NIST control crosswalk

Crosswalk catalog mapping NIST control IDs — SP 800-53 Rev 5 (federal systems), NIST CSF 2.0 (cyber risk management), SP 800-171 Rev 3 (CUI / non-federal), and SP 800-218 SSDF (secure software development) — to the framework primitives that satisfy them. Used by operators producing System Security Plans (SSPs), POAMs, ATO packages, or CMMC self-assessments to show evidence-of-control coverage at the primitive level.

The catalog is intentionally NOT exhaustive — controls that are purely organizational (e.g. PS-1 Personnel Security Policy) or purely physical (e.g. PE-3 Physical Access Control) are absent; only controls a framework can demonstrably help an operator meet are mapped.

b.nistCrosswalk.controls(catalog) #

Returns the control catalog map for one of: 800-53r5, csf-2.0, 800-171r3, 800-218.

var sp80053 = b.nistCrosswalk.controls("800-53r5");
console.log(sp80053["AC-3"].primitives);
// → ["b.permissions", "b.middleware.requireAuth", ...]

b.nistCrosswalk.coverage(opts) #

{
  {
    catalog:    "800-53r5" | "csf-2.0" | "800-171r3" | "800-218",
    controlIds: string[],
  }
}

Given a list of control IDs the operator's SSP claims to satisfy, returns { covered, uncovered, primitives } — covered lists the IDs in the catalog with at least one mapped primitive, uncovered lists IDs with no mapping, primitives is the deduplicated set of framework primitives evidencing coverage. Use the output to bind SSP control descriptions to specific framework callouts.

var rv = b.nistCrosswalk.coverage({
  catalog:    "800-53r5",
  controlIds: ["AC-2", "AC-3", "AC-99-fake"],
});
// rv.covered     → ["AC-2", "AC-3"]
// rv.uncovered   → ["AC-99-fake"]
// rv.primitives  → ["b.session", "b.auth.password", "b.permissions", ...]

b.nistCrosswalk.listCatalogs() #

Returns [{ id, family, count }] — the catalogs known to the crosswalk + how many control IDs are mapped in each.

b.nistCrosswalk.listCatalogs();
// → [{ id: "800-53r5", family: "...", count: 50 }, ...]

Last updated 2026-08-08T16:39:49.652Z by seeder.