": "Nonlocal Maintenance",
+      "family": "MA",
+      "priority": "P2",
+      "description": "Approve and monitor nonlocal maintenance and diagnostic activities.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.7.5",
+      "cmmc_level_2": "MA.L2-3.7.5",
+      "cmmc_level_3": "MA.L2-3.7.5",
+      "stig_rules": ["SV-86663r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "MA-5",
+      "title": "Maintenance Personnel",
+      "family": "MA",
+      "priority": "P2",
+      "description": "Establish a process for maintenance personnel authorization and maintain a list of authorized personnel.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.7.6",
+      "cmmc_level_2": "MA.L2-3.7.6",
+      "cmmc_level_3": "MA.L2-3.7.6",
+      "stig_rules": ["SV-86665r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "MA-6",
+      "title": "Timely Maintenance",
+      "family": "MA",
+      "priority": "P2",
+      "description": "Obtain maintenance support and spare parts for system components within defined time period of failure.",
+      "fedramp_moderate": false,
+      "fedramp_high": true,
+      "nist_800_171": null,
+      "cmmc_level_2": null,
+      "cmmc_level_3": "MA.L3-3.7.1e",
+      "stig_rules": ["SV-86667r1_rule"],
+      "il4_required": false,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "MP-2",
+      "title": "Media Access",
+      "family": "MP",
+      "priority": "P1",
+      "description": "Restrict access to digital and non-digital media to organization-defined types of individuals.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.8.2",
+      "cmmc_level_2": "MP.L2-3.8.2",
+      "cmmc_level_3": "MP.L2-3.8.2",
+      "stig_rules": ["SV-86669r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "MP-3",
+      "title": "Media Marking",
+      "family": "MP",
+      "priority": "P2",
+      "description": "Mark system media indicating distribution limitations, handling caveats, and applicable security markings.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.8.4",
+      "cmmc_level_2": "MP.L2-3.8.4",
+      "cmmc_level_3": "MP.L2-3.8.4",
+      "stig_rules": ["SV-86671r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "MP-4",
+      "title": "Media Storage",
+      "family": "MP",
+      "priority": "P1",
+      "description": "Physically control and securely store digital and non-digital media within controlled areas.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.8.1",
+      "cmmc_level_2": "MP.L2-3.8.1",
+      "cmmc_level_3": "MP.L2-3.8.1",
+      "stig_rules": ["SV-86673r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "MP-5",
+      "title": "Media Transport",
+      "family": "MP",
+      "priority": "P1",
+      "description": "Protect and control digital and non-digital media during transport outside of controlled areas.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.8.5",
+      "cmmc_level_2": "MP.L2-3.8.5",
+      "cmmc_level_3": "MP.L2-3.8.5",
+      "stig_rules": ["SV-86675r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "MP-6",
+      "title": "Media Sanitization",
+      "family": "MP",
+      "priority": "P1",
+      "description": "Sanitize system media prior to disposal, release out of organizational control, or release for reuse.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.8.3",
+      "cmmc_level_2": "MP.L2-3.8.3",
+      "cmmc_level_3": "MP.L3-3.8.1e",
+      "stig_rules": ["SV-86677r1_rule", "SV-86679r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "MP-7",
+      "title": "Media Use",
+      "family": "MP",
+      "priority": "P1",
+      "description": "Restrict the use of certain types of media on system components.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.8.7",
+      "cmmc_level_2": "MP.L2-3.8.7",
+      "cmmc_level_3": "MP.L2-3.8.7",
+      "stig_rules": ["SV-86681r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "PE-2",
+      "title": "Physical Access Authorizations",
+      "family": "PE",
+      "priority": "P1",
+      "description": "Develop, approve, and maintain a list of individuals with authorized access to the facility.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.10.1",
+      "cmmc_level_2": "PE.L2-3.10.1",
+      "cmmc_level_3": "PE.L2-3.10.1",
+      "stig_rules": ["SV-86683r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "PE-3",
+      "title": "Physical Access Control",
+      "family": "PE",
+      "priority": "P1",
+      "description": "Enforce physical access authorizations at entry/exit points using physical access control systems.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.10.1",
+      "cmmc_level_2": "PE.L2-3.10.1",
+      "cmmc_level_3": "PE.L3-3.10.1e",
+      "stig_rules": ["SV-86685r1_rule", "SV-86687r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "PE-6",
+      "title": "Monitoring Physical Access",
+      "family": "PE",
+      "priority": "P1",
+      "description": "Monitor physical access to the facility to detect and respond to physical security incidents.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.10.2",
+      "cmmc_level_2": "PE.L2-3.10.2",
+      "cmmc_level_3": "PE.L2-3.10.2",
+      "stig_rules": ["SV-86689r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "PE-17",
+      "title": "Alternate Work Site",
+      "family": "PE",
+      "priority": "P2",
+      "description": "Employ management, operational, and technical controls at alternate work sites.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.10.6",
+      "cmmc_level_2": "PE.L2-3.10.6",
+      "cmmc_level_3": "PE.L2-3.10.6",
+      "stig_rules": ["SV-86691r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "PL-1",
+      "title": "Policy and Procedures",
+      "family": "PL",
+      "priority": "P1",
+      "description": "Develop, document, and disseminate a planning policy and procedures.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": null,
+      "cmmc_level_2": null,
+      "cmmc_level_3": null,
+      "stig_rules": ["SV-86693r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "PL-2",
+      "title": "System Security and Privacy Plans",
+      "family": "PL",
+      "priority": "P1",
+      "description": "Develop security and privacy plans for the system consistent with the enterprise architecture.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.12.4",
+      "cmmc_level_2": "CA.L2-3.12.4",
+      "cmmc_level_3": "CA.L2-3.12.4",
+      "stig_rules": ["SV-86695r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "PL-4",
+      "title": "Rules of Behavior",
+      "family": "PL",
+      "priority": "P2",
+      "description": "Establish and provide rules describing responsibilities and expected behavior for system access.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": null,
+      "cmmc_level_2": null,
+      "cmmc_level_3": null,
+      "stig_rules": ["SV-86697r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "PM-1",
+      "title": "Information Security Program Plan",
+      "family": "PM",
+      "priority": "P1",
+      "description": "Develop and disseminate an organization-wide information security program plan.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": null,
+      "cmmc_level_2": null,
+      "cmmc_level_3": null,
+      "stig_rules": [],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "PM-9",
+      "title": "Risk Management Strategy",
+      "family": "PM",
+      "priority": "P1",
+      "description": "Develop a comprehensive strategy to manage risk to organizational operations, assets, and individuals.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": null,
+      "cmmc_level_2": null,
+      "cmmc_level_3": null,
+      "stig_rules": [],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "PM-16",
+      "title": "Threat Awareness Program",
+      "family": "PM",
+      "priority": "P1",
+      "description": "Implement a threat awareness program with cross-organization information-sharing capability.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": null,
+      "cmmc_level_2": null,
+      "cmmc_level_3": "RA.L3-3.11.2e",
+      "stig_rules": [],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "PS-3",
+      "title": "Personnel Screening",
+      "family": "PS",
+      "priority": "P1",
+      "description": "Screen individuals prior to authorizing access to the system.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.9.1",
+      "cmmc_level_2": "PS.L2-3.9.1",
+      "cmmc_level_3": "PS.L2-3.9.1",
+      "stig_rules": ["SV-86699r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "PS-4",
+      "title": "Personnel Termination",
+      "family": "PS",
+      "priority": "P1",
+      "description": "Upon termination, disable system access, terminate authenticators, conduct exit interviews, and retrieve property.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.9.2",
+      "cmmc_level_2": "PS.L2-3.9.2",
+      "cmmc_level_3": "PS.L2-3.9.2",
+      "stig_rules": ["SV-86701r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "PS-5",
+      "title": "Personnel Transfer",
+      "family": "PS",
+      "priority": "P2",
+      "description": "Review and confirm ongoing operational need for access authorizations when individuals are reassigned or transferred.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.9.2",
+      "cmmc_level_2": "PS.L2-3.9.2",
+      "cmmc_level_3": "PS.L2-3.9.2",
+      "stig_rules": ["SV-86703r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "PT-1",
+      "title": "Policy and Procedures",
+      "family": "PT",
+      "priority": "P1",
+      "description": "Develop, document, and disseminate PII processing and transparency policy and procedures.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": null,
+      "cmmc_level_2": null,
+      "cmmc_level_3": null,
+      "stig_rules": [],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "PT-2",
+      "title": "Authority to Process PII",
+      "family": "PT",
+      "priority": "P1",
+      "description": "Determine and document the legal authority that permits collection, use, maintenance, and sharing of PII.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": null,
+      "cmmc_level_2": null,
+      "cmmc_level_3": null,
+      "stig_rules": [],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "RA-3",
+      "title": "Risk Assessment",
+      "family": "RA",
+      "priority": "P1",
+      "description": "Conduct a risk assessment identifying threats, vulnerabilities, and potential impacts to organizational operations.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.11.1",
+      "cmmc_level_2": "RA.L2-3.11.1",
+      "cmmc_level_3": "RA.L2-3.11.1",
+      "stig_rules": ["SV-86705r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "RA-5",
+      "title": "Vulnerability Monitoring and Scanning",
+      "family": "RA",
+      "priority": "P1",
+      "description": "Monitor and scan for vulnerabilities in the system and hosted applications and remediate discovered vulnerabilities.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.11.2",
+      "cmmc_level_2": "RA.L2-3.11.2",
+      "cmmc_level_3": "RA.L2-3.11.2",
+      "stig_rules": ["SV-86707r1_rule", "SV-86709r1_rule", "SV-86711r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "RA-7",
+      "title": "Risk Response",
+      "family": "RA",
+      "priority": "P1",
+      "description": "Respond to findings from security assessments, monitoring, and audits in accordance with risk tolerance.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.11.3",
+      "cmmc_level_2": "RA.L2-3.11.3",
+      "cmmc_level_3": "RA.L2-3.11.3",
+      "stig_rules": ["SV-86713r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "SA-2",
+      "title": "Allocation of Resources",
+      "family": "SA",
+      "priority": "P1",
+      "description": "Determine high-level information security and privacy requirements for the system in mission/business process planning.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": null,
+      "cmmc_level_2": null,
+      "cmmc_level_3": null,
+      "stig_rules": ["SV-86715r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "SA-4",
+      "title": "Acquisition Process",
+      "family": "SA",
+      "priority": "P1",
+      "description": "Include security and privacy requirements in acquisition contracts for system development and services.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": null,
+      "cmmc_level_2": null,
+      "cmmc_level_3": null,
+      "stig_rules": ["SV-86717r1_rule", "SV-86719r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "SA-8",
+      "title": "Security and Privacy Engineering Principles",
+      "family": "SA",
+      "priority": "P1",
+      "description": "Apply systems security and privacy engineering principles in specification, design, development, implementation, and modification.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.13.2",
+      "cmmc_level_2": "SC.L2-3.13.2",
+      "cmmc_level_3": "SC.L2-3.13.2",
+      "stig_rules": ["SV-86721r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "SA-9",
+      "title": "External System Services",
+      "family": "SA",
+      "priority": "P1",
+      "description": "Require providers of external system services to comply with organizational security and privacy requirements.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": null,
+      "cmmc_level_2": null,
+      "cmmc_level_3": null,
+      "stig_rules": ["SV-86723r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "SA-11",
+      "title": "Developer Testing and Evaluation",
+      "family": "SA",
+      "priority": "P1",
+      "description": "Require the developer to create and implement a security and privacy assessment plan.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": null,
+      "cmmc_level_2": null,
+      "cmmc_level_3": null,
+      "stig_rules": ["SV-86725r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "SC-2",
+      "title": "Separation of System and User Functionality",
+      "family": "SC",
+      "priority": "P1",
+      "description": "Separate user functionality including user interface services from system management functionality.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.13.3",
+      "cmmc_level_2": "SC.L2-3.13.3",
+      "cmmc_level_3": "SC.L2-3.13.3",
+      "stig_rules": ["SV-86727r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "SC-4",
+      "title": "Information in Shared System Resources",
+      "family": "SC",
+      "priority": "P1",
+      "description": "Prevent unauthorized and unintended information transfer via shared system resources.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.13.4",
+      "cmmc_level_2": "SC.L2-3.13.4",
+      "cmmc_level_3": "SC.L2-3.13.4",
+      "stig_rules": ["SV-86729r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "SC-7",
+      "title": "Boundary Protection",
+      "family": "SC",
+      "priority": "P1",
+      "description": "Monitor and control communications at the external managed interfaces and at key internal managed interfaces.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.13.1",
+      "cmmc_level_2": "SC.L2-3.13.1",
+      "cmmc_level_3": "SC.L3-3.13.1e",
+      "stig_rules": ["SV-86731r1_rule", "SV-86733r1_rule", "SV-86735r1_rule", "SV-86737r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "SC-8",
+      "title": "Transmission Confidentiality and Integrity",
+      "family": "SC",
+      "priority": "P1",
+      "description": "Protect the confidentiality and integrity of transmitted information.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.13.8",
+      "cmmc_level_2": "SC.L2-3.13.8",
+      "cmmc_level_3": "SC.L2-3.13.8",
+      "stig_rules": ["SV-86739r1_rule", "SV-86741r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "SC-10",
+      "title": "Network Disconnect",
+      "family": "SC",
+      "priority": "P2",
+      "description": "Terminate the network connection at the end of the session or after a defined period of inactivity.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.13.9",
+      "cmmc_level_2": "SC.L2-3.13.9",
+      "cmmc_level_3": "SC.L2-3.13.9",
+      "stig_rules": ["SV-86743r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "SC-12",
+      "title": "Cryptographic Key Establishment and Management",
+      "family": "SC",
+      "priority": "P1",
+      "description": "Establish and manage cryptographic keys when cryptography is employed within the system.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.13.10",
+      "cmmc_level_2": "SC.L2-3.13.10",
+      "cmmc_level_3": "SC.L2-3.13.10",
+      "stig_rules": ["SV-86745r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "SC-13",
+      "title": "Cryptographic Protection",
+      "family": "SC",
+      "priority": "P1",
+      "description": "Implement organization-defined types of cryptography required for each specified cryptographic use.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.13.11",
+      "cmmc_level_2": "SC.L2-3.13.11",
+      "cmmc_level_3": "SC.L2-3.13.11",
+      "stig_rules": ["SV-86747r1_rule", "SV-86749r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "SC-15",
+      "title": "Collaborative Computing Devices and Applications",
+      "family": "SC",
+      "priority": "P1",
+      "description": "Prohibit remote activation of collaborative computing devices and applications with defined exceptions.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.13.12",
+      "cmmc_level_2": "SC.L2-3.13.12",
+      "cmmc_level_3": "SC.L2-3.13.12",
+      "stig_rules": ["SV-86751r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "SC-18",
+      "title": "Mobile Code",
+      "family": "SC",
+      "priority": "P2",
+      "description": "Define acceptable and unacceptable mobile code and technologies and establish usage restrictions.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.13.13",
+      "cmmc_level_2": "SC.L2-3.13.13",
+      "cmmc_level_3": "SC.L2-3.13.13",
+      "stig_rules": ["SV-86753r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "SC-23",
+      "title": "Session Authenticity",
+      "family": "SC",
+      "priority": "P1",
+      "description": "Protect the authenticity of communications sessions.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.13.15",
+      "cmmc_level_2": "SC.L2-3.13.15",
+      "cmmc_level_3": "SC.L2-3.13.15",
+      "stig_rules": ["SV-86755r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "SC-28",
+      "title": "Protection of Information at Rest",
+      "family": "SC",
+      "priority": "P1",
+      "description": "Protect the confidentiality and integrity of organization-defined information at rest.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.13.16",
+      "cmmc_level_2": "SC.L2-3.13.16",
+      "cmmc_level_3": "SC.L3-3.13.4e",
+      "stig_rules": ["SV-86757r1_rule", "SV-86759r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "SC-39",
+      "title": "Process Isolation",
+      "family": "SC",
+      "priority": "P1",
+      "description": "Maintain a separate execution domain for each executing system process.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": null,
+      "cmmc_level_2": null,
+      "cmmc_level_3": "SC.L3-3.13.4e",
+      "stig_rules": ["SV-86761r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "SI-2",
+      "title": "Flaw Remediation",
+      "family": "SI",
+      "priority": "P1",
+      "description": "Identify, report, and correct system flaws; test updates for effectiveness and side effects before installation.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.14.1",
+      "cmmc_level_2": "SI.L2-3.14.1",
+      "cmmc_level_3": "SI.L2-3.14.1",
+      "stig_rules": ["SV-86763r1_rule", "SV-86765r1_rule", "SV-86767r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "SI-3",
+      "title": "Malicious Code Protection",
+      "family": "SI",
+      "priority": "P1",
+      "description": "Implement malicious code protection mechanisms at system entry and exit points.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.14.2",
+      "cmmc_level_2": "SI.L2-3.14.2",
+      "cmmc_level_3": "SI.L2-3.14.2",
+      "stig_rules": ["SV-86769r1_rule", "SV-86771r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "SI-4",
+      "title": "System Monitoring",
+      "family": "SI",
+      "priority": "P1",
+      "description": "Monitor the system to detect attacks, indicators of potential attacks, and unauthorized connections.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.14.6",
+      "cmmc_level_2": "SI.L2-3.14.6",
+      "cmmc_level_3": "SI.L3-3.14.1e",
+      "stig_rules": ["SV-86773r1_rule", "SV-86775r1_rule", "SV-86777r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "SI-5",
+      "title": "Security Alerts, Advisories, and Directives",
+      "family": "SI",
+      "priority": "P1",
+      "description": "Receive system security alerts, advisories, and directives from external organizations on an ongoing basis.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": "171-3.14.3",
+      "cmmc_level_2": "SI.L2-3.14.3",
+      "cmmc_level_3": "SI.L2-3.14.3",
+      "stig_rules": ["SV-86779r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "SI-7",
+      "title": "Software, Firmware, and Information Integrity",
+      "family": "SI",
+      "priority": "P1",
+      "description": "Employ integrity verification tools to detect unauthorized changes to software, firmware, and information.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": null,
+      "cmmc_level_2": null,
+      "cmmc_level_3": null,
+      "stig_rules": ["SV-86781r1_rule", "SV-86783r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "SI-10",
+      "title": "Information Input Validation",
+      "family": "SI",
+      "priority": "P1",
+      "description": "Check the validity of organization-defined information inputs.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": null,
+      "cmmc_level_2": null,
+      "cmmc_level_3": null,
+      "stig_rules": ["SV-86785r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "SI-12",
+      "title": "Information Management and Retention",
+      "family": "SI",
+      "priority": "P2",
+      "description": "Manage and retain information within the system in accordance with applicable laws, regulations, and standards.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": null,
+      "cmmc_level_2": null,
+      "cmmc_level_3": null,
+      "stig_rules": ["SV-86787r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "SI-16",
+      "title": "Memory Protection",
+      "family": "SI",
+      "priority": "P1",
+      "description": "Implement controls to protect the system memory from unauthorized code execution.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": null,
+      "cmmc_level_2": null,
+      "cmmc_level_3": null,
+      "stig_rules": ["SV-86789r1_rule"],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "SR-1",
+      "title": "Policy and Procedures",
+      "family": "SR",
+      "priority": "P1",
+      "description": "Develop, document, and disseminate a supply chain risk management policy and procedures.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": null,
+      "cmmc_level_2": null,
+      "cmmc_level_3": null,
+      "stig_rules": [],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "SR-3",
+      "title": "Supply Chain Controls and Processes",
+      "family": "SR",
+      "priority": "P1",
+      "description": "Establish a process for identifying and addressing weaknesses or deficiencies in supply chain elements.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": null,
+      "cmmc_level_2": null,
+      "cmmc_level_3": null,
+      "stig_rules": [],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "SR-5",
+      "title": "Acquisition Strategies, Tools, and Methods",
+      "family": "SR",
+      "priority": "P1",
+      "description": "Employ acquisition strategies and procurement methods to protect against and mitigate supply chain risks.",
+      "fedramp_moderate": true,
+      "fedramp_high": true,
+      "nist_800_171": null,
+      "cmmc_level_2": null,
+      "cmmc_level_3": null,
+      "stig_rules": [],
+      "il4_required": true,
+      "il5_required": true,
+      "il6_required": true
+    },
+    {
+      "nist_800_53": "SR-11",
+      "title": "Component Authenticity",
+      "family": "SR",
+      "priority": "P2",
+      "description": "Develop and implement anti-counterfeit policy and procedures to detect and prevent counterfeit components.",
+      "fedramp_moderate": false,
+      "fedramp_high": true,
+      "nist_800_171": null,
+      "cmmc_level_2": null,
+      "cmmc_level_3": null,
+      "stig_rules": [],
+      "il4_required": false,
+      "il5_required": true,
+      "il6_required": true
+    }
+  ]
+}