User Guide Control Catalogs and Baselines
The controls layer is the foundation everything else builds on. A control catalog is the full set of controls from a source like NIST SP 800-53; a baseline (also called a profile) is a tailored selection of those controls for a given impact level or system. Control mappings relate one catalog's controls to another's. This guide covers loading catalogs, tailoring baselines, and building mappings.
Who this is for: control authors and compliance engineers. Viewing catalogs, baselines, and mappings is public on most instances; creating and editing requires the appropriate role — see RBAC.
- Access: viewing is typically public; creating/editing catalogs, baselines, and mappings requires a role with the matching write permission.
-
Where to find it: the Controls menu → Control Catalogs
(
/control_catalogs), Baselines (/profile_documents), Mappings (/control_mappings).
The Control Catalogs index — NIST catalogs and baselines available in the instance.
flowchart LR
SEED[NIST Rev 4 / Rev 5 seed] --> CAT[Control Catalog]
IMP[Import JSON/XML] --> CAT
CAT --> BASE[Baseline / Profile]
CAT -. relate .-> MAP[Control Mapping]
BASE --> SSP[Feeds SSP / CDEF / SAP]
- Load a control catalog from NIST seed data or by importing an OSCAL catalog file.
- Tailor a baseline — pick the subset of controls that applies to your system's impact level.
- Map between frameworks — relate controls in one catalog to another (e.g. Rev 4 → Rev 5) with NIST IR 8477 relationship types.
- Go to Controls → Control Catalogs (
/control_catalogs). - Click New.
- Enter name, version, source, and description.
- In the template selector, choose NIST SP 800-53 Rev 4 or Rev 5 to seed the catalog with that control set (or blank to start empty).
- Save. Open the catalog to see its control families, each listing its controls.
- From the catalog list, click Import (
/control_catalogs/import). - Upload a catalog file — JSON or XML OSCAL catalog format.
- Submit. The catalog is created with its families and controls populated.
- Open a catalog and drill into a family to see its controls; use Edit on the family to change its code, name, or description.
-
Edit an individual control (
/catalog_controls/:id/edit) to change its ID, title, description, or statement. - To add many controls at once, use Batch Create on a family
(
.../catalog_controls/batch_new) — fill multiple rows and submit together.
On the catalog detail page use the OSCAL export buttons. Two variants are offered: validated (schema-checked) and unvalidated.
A baseline selects and prioritizes controls from a catalog.
- Go to Controls → Baselines (
/profile_documents). - Click Create from Catalog (
/profile_documents/select_catalog). - Step 1: choose the source catalog.
- Step 2: use the checklist to select which controls to include.
- Submit to create the baseline. Its detail page shows the selected controls with a priority heatmap grouped by NIST family.
You can also click Create New for an empty baseline, or Copy an existing baseline's detail page to duplicate it as a starting point.
Open a baseline, then Edit an individual profile control
(/profile_documents/:id/profile_controls/:id/edit) to set its priority.
The priority heatmap on the detail page reflects your selections.
On the baseline detail page: JSON for the raw document, or OSCAL (validated / unvalidated) for the profile.
- Go to Controls → Mappings (
/control_mappings) and click Create New. - Give the mapping a name and set its source and target catalogs.
- Open the mapping detail page. In the Add Entry row, enter the source control ID, target control ID, their types, and a relationship, then click Add Entry. Relationship types (per NIST IR 8477) are: equal, equivalent, subset, superset, intersects.
- Repeat for each pair. Entries appear in the Mapping Entries table.
Use the action buttons on the mapping detail page: Publish moves a draft to complete; Deprecate retires a completed mapping. Export OSCAL emits the mapping in OSCAL form.
- Seed from NIST Rev 5 unless you have a specific reason to stay on Rev 4 — it's the current FedRAMP baseline.
- Build the baseline once, reuse it across every SSP for that impact level rather than re-selecting controls each time.
- Keep a mapping in draft until every entry is reviewed, then Publish — downstream consumers should rely on published mappings.
- Prefer import for authoritative OSCAL catalogs and seed for the standard NIST sets; hand-editing is best reserved for small corrections.
| Symptom | Likely cause | What to do |
|---|---|---|
| Import rejected | File isn't valid OSCAL JSON/XML | Validate the catalog file before importing |
| OSCAL export fails validation | Missing required metadata on a control | Fix the flagged fields, then use the validated export |
| Can't add a mapping entry / edit a control | View-only access | You need the write permission (RBAC) |
| Baseline shows no controls | None selected in the checklist step | Re-run Create from Catalog and select controls |
- User Guides index
- Converters & Imports
- System Security Plans (SSP) — consumes baselines.
- Framework Mapping — how external frameworks relate to NIST.
- Screens & UI — exhaustive element-level reference.