A version is never changed once it is in the library. A correction or a new edition arrives as a new version, and a version the publisher withdraws stays readable and says so. AxisSynapse summaries of licensed standards are in its own words. Before a summary is published, it is checked for distance from the licensed text and reviewed by two people other than its author. To work with the official text, import your own licensed copy into your workspace.
Frameworks and regulations
Catalogs of requirements: standards, regulations and their assessment procedures.
| Framework | Text | Status | Source | Licence |
|---|---|---|---|---|
| FAR 52.204-21: Basic Safeguarding of Covered Contractor Information SystemsVersion 2021-11 · Federal Acquisition Regulation (GSA, DoD and NASA) · 15 requirements | The publisher's text, structured by AxisSynapse from the publisher's data | In the libraryCurrent (2021-12-06) | 48 CFR 52.204-21 (NOV 2021), eCFR as of 2026-10-08; last amended 2021-12-06From www.ecfr.gov · retrieved 2026-10-13 · SHA-256 6797a48c927c… · 1 more pinned source | ecfr-us-gov |
| FedRAMP Consolidated Rules for 2026 (FRR rules, FRD definitions)Version 2026.10.08.01 · U.S. General Services Administration (FedRAMP) · 245 requirements | The publisher's text, structured by AxisSynapse from the publisher's data | In the libraryCurrent (2026-10-08) | FedRAMP Consolidated Rules 2026.10.08.01 (no releases: pinned by commit)From raw.githubusercontent.com · retrieved 2026-10-14 · SHA-256 db442f2d6eff… | fedramp-us-gov |
| FedRAMP Key Security Indicators (Consolidated Rules 2026)Version 2026.10.08.01 · U.S. General Services Administration (FedRAMP) · 46 requirements | The publisher's text, structured by AxisSynapse from the publisher's data | In the libraryCurrent (2026-10-08) | FedRAMP Consolidated Rules 2026.10.08.01 (no releases: pinned by commit)From raw.githubusercontent.com · retrieved 2026-10-14 · SHA-256 db442f2d6eff… | fedramp-us-gov |
| HIPAA Security Rule (45 CFR Part 164, Subpart C)Version 2020-11-24 · U.S. Department of Health and Human Services (HHS) · 63 requirements | The publisher's text, structured by AxisSynapse from the publisher's data | In the libraryCurrent (2020-11-24) | 45 CFR 164 Subpart C, eCFR as of 2026-10-08 (decompressed; served gzip-encoded)From www.ecfr.gov · retrieved 2026-10-14 · SHA-256 9041a339ad1e… · 1 more pinned source | ecfr-us-gov |
| NIST AI Risk Management Framework (AI RMF)Version 1.0 · National Institute of Standards and Technology (NIST) · 72 requirements | The publisher's text, structured by AxisSynapse from the publisher's data | In the libraryCurrent (2026-10-13) | CPRT dataset AI_100_1_0_0 (AI RMF 1.0, dataset version 1.1.0), with the AI RMF PlaybookFrom csrc.nist.gov · retrieved 2026-10-13 · SHA-256 add55ca2e010… | nist-data |
| NIST Cybersecurity Framework (CSF)Version 2.0 · National Institute of Standards and Technology (NIST) · 106 requirements | The publisher's text, structured by AxisSynapse from the publisher's data | In the libraryCurrent (2026-10-13) | CPRT dataset CSF_2_0_0 (NIST Cybersecurity Framework, version 2.0)From csrc.nist.gov · retrieved 2026-10-13 · SHA-256 de36759d2f3f… · 1 more pinned source | nist-data |
| NIST Privacy FrameworkVersion 1.0 · National Institute of Standards and Technology (NIST) · 100 requirements | The publisher's text, structured by AxisSynapse from the publisher's data | In the libraryCurrent (2026-10-13) | CPRT dataset PF_1_0_0 (NIST Privacy Framework, version 1.0)From csrc.nist.gov · retrieved 2026-10-13 · SHA-256 c20d7fade235… | nist-data |
| NIST SP 800-171: Protecting Controlled Unclassified Information in Nonfederal Systems and OrganizationsVersion r2 · National Institute of Standards and Technology (NIST) · 110 requirements | The publisher's text, structured by AxisSynapse from the publisher's data | In the libraryWithdrawn by the publisher (2024-05-14) | SP 800-171 Rev. 2 (February 2020, updated 2021-01-28); CSV updated 2022-03-31From csrc.nist.gov · retrieved 2026-10-13 · SHA-256 0f4d59413bbc… · 3 more pinned sources | nist-data |
| NIST SP 800-171: Protecting Controlled Unclassified Information in Nonfederal Systems and OrganizationsVersion r3 · National Institute of Standards and Technology (NIST) · 97 requirementsReplaces NIST SP 800-171: Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations r2 | The publisher's text, as published | In the libraryCurrent (2024-05-14) | v1.5.0From raw.githubusercontent.com · retrieved 2026-10-13 · SHA-256 21b6f3b118b6… | us-gov-public-domain |
| NIST SP 800-171A: Assessment Procedures for the SP 800-171 Security RequirementsVersion r2 · National Institute of Standards and Technology (NIST) · 110 requirements | The publisher's text, structured by AxisSynapse from the publisher's data | In the libraryWithdrawn by the publisher (2024-05-14) | SP 800-171A (June 2018), the normative text; the file carries NIST's withdrawal notice of 2024-05-14From nvlpubs.nist.gov · retrieved 2026-10-13 · SHA-256 21bf3acc43f4… · 5 more pinned sources | nist-data |
| NIST SP 800-172: Enhanced Security Requirements for Protecting Controlled Unclassified InformationVersion 2021-02 · National Institute of Standards and Technology (NIST) · 35 requirements | The publisher's text, structured by AxisSynapse from the publisher's data | In the libraryWithdrawn by the publisher (2026-05-13) | CPRT dataset SP_800_172_1_0_0 (SP 800-172, February 2021)From csrc.nist.gov · retrieved 2026-10-13 · SHA-256 d98377b992f0… · 3 more pinned sources | nist-data |
| NIST SP 800-172: Enhanced Security Requirements for Protecting Controlled Unclassified InformationVersion r3 · National Institute of Standards and Technology (NIST) · 103 requirementsReplaces NIST SP 800-172: Enhanced Security Requirements for Protecting Controlled Unclassified Information 2021-02 | The publisher's text, as published | In the libraryCurrent (2026-05-13) | v1.5.0From raw.githubusercontent.com · retrieved 2026-10-14 · SHA-256 21c6df17c7ff… | us-gov-public-domain |
| NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and OrganizationsVersion 5.1.1 · National Institute of Standards and Technology (NIST) · 1011 requirements | The publisher's text, as published | Deprecated in the library on 2025-08-27Superseded by the publisher (2025-08-27) | v1.3.0From raw.githubusercontent.com · retrieved 2026-10-14 · SHA-256 81cf2de45ede… | us-gov-public-domain |
| NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and OrganizationsVersion 5.2.0 · National Institute of Standards and Technology (NIST) · 1014 requirements | The publisher's text, as published | In the libraryCurrent (2025-08-27) | v1.5.0From raw.githubusercontent.com · retrieved 2026-10-13 · SHA-256 01f37cf90ea9… | us-gov-public-domain |
| SOC 2 Trust Services Criteria (AxisSynapse summary)Version 2017-pof2022-axis1 · AICPA · 61 requirements | An AxisSynapse summary in its own words, not the official text | Awaiting review: not yet available to workspaces | 2017 Trust Services Criteria (With Revised Points of Focus – 2022): the AICPA's page for the editionFrom www.aicpa-cima.com · retrieved 2026-10-13 · SHA-256 380bd391cc0d… · 1 more pinned source | aicpa-tsc-own-words |
Baselines and profiles
Selections of a catalog's requirements, with the values a program or an authority sets for them.
| Framework | Text | Status | Source | Licence |
|---|---|---|---|---|
| CMMC Level 1: FAR 52.204-21, assessed through NIST SP 800-171 Rev. 2 (32 CFR 170)Version 2024-12-16 · U.S. Department of Defense (32 CFR 170) · 17 requirements | The publisher's text, structured by AxisSynapse from the publisher's data | In the libraryCurrent (2024-12-16) | 32 CFR Part 170 (CMMC Program), eCFR as of 2026-10-08; in force since 2024-12-16 (89 FR 83214), unamendedFrom www.ecfr.gov · retrieved 2026-10-13 · SHA-256 3dc8b9bebbe5… · 2 more pinned sources | ecfr-us-gov |
| CMMC Level 2: NIST SP 800-171 Rev. 2 with CMMC ids (32 CFR 170)Version 2024-12-16 · U.S. Department of Defense (32 CFR 170) · 110 requirements | The publisher's text, structured by AxisSynapse from the publisher's data | In the libraryCurrent (2024-12-16) | 32 CFR Part 170 (CMMC Program), eCFR as of 2026-10-08; in force since 2024-12-16 (89 FR 83214), unamendedFrom www.ecfr.gov · retrieved 2026-10-13 · SHA-256 3dc8b9bebbe5… · 3 more pinned sources | ecfr-us-gov |
| CMMC Level 3: 24 NIST SP 800-172 requirements with DoD-assigned parameters (32 CFR 170)Version 2024-12-16 · U.S. Department of Defense (32 CFR 170) · 24 requirements | The publisher's text, structured by AxisSynapse from the publisher's data | In the libraryCurrent (2024-12-16) | 32 CFR Part 170 (CMMC Program), eCFR as of 2026-10-08; in force since 2024-12-16 (89 FR 83214), unamendedFrom www.ecfr.gov · retrieved 2026-10-13 · SHA-256 3dc8b9bebbe5… · 3 more pinned sources | ecfr-us-gov |
| FedRAMP Rev5 Class B baseline: NIST SP 800-53 Rev. 5 controls (FedRAMP Consolidated Rules 2026)Version 2026.10.08.01 · U.S. General Services Administration (FedRAMP) · 155 requirements | The publisher's text, structured by AxisSynapse from the publisher's data | In the libraryCurrent (2026-10-08) | FedRAMP Consolidated Rules 2026.10.08.01 (no releases: pinned by commit)From raw.githubusercontent.com · retrieved 2026-10-14 · SHA-256 db442f2d6eff… | fedramp-us-gov |
| FedRAMP Rev5 Class C baseline: NIST SP 800-53 Rev. 5 controls (FedRAMP Consolidated Rules 2026)Version 2026.10.08.01 · U.S. General Services Administration (FedRAMP) · 322 requirements | The publisher's text, structured by AxisSynapse from the publisher's data | In the libraryCurrent (2026-10-08) | FedRAMP Consolidated Rules 2026.10.08.01 (no releases: pinned by commit)From raw.githubusercontent.com · retrieved 2026-10-14 · SHA-256 db442f2d6eff… | fedramp-us-gov |
| FedRAMP Rev5 Class D baseline: NIST SP 800-53 Rev. 5 controls (FedRAMP Consolidated Rules 2026)Version 2026.10.08.01 · U.S. General Services Administration (FedRAMP) · 409 requirements | The publisher's text, structured by AxisSynapse from the publisher's data | In the libraryCurrent (2026-10-08) | FedRAMP Consolidated Rules 2026.10.08.01 (no releases: pinned by commit)From raw.githubusercontent.com · retrieved 2026-10-14 · SHA-256 db442f2d6eff… | fedramp-us-gov |
| IRS Publication 1075: Federal Tax Information safeguards (overlay on NIST SP 800-53 Rev. 5)Version 2021-11 · Internal Revenue Service (IRS), Office of Safeguards · 376 requirements | The publisher's text, structured by AxisSynapse from the publisher's data | In the libraryCurrent (2021-11-16) | Publication 1075 (Rev. 11-2021), 216 pages; PDF created 2021-11-16, modified 2021-12-09From www.irs.gov · retrieved 2026-10-14 · SHA-256 3aca5e1a4ab8… · 2 more pinned sources | irs-us-gov |
| NIST SP 800-53B: High-Impact Security Control Baseline (Rev. 5)Version 5.2.0 · National Institute of Standards and Technology (NIST) · 370 requirements | The publisher's text, as published | In the libraryCurrent (2025-08-27) | v1.5.0From raw.githubusercontent.com · retrieved 2026-10-13 · SHA-256 60576970caef… | us-gov-public-domain |
| NIST SP 800-53B: Low-Impact Security Control Baseline (Rev. 5)Version 5.2.0 · National Institute of Standards and Technology (NIST) · 149 requirements | The publisher's text, as published | In the libraryCurrent (2025-08-27) | v1.5.0From raw.githubusercontent.com · retrieved 2026-10-13 · SHA-256 8fd206017c8d… | us-gov-public-domain |
| NIST SP 800-53B: Moderate-Impact Security Control Baseline (Rev. 5)Version 5.2.0 · National Institute of Standards and Technology (NIST) · 287 requirements | The publisher's text, as published | In the libraryCurrent (2025-08-27) | v1.5.0From raw.githubusercontent.com · retrieved 2026-10-13 · SHA-256 9030dbf1f131… | us-gov-public-domain |
| NIST SP 800-53B: Privacy Control Baseline (Rev. 5)Version 5.2.0 · National Institute of Standards and Technology (NIST) · 96 requirements | The publisher's text, as published | In the libraryCurrent (2025-08-27) | v1.5.0From raw.githubusercontent.com · retrieved 2026-10-13 · SHA-256 7e650c4397ad… | us-gov-public-domain |
Crosswalks
Links between the requirements of two frameworks, with who states them.
| Crosswalk | Between | Status | Source | Licence |
|---|---|---|---|---|
| FAR 52.204-21(b)(1) to SP 800-171 Rev. 2 (32 CFR 170, Table 2)Version 1 · United States Government (32 CFR 170, CMMC Program) · 17 entries | FAR 52.204-21: Basic Safeguarding of Covered Contractor Information Systems 2021-11 → NIST SP 800-171: Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations r2Stated by the publisher | In the library | 32 CFR Part 170 (CMMC Program), eCFR as of 2026-10-08; in force since 2024-12-16 (89 FR 83214), unamendedFrom www.ecfr.gov · retrieved 2026-10-13 · SHA-256 3dc8b9bebbe5… | ecfr-us-gov |
| NIST Privacy Framework 1.0 to SP 800-53 Rev. 5 (NIST mapping)Version 1 · National Institute of Standards and Technology (NIST) · 467 entries | NIST Privacy Framework 1.0 → NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations 5.2.0Stated by the publisher | In the library | SP 800-53 Rev. 5 upd. 1: Mappings: Cybersecurity Framework (1.1) and Privacy Framework (1.0) to Rev. 5From csrc.nist.gov · retrieved 2026-10-14 · SHA-256 8b09e8c5bd11… | nist-data |
| SP 800-171 Rev. 2 to Rev. 3 transition (NIST change analysis)Version 1 · National Institute of Standards and Technology (NIST) · 111 entries | NIST SP 800-171: Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations r2 → NIST SP 800-171: Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations r3Stated by the publisher | In the library | SP 800-171 Rev. 3 (May 2024): the Rev. 2 to Rev. 3 change analysis (OLIR record 138: NIST, Owner)From csrc.nist.gov · retrieved 2026-10-13 · SHA-256 ad0908f52945… | nist-data |
| SP 800-171 Rev. 2 to SP 800-53 Rev. 5, derived by AxisSynapse from two NIST tablesVersion 1 · AxisSynapse · 206 entries | NIST SP 800-171: Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations r2 → NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations 5.2.0Derived by AxisSynapse from the publisher's tables; each link is a proposal a person approves | In the library | SP 800-171 Rev. 3 (May 2024): the Rev. 2 to Rev. 3 change analysis (OLIR record 138: NIST, Owner)From csrc.nist.gov · retrieved 2026-10-13 · SHA-256 ad0908f52945… · 1 more pinned source | axissynapse-authored |
| SP 800-171 Rev. 3 to SP 800-53 Rev. 5 (NIST's source controls)Version 1 · National Institute of Standards and Technology (NIST) · 157 entries | NIST SP 800-171: Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations r3 → NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations 5.2.0Stated by the publisher | In the library | v1.5.0From raw.githubusercontent.com · retrieved 2026-10-13 · SHA-256 21b6f3b118b6… · 1 more pinned source | us-gov-public-domain |
Licences and notices
The terms each piece of content is used under, and the notice it carries wherever its words are shown or exported.
| Licence | Notice | On public pages | AI may derive from it |
|---|---|---|---|
| aicpa-soc2-own-wordsAICPATerms | Written by AxisSynapse; not the official text. The AICPA owns the SOC 2® guide and the SOC 2® Description Criteria. Use your licensed copies for the examination. | No | No |
| aicpa-tsc-own-wordsAICPATerms | Summary by AxisSynapse; not the official text. The AICPA owns the Trust Services Criteria. Use your licensed copy for audit. | No | No |
| axissynapse-authoredAxisSynapse | AxisSynapse | Yes | Yes |
| ecfr-us-govUnited States Government (Office of the Federal Register, eCFR)Terms | Source: Electronic Code of Federal Regulations (eCFR), Office of the Federal Register. The eCFR is authoritative but unofficial; the official edition is the annual Code of Federal Regulations on govinfo.gov. A work of the United States Government, not subject to copyright in the United States (17 U.S.C. 105). Structured by AxisSynapse; no endorsement by any agency is implied. | Yes | Yes |
| fedramp-us-govUnited States Government (General Services Administration, FedRAMP)Terms | Source: FedRAMP Consolidated Rules (General Services Administration), github.com/FedRAMP/rules, pinned by commit in each pack's sources.json. Structured by AxisSynapse; no endorsement by GSA or FedRAMP is implied. | Yes | Yes |
| irs-us-govUnited States Government (Internal Revenue Service, Office of Safeguards)Terms | Source: Internal Revenue Service (IRS), Office of Safeguards, Publication 1075, Tax Information Security Guidelines for Federal, State and Local Agencies. A work of the United States Government, not subject to copyright in the United States (17 U.S.C. 105). Structured by AxisSynapse; no endorsement by the IRS or any agency is implied. | Yes | Yes |
| nist-dataNational Institute of Standards and Technology (NIST)Terms | Source: National Institute of Standards and Technology (NIST). Changed by AxisSynapse; the content version's change notice states what was changed, when and why. | Yes | Yes |
| us-gov-public-domainUnited States GovernmentTerms | A work of the United States Government, not subject to copyright in the United States (17 U.S.C. 105); NIST's OSCAL content is also dedicated to the worldwide public domain (CC0 1.0). No endorsement by any agency is implied. | Yes | Yes |