[tristanroth1]

What and why

Adds NIST SP 800-53 and the NIST Risk Management Framework to the library, a promise made publicly after the launch post. It also fills the NIST SP 800-171 and CMMC shelves, which the tag list offered while zero skills carried them.

• Tags: nist-800-53 (NIST SP 800-53) and nist-rmf (NIST RMF) in tools/validate.mjs, the site labels and framework intros, the template, AGENTS.md and the FAQ. Skill names still never contain NIST.
• Citation rule: NIST publications are US government works, so skills tagged nist-800-53, nist-rmf, nist-800-171 or nist-csf may name control ids and families (AC-2, the RA family). They never copy or paraphrase control wording. CMMC is unchanged. The rule is written in AGENTS.md (Ground rules), CONTRIBUTING.md (The bar), the template and the submit-skill system skill. CONTROL_ID gains an 800-53 id and enhancement pattern, so requirement wording within 80 characters of an id is rejected the same way as for every other framework. New validator tests: a bare id or enhancement passes; AC-2 requires ... fails; ids such as AC-2(3), SR-11 and PM-9 are matched.
• Three new house skills (skills/tristan-roth/): system-categorization-first-pass (risk; nist-rmf, nist-800-53), ssp-control-implementation-statements (policies; nist-800-53, nist-rmf, nist-800-171, cmmc), poam-first-draft (audit; nist-800-53, nist-rmf, nist-800-171, cmmc). Each is checked against the hashed title denylist and has a Copilot challenge record in reviews/copilot-challenge/.
• Empty shelves: loadContent drops any framework tag no skill carries before the site uses it, so it never appears in list pages, filters, framework pages, the sitemap or OG images. The validator still accepts the tag. New site test in site/tests/content.test.mjs. After this PR every tag has at least 3 skills.
• CHANGELOG "Unreleased" has new entries. The release pins are not changed.

Retagged skills (14)

• risk-method-drafting + nist-rmf: the method is the organizational risk strategy an RMF Prepare step builds on.
• risk-register-first-pass + nist-rmf, nist-800-53, nist-800-171: scenario-based risk assessment works as written for the RA family and an 800-171 risk assessment.
• risk-acceptance-memo + nist-rmf: one sentence added. The authorizing official owns acceptance of the system's remaining risk; link the memo to the plan of action item.
• incident-response-plan-drafting + nist-800-53, nist-800-171, cmmc: the IR family is central. One clause added on DFARS 252.204-7012: which incidents trigger the report to DoD (72 hours), and preservation of images plus monitoring and packet capture data for at least 90 days.
• access-review-campaign-prep + nist-800-53, nist-800-171, cmmc: account review is central to the AC family.
• logging-and-monitoring-evidence-pack + nist-800-53, nist-800-171, cmmc: covers the AU family's evidence.
• change-management-evidence-sampling + nist-800-53, nist-800-171, cmmc: covers the CM family's evidence.
• evidence-freshness-check + nist-800-53, nist-800-171, cmmc: readiness of artefacts before an assessor samples them.
• internal-audit-checklist-from-scope + nist-800-53, nist-800-171, cmmc: test per commitment with record, sample and pass criterion is a mock control assessment. The management-system tests are already conditional.
• vendor-tiering + nist-800-53: supports supply chain risk work (SR family).
• first-gap-assessment + nist-800-53, nist-800-171, cmmc: 800-171/CMMC readiness is a gap assessment. One sentence added: the SSP and the plan of action and milestones each get a row.
• multi-framework-overlap-map + nist-800-53, nist-800-171: crosswalks to 800-53 are a core use.
• grc-setup-review + nist-800-53, nist-rmf, nist-800-171, cmmc: it ranks the library for any setup, and the NIST skills now exist.
• backup-restore-test-evidence + nist-800-53: restore testing belongs to the CP family.

Considered and not tagged: risk-treatment-plan-drafting (in NIST work the plan of action and milestones is the instrument, and the new skill covers it), incident-severity-triage (its clocks are EU and HIPAA only), and ISO-specific skills (SoA, stage 1, management review).

Framework accuracy challenge

COPILOT_CHALLENGE: system-categorization-first-pass, conversation 114ef960-d4b0-49cc-a89a-2c542938e72e, Q1 PASS, Q2 FIX, Q3 FIX, all fixed (adjustment in both directions, security category wording, information owners, privacy threshold analysis, more triggers, CNSSI 1253 revision check)
COPILOT_CHALLENGE: ssp-control-implementation-statements, conversation 58849f7e-d587-4bb8-a1eb-5ad1de0555c5, Q1 PASS, Q2 FIX, Q3 FIX, fixed (Level 2 assesses against Rev. 2 per 32 CFR 170.14, CMMC met/not met per 170.24, enhancement rows, assessment objective check). Copilot's "no inherited for 800-171/CMMC" fix was reversed after Codex round 1: the CMMC Assessment Process v2.0 (2.17 to 2.21) evaluates inheritance claims, so the official text wins. Three additions declined, with reasons in the record
COPILOT_CHALLENGE: poam-first-draft, conversation d810629a-7f59-49ab-af5f-7603eb17c3cf, Q1 PASS, Q2 FIX, Q3 FIX, fixed (KEV timelines bind federal civilian agencies only, CMMC 180-day closeout and 170.21 limits, point value column, status list, SSP link). Copilot cited BOD 22-01, which cisa.gov shows as revoked and superseded by BOD 26-04, so the skill names "the directive in force". One claim (CMMC designations limited after a suspension) could not be verified and was not used

Checked against official text: 32 CFR 170.14(c)(3) and (d), 170.21 and 170.24 and DFARS 252.204-7012 (a), (c)(1) and (e) on eCFR; CMMC Assessment Process v2.0 sections 2.17 to 2.21 on cyberab.org; the BOD 22-01 revocation on cisa.gov. Each record has a Verified section.

Codex round 1 fixes

1. SSP: inheritance is evaluated under CMMC too (CAP 2.17 to 2.21); an undocumented provider part is "undetermined", not hybrid.
2. POA&M: an item with no plan stays on the plan as incomplete and escalated until a recorded acceptance; acceptance never turns not met into met (32 CFR 170.24).
3. POA&M: the operative 32 CFR 170.21 limits, with the six ineligible requirements by bare id only.
4. IR plan: DFARS 252.204-7012 trigger scope and preservation of monitoring and packet capture data.

Codex round 2 fixes

1. SSP: both CMMC cloud paths, FedRAMP Marketplace or a complete, current FedRAMP Moderate equivalency body of evidence (CAP 2.20 and 2.21), for offerings that store, process or transmit CUI.
2. IR plan: the third DFARS 252.204-7012(c) trigger is worded precisely (ability to perform contract requirements designated as operationally critical support).
3. SSP: implemented means evidence fit for the assessment objective (examine, interview, test); dated records only where a control recurs.
4. SSP: CMMC findings are met, not met or not applicable (32 CFR 170.24), and not applicable counts as met.

Rebased onto #20 conventions

Rebased onto main (94f7f3e, after #18 and #20). The three new skills now carry the data line in their inputs, a run-specific ## Not checked on the signed output, a blank ## Review record and the NEVER rule against filling it in. The signed outputs are categorization-memo.md (names the information-types.csv version), statements.md (names the statement-index.csv version) and poam-review.md (the review companion of poam.csv, naming the CSV and the version or date approved). The old approval blocks were removed. incident-response-plan-drafting was trimmed back under 1200 words. README, SKILL-LIST and CHANGELOG count 64 skills.

Checks

• node tools/validate.mjs: ok, 64 skills
• node --test tools/*.test.mjs: 182 pass, 0 fail
• cd site && npm ci && npm run build: ok, 100 pages; SEO gate L0P: pass; npm test: 51 pass, 0 fail
• No em dash in changed files

CODEX_REVIEW: Codex 2026-10-27 round 1 FIX-FIRST (4 fixed), round 2 FIX-FIRST (4 fixed), round 3 narrow FIX-FIRST (3 wording fixes in 81f23cf); rebase confirmation: Codex unavailable (quota) -> Vibe 2026-10-27: SHIP

Owner: founder
Next: independent review by grcskills-feedback session, then merge and release

🤖 Generated with Claude Code