Skip to content

ADR 0008: NIST SP 800-53 rev5 as a second control framework

  • Status: accepted (v1.0.0)
  • Date: 2026-09-26

Context

Only CIS v8 was supported, and its official mapping targets ATT&CK v8.2. The roadmap listed NIST 800-53 via the CTID Mappings Explorer.

Decision

  • Ingest the CTID Mappings Explorer file nist_800_53-rev5_attack-16.1-enterprise.json (Apache-2.0, sha256-pinned in scripts/download_data.py). Each mitigates object is one (control, technique) pair. The 96 non_mappable objects carry no control and are skipped.
  • Carry ATT&CK v16.1 ids to v19.2 with the same revoked-by resolver used for CIS: 5,090 pairs unchanged, 173 carried forward, 1 dropped, 5,236 unique pairs over 109 controls.
  • Build a separate catalog, processed/catalog-nist.json (--catalog nist), with the same techniques, rules and log sources but NIST controls. Keeping it separate means that every published CIS number, and the synthetic-org benchmark that samples controls, is unchanged.
  • New selector @family:AC|IA for NIST families. vantage/postures/acme-nist.yaml claims every mapped control.

Consequences

  • Claiming every mapped NIST control covers 66.9% of ATT&CK v19.2 on paper, compared with 54.2% for CIS IG3. With the same telemetry the defended share is similar (40.3% vs 37.7% with every log source), so the paper-vs-real gap is larger for NIST (26.6 pp vs 16.5 pp).
  • The CTID mapping has no Implementation-Group equivalent. Update (ADR 0009): SP 800-53B baseline membership now comes from the NIST OSCAL profiles (@baseline:LOW|MODERATE|HIGH). The upper bound barely matters: LOW already reaches 460 of the 466 mapped techniques (66.0% vs 66.9%), and MODERATE and HIGH reach all 466.