SPARC is an open-source compliance documentation platform that transforms how organizations manage NIST 800-53 security controls. It replaces fragmented spreadsheets and siloed documents with a coordinated, web-based, real-time source of truth — empowering security teams, assessors, system owners, and program managers to document, assess, and prove compliance across the full RMF lifecycle.
Documentation: See the SPARC Wiki for comprehensive documentation covering RBAC, screens, core functions, integrations, architecture, and configuration.
- Full RMF Artifact Lifecycle — Manage Catalogs, Profiles, Component Definitions (CDEFs), SSPs, SAPs, SARs, and POA&Ms in one platform
- SSP Creation Wizard — Build System Security Plans from scratch by selecting baselines and assembling components
- Multi-Format Import — Import from OSCAL JSON, OSCAL XML, DISA STIGs (XCCDF), and InSpec profiles
- OSCAL Export — Export validated OSCAL v1.1.2 JSON for SSPs, CDEFs, Profiles, SARs, and POA&Ms
- HDF ↔ OSCAL Translation — Convert scanner findings (HDF) to OSCAL SAR via the MITRE hdf-libs bridge, with optional evidence back-matter enrichment
- Document Review & Approval — Optional review queue and approval workflow for
trust-store documents, gated by
SPARC_REQUIRE_DOCUMENT_APPROVAL - Authoritative Sources & Federation — Subscribe to HMAC-signed authoritative content bundles published by federation peers
- Interactive Heat Maps — Visual compliance dashboards showing control status by NIST family
- Inline Field Editing — Edit implementation details directly in the browser
- Authentication & SSO — Local login, GitHub/GitLab OAuth, OIDC (Okta/Keycloak/ Entra ID), and LDAP
- Role-Based Access — 29 NIST RMF roles with instance and authorization-boundary scoping, boundary-scoped document access (AC-3), and an admin UI
- Background Processing — Async job processing for large files via Solid Queue (database-backed; Sidekiq + Redis optional)
- RESTful API — Programmatic access at
/api/v1/
Follow the Quick Start Guide to begin local use, testing, and development of the application.
SPARC is configured via environment variables with sensible defaults. No configuration is required for local development.
- Full reference: docs/ENVIRONMENT_VARIABLES.md
- Production hardening guide: docs/PRODUCTION_SECURITY.md — operator-facing checklist of every security-relevant env var, deployment-layer requirement, and hardening verification steps
- Quick start templates:
.env.example(development),.env.production.example(production)
The centralized SparcConfig module (app/models/sparc_config.rb) reads all
variables with defaults.
📖 Public documentation lives in the SPARC Wiki — the canonical, kept-current home for product docs:
| Getting Started | Configuration | Architecture |
| RBAC | Data Isolation | Screens |
| Core Functions | Framework Mapping | Integrations |
📦 Release notes: GitHub Releases (the wiki Changelog is a concise index).
Technical reference that ships next to the code — indexed in docs/MAP.md:
| Topic | Link |
|---|---|
| Environment variables (exhaustive) | docs/ENVIRONMENT_VARIABLES.md |
| REST API (per-endpoint + Postman) | docs/API.md · docs/api/ |
| OSCAL field mappings & schemas | docs/oscal-data-mapping.md · docs/data_mapping/ |
| Production security & hardening | docs/PRODUCTION_SECURITY.md · docs/AUTHENTICATION.md |
| Compliance artifacts | docs/compliance/README.md · NIST 800-53 mapping · OSCAL CDEFs |
| Contributing (internal dev docs) | docs/dev/issue_rules.md · docs/dev/README.md |
The UI follows the OSCAL / RMF artifact dependency chain:
| Order | Artifact | Purpose | Status |
|---|---|---|---|
| 1 | Catalog | Raw control definitions (e.g., NIST SP 800-53) | Implemented |
| 2 | Profile | Tailored baseline / selection set | Implemented |
| 3 | Component Definition (CDEF) | Reusable control implementations | Implemented |
| 4 | System Security Plan (SSP) | How the system implements the baseline | Implemented |
| 5 | Assessment Plan (SAP) | How the assessment will be performed | Implemented |
| 6 | Assessment Results (SAR) | Findings & evidence from assessment | Implemented |
| 7 | POA&M | Remediation tracking for weaknesses | Implemented |
-
Fork the repository
-
Create a feature branch (
git checkout -b feature/my-feature) -
Ensure all checks pass:
bundle exec rubocop && bundle exec brakeman && bundle exec rspec
-
Commit your changes and open a Pull Request against
main
| Branch Prefix | Purpose |
|---|---|
feature/ |
New functionality |
fix/ |
Bug fixes |
refactor/ |
Code restructuring |
docs/ |
Documentation |
- NIST — SP 800-53 control catalog framework
- OSCAL standard
- MITRE — SAF and Heimdall
- Chef/Progress InSpec — Compliance-as-code framework
- DISA — STIGs in XCCDF format
- CIS — Security benchmarks
- @clem-field — Creator, lead developer, and maintainer
SPARC is released under the Apache License, Version 2.0. Copyright 2026 Risk Sentinel.
Third-party content sources and per-component license dispositions
are tracked in docs/compliance/THIRD_PARTY_NOTICES.md
and docs/compliance/license-dispositions.yml.
Canonical text for every license referenced by SPARC's SBOM lives under
LICENSES/.