name	oscal-catalog-provider
description	Fetch official NIST 800-53 and FedRAMP OSCAL catalogs from authoritative sources

OSCAL Catalog Provider

Purpose

Provide access to official NIST and FedRAMP control catalogs without requiring user uploads. This skill knows where to fetch authoritative OSCAL content and how to use it.

When to Use

Use this skill when:

User needs to reference NIST 800-53 controls but hasn't uploaded a catalog
Comparing an SSP against FedRAMP baselines
Generating implementation narratives for specific controls
Mapping controls between frameworks
Any task requiring authoritative control definitions

Official OSCAL Content Sources

NIST 800-53 Rev 5 (Full Catalog)

Resource	URL
Catalog JSON	`https://raw.githubusercontent.com/usnistgov/oscal-content/main/nist.gov/SP800-53/rev5/json/NIST_SP-800-53_rev5_catalog.json`
Catalog YAML	`https://raw.githubusercontent.com/usnistgov/oscal-content/main/nist.gov/SP800-53/rev5/yaml/NIST_SP-800-53_rev5_catalog.yaml`
Repository	`https://github.com/usnistgov/oscal-content`

Stats: 1,193 controls (323 base controls + 870 enhancements) across 20 control families.

FedRAMP Baselines (Rev 5)

Baseline	Controls	URL
HIGH	421	`https://raw.githubusercontent.com/GSA/fedramp-automation/master/dist/content/rev5/baselines/json/FedRAMP_rev5_HIGH-baseline-resolved-profile_catalog.json`
MODERATE	325	`https://raw.githubusercontent.com/GSA/fedramp-automation/master/dist/content/rev5/baselines/json/FedRAMP_rev5_MODERATE-baseline-resolved-profile_catalog.json`
LOW	156	`https://raw.githubusercontent.com/GSA/fedramp-automation/master/dist/content/rev5/baselines/json/FedRAMP_rev5_LOW-baseline-resolved-profile_catalog.json`
LI-SaaS	~156	`https://raw.githubusercontent.com/GSA/fedramp-automation/master/dist/content/rev5/baselines/json/FedRAMP_rev5_LI-SaaS-baseline-resolved-profile_catalog.json`
Repository	—	`https://github.com/GSA/fedramp-automation`

NIST Cybersecurity Framework (CSF)

Resource	URL
CSF 2.0 Catalog	`https://raw.githubusercontent.com/usnistgov/oscal-content/main/nist.gov/CSF/2.0/json/CSF_2.0_catalog.json`

CIS Controls

Resource	URL
CIS v8 Catalog	`https://raw.githubusercontent.com/CISecurity/OCALCatalog/main/CIS_Controls_v8_catalog.json`

Instructions

1. Determine Required Catalog

Based on the user's request, identify which catalog is needed:

User Mentions	Fetch This
"NIST 800-53", "800-53", "NIST controls"	NIST 800-53 Rev 5 catalog
"FedRAMP High"	FedRAMP HIGH baseline
"FedRAMP Moderate", "FedRAMP"	FedRAMP MODERATE baseline
"FedRAMP Low"	FedRAMP LOW baseline
"FedRAMP LI-SaaS", "Low Impact SaaS"	FedRAMP LI-SaaS baseline
"NIST CSF", "Cybersecurity Framework"	NIST CSF 2.0 catalog
"CIS Controls", "CIS"	CIS Controls v8 catalog

2. Attempt to Fetch the Catalog

If you have web/fetch capabilities: Retrieve the JSON from the appropriate URL above.

If you cannot fetch (no network access): You MUST ask the user to upload the catalog manually. Use this exact message format:

I need the official OSCAL catalog to complete this task, but I can't fetch it directly.

Please download and upload one of these files:

You Need	Download From
NIST 800-53 Rev 5	NIST_SP-800-53_rev5_catalog.json
FedRAMP HIGH	FedRAMP_rev5_HIGH-baseline-resolved-profile_catalog.json
FedRAMP MODERATE	FedRAMP_rev5_MODERATE-baseline-resolved-profile_catalog.json
FedRAMP LOW	FedRAMP_rev5_LOW-baseline-resolved-profile_catalog.json

Quick steps:

Right-click the link above → "Save Link As..."
Upload the downloaded JSON file to this conversation
I'll continue with your request

IMPORTANT: Always attempt the fetch first before asking the user to upload. Only show the upload instructions if fetching fails or is not available.

3. Parse and Use

Once you have the catalog content:

Parse the JSON structure (see oscal-parser skill)
Navigate to the requested controls
Extract required information (title, description, parameters, guidance)
Apply to the user's task

4. Cache Within Conversation

If you fetch a catalog, retain it in context for the duration of the conversation to avoid re-fetching.

Control Families Reference

NIST 800-53 Rev 5 organizes controls into 20 families:

ID	Family	Controls
AC	Access Control	25 base + enhancements
AT	Awareness and Training	6 base
AU	Audit and Accountability	16 base
CA	Assessment, Authorization, Procedures	9 base
CM	Configuration Management	14 base
CP	Contingency Planning	13 base
IA	Identification and Authentication	12 base
IR	Incident Response	10 base
MA	Maintenance	7 base
MP	Media Protection	8 base
PE	Physical and Environmental Protection	23 base
PL	Planning	11 base
PM	Program Management	32 base
PS	Personnel Security	9 base
PT	Personally Identifiable Information Processing	8 base
RA	Risk Assessment	10 base
SA	System and Services Acquisition	23 base
SC	System and Communications Protection	51 base
SI	System and Information Integrity	23 base
SR	Supply Chain Risk Management	12 base

FedRAMP Baseline Quick Reference

What's in Each Baseline

FedRAMP LOW (156 controls)

Basic security hygiene
Suitable for: Public, non-sensitive data
Key families: AC, AU, IA, SC

FedRAMP MODERATE (325 controls)

Most common authorization level
Suitable for: CUI, PII, business-sensitive data
Adds: Enhanced monitoring, incident response, contingency planning

FedRAMP HIGH (421 controls)

Maximum protection
Suitable for: Law enforcement, healthcare, financial, critical infrastructure
Adds: Advanced access controls, cryptography, supply chain protections

Control Differences by Baseline

Control	LOW	MODERATE	HIGH
AC-2	✓	✓ + (1)(2)(3)(4)	✓ + (1)(2)(3)(4)(5)(11)(12)(13)
AU-2	✓	✓	✓ + additional events
IA-2	✓ + (1)(2)	✓ + (1)(2)(8)(12)	✓ + (1)(2)(5)(8)(12)
SC-8	—	✓	✓ + (1)
SC-28	—	✓	✓ + (1)

Example Usage

User Request

"What does AC-2 require at FedRAMP Moderate?"

Agent Response Using This Skill

Identify: FedRAMP Moderate baseline needed
Fetch: FedRAMP MODERATE baseline catalog
Locate: AC-2 and its required enhancements
Respond with:
- AC-2 base control requirements
- Required enhancements: AC-2(1), AC-2(2), AC-2(3), AC-2(4)
- FedRAMP-specific parameters (ODPs)
- Implementation guidance

User Request

"Compare our SSP controls against FedRAMP Moderate"

Agent Workflow

Fetch FedRAMP MODERATE baseline
Parse user's SSP (use oscal-parser)
Extract implemented controls from SSP (use controls-extractor)
Compare against baseline control list
Report gaps and coverage percentage

Version Information

Catalog	Version	OSCAL Version	Last Updated
NIST 800-53	Rev 5.1.1	1.1.2	2024
FedRAMP Baselines	Rev 5	1.1.2	2024
NIST CSF	2.0	1.1.2	2024

Fallback: When Fetch Is Not Available

If fetching is not possible and the user hasn't uploaded a catalog:

You MUST ask the user to upload the catalog. Use the message template in Step 2 above.

⛔ DO NOT Use Training Knowledge for Compliance

Never use training knowledge or memory to provide control definitions, parameters, or requirements for compliance tasks.

This is not a recommendation — it is a hard requirement. Using unofficial control information for compliance work is dangerous and could cause serious harm.

Risk	Consequence
Control text may be outdated	Failed audit, security gaps
Parameters (ODPs) may be wrong	Non-compliant implementation
Enhancements may be missing	Incomplete security posture
Baseline assignments may differ	Wrong controls for authorization level

Compliance decisions must be based on authoritative sources only:

Official NIST OSCAL catalogs
Official FedRAMP baseline profiles
Documents directly from NIST, GSA, or the authorizing body

What To Say If User Asks You To Proceed Without The Catalog

⚠️ I cannot provide control definitions from memory for compliance work.

Using unofficial or potentially outdated control information could result in:

Failed audits and authorization delays

Security vulnerabilities from incorrect implementations

Regulatory non-compliance and potential fines

Legal and financial consequences for your organization

Please upload the official OSCAL catalog. I can help you download it — just let me know which baseline you need (NIST 800-53, FedRAMP Low/Moderate/High).

If you need help with something that doesn't require authoritative control text, I'm happy to assist with that instead.

Decision Tree

User needs catalog data
        │
        ▼
Can I fetch from URL?
        │
    ┌───┴───┐
   YES      NO
    │        │
    ▼        ▼
 Fetch    Has user uploaded?
  it          │
    │     ┌───┴───┐
    │    YES      NO
    │     │        │
    │     ▼        ▼
    │   Use      Ask user to upload
    │  upload    (show download links)
    │     │        │
    ▼     ▼        ▼
 ┌────────────┐   User refuses to upload?
 │ Continue   │        │
 │ with task  │        ▼
 └────────────┘   ⛔ STOP
                  Do NOT proceed with
                  compliance tasks.
                  
                  Offer to help with
                  non-compliance tasks instead.

Related Skills

oscal-parser — Parse fetched catalog JSON
controls-extractor — Extract specific controls from catalog
control-mapper — Map between NIST and other frameworks

oscal-catalog-provider

Install Skill

SKILL.md

OSCAL Catalog Provider

Purpose

When to Use

Official OSCAL Content Sources

NIST 800-53 Rev 5 (Full Catalog)

FedRAMP Baselines (Rev 5)

NIST Cybersecurity Framework (CSF)

CIS Controls

Instructions

1. Determine Required Catalog

2. Attempt to Fetch the Catalog

3. Parse and Use

4. Cache Within Conversation

Control Families Reference

FedRAMP Baseline Quick Reference

What's in Each Baseline

Control Differences by Baseline

Example Usage

User Request

Agent Response Using This Skill

User Request

Agent Workflow

Version Information

Fallback: When Fetch Is Not Available

⛔ DO NOT Use Training Knowledge for Compliance

What To Say If User Asks You To Proceed Without The Catalog

Decision Tree

Related Skills