{ "component-definition": { "uuid": "32bd1627-af70-4898-9ce7-391db1d67b2f", "metadata": { "title": "Debian 13 Passphrase Hardening Capability Component Definition", "last-modified": "2026-09-16T00:00:00Z", "version": "1.0.0", "oscal-version": "1.1.2", "roles": [ { "id": "system-administrator", "title": "System Administrator" }, { "id": "system-security-officer", "title": "System Security Officer" } ], "parties": [ { "uuid": "1b4346aa-044e-4e42-a524-53d40f60f879", "type": "organization", "name": "Platform Operations" } ], "responsible-parties": [ { "role-id": "system-administrator", "party-uuids": [ "1b4346aa-044e-4e42-a524-53d40f60f879" ] }, { "role-id": "system-security-officer", "party-uuids": [ "1b4346aa-044e-4e42-a524-53d40f60f879" ] } ], "remarks": "Theoretical component. It describes a configuration that satisfies the named controls when applied; it is not an assertion that any particular system is running it. An SSP leveraging this component must supply the implementation evidence for its own hosts.\n\nAssurance state is 'technically-tested': the configuration was applied to a clean Debian 13 install and verified end to end. It has NOT been independently assessed, and is not endorsed or accredited by the ACSC, NIST, or any assessment authority.", "document-ids": [ { "scheme": "https://ns.oscalops.net/component-definitions", "identifier": "debian-13-passphrase-hardening" } ], "props": [ { "name": "assurance-state", "ns": "https://ns.oscalops.net/component-definitions", "value": "technically-tested" }, { "name": "assurance-authority", "ns": "https://ns.oscalops.net/component-definitions", "value": "none; self-asserted by the contributing author" }, { "name": "endorsement", "ns": "https://ns.oscalops.net/component-definitions", "value": "none" }, { "name": "publisher", "ns": "https://ns.oscalops.net/component-definitions", "value": "library_component-definition contributors" }, { "name": "publication-status", "ns": "https://ns.oscalops.net/component-definitions", "value": "unpublished" }, { "name": "artifact-slug", "ns": "https://ns.oscalops.net/component-definitions", "value": "debian-13-passphrase-hardening" } ], "links": [ { "href": "https://library.oscalops.net/component-definitions/debian-13-passphrase-hardening/1.0.0/component-definition.json", "rel": "canonical", "text": "Reserved canonical URL; the registry is not yet published" } ] }, "import-component-definitions": [ { "href": "../debian-13-pwquality-base/component-definition.json" }, { "href": "../debian-13-pwquality-minlen/component-definition.json" }, { "href": "../debian-13-pwquality-no-complexity/component-definition.json" }, { "href": "../debian-13-pwquality-dictionary/component-definition.json" }, { "href": "../debian-13-pwquality-predictability/component-definition.json" }, { "href": "../debian-13-pam-wordcount/component-definition.json" }, { "href": "../debian-13-password-hashing/component-definition.json" } ], "capabilities": [ { "uuid": "99ea6bc1-88a7-4192-a12e-0e2252c15bc8", "name": "Debian 13 passphrase hardening", "description": "The ISM password-strength control family on a Debian 13 (trixie) host, satisfied by seven components applied together. Each owns its own settings and claims only what it enforces alone; this capability claims what holds only for the combination.\n\nApply debian-13-pwquality-base first: every pwquality rule component and the word-count check depend on it. debian-13-password-hashing asserts a Debian default and applies nothing.", "props": [ { "name": "os-distribution", "ns": "https://ns.oscalops.net/component-definitions", "value": "debian" }, { "name": "os-release", "ns": "https://ns.oscalops.net/component-definitions", "value": "13" }, { "name": "os-codename", "ns": "https://ns.oscalops.net/component-definitions", "value": "trixie" }, { "name": "apply-order", "ns": "https://ns.oscalops.net/component-definitions/debian-13-passphrase-hardening", "value": "debian-13-pwquality-base first, then the rule components in any order, then debian-13-pam-wordcount" } ], "incorporates-components": [ { "component-uuid": "fd553b52-da7a-4459-ba06-acaa9bae0064", "description": "debian-13-pwquality-base: the enforcement point, and no maximum length or character-set restriction" }, { "component-uuid": "c5583c57-fc9c-4014-86b1-55c018f4e5f9", "description": "debian-13-pwquality-minlen: the minimum length for the applicability" }, { "component-uuid": "83161f74-01af-4bbd-abcd-aaa108790f60", "description": "debian-13-pwquality-no-complexity: no character-class requirement" }, { "component-uuid": "0a283933-bb57-4cb8-b6c4-064280d959cd", "description": "debian-13-pwquality-dictionary: commonly used passwords" }, { "component-uuid": "787b6f80-2be0-482c-a4d2-a2a34a9875f6", "description": "debian-13-pwquality-predictability: monotonic runs, repeats and account-derived strings" }, { "component-uuid": "d5fd110b-962b-4b6f-b64e-b972c6d19567", "description": "debian-13-pam-wordcount: the ism-1558 word count" }, { "component-uuid": "85e7add0-7c26-40a8-8147-8ab63ad5e29e", "description": "debian-13-password-hashing: yescrypt password storage" } ], "control-implementations": [ { "uuid": "2fc6fff5-59bb-4a82-abc6-bcc1b1463c50", "source": "https://raw.githubusercontent.com/AustralianCyberSecurityCentre/ism-oscal/v2026.09.4/ISM_catalog.json", "description": "ISM password-strength controls that hold only when this capability's components are applied together, from ISM release v2026.09.4.", "props": [ { "name": "catalog-release", "ns": "https://ns.oscalops.net/component-definitions", "value": "v2026.09.4" }, { "name": "catalog-authority", "ns": "https://ns.oscalops.net/component-definitions", "value": "Australian Cyber Security Centre" }, { "name": "control-family", "ns": "https://ns.oscalops.net/component-definitions", "value": "Guidelines for system access > Credential management > Password strength" } ], "links": [ { "href": "#36c41fd6-4e7c-4dbf-92bc-604bf58f40f1", "rel": "reference", "text": "Pinned ISM catalogue release" } ], "implemented-requirements": [ { "uuid": "fc65c477-a007-4aaf-95c2-4581a6891b89", "control-id": "ism-1558", "description": "Partially implemented by the combination. debian-13-pam-wordcount enforces the minimum word count and debian-13-pwquality-predictability rejects monotonic sequences, repeated characters and account-derived strings, in one password stack. Verified through real password changes with both applied.\n\nNOT ENFORCED by any component: a sequence of categorised words, a real sentence in natural language, and song lyrics, quotes or other publicly available material all satisfy the word count while being exactly what this control prohibits.", "props": [ { "name": "implementation-status", "ns": "https://ns.oscalops.net/component-definitions", "value": "partial" }, { "name": "applicability", "ns": "https://cyber.gov.au/ns/ism/oscal/3.0", "value": "NC" }, { "name": "applicability", "ns": "https://cyber.gov.au/ns/ism/oscal/3.0", "value": "OS" }, { "name": "applicability", "ns": "https://cyber.gov.au/ns/ism/oscal/3.0", "value": "P" }, { "name": "applicability", "ns": "https://cyber.gov.au/ns/ism/oscal/3.0", "value": "S" }, { "name": "applicability", "ns": "https://cyber.gov.au/ns/ism/oscal/3.0", "value": "TS" }, { "name": "correlates-nist-statement", "ns": "https://ns.oscalops.net/component-definitions", "value": "ia-5.1_smt.h" }, { "name": "correlation-strength", "ns": "https://ns.oscalops.net/component-definitions", "value": "narrower" }, { "name": "assessment-method", "ns": "https://ns.oscalops.net/component-definitions", "value": "test" }, { "name": "assessment-frequency", "ns": "https://ns.oscalops.net/component-definitions", "value": "annual" }, { "name": "residual-risk", "ns": "https://ns.oscalops.net/component-definitions", "value": "Randomness and provenance of the words are not enforced. Natural-language sentences, lyrics and categorised word lists remain accepted." } ], "links": [ { "href": "#bc3163e9-4609-4a10-87ea-98fb25ef4e45", "rel": "reference", "text": "Verification script" } ], "responsible-roles": [ { "role-id": "system-security-officer", "party-uuids": [ "1b4346aa-044e-4e42-a524-53d40f60f879" ] } ], "remarks": "pwqgen(1) or pwmake(1) generate passphrases so users never select words themselves, which is the only practical answer to the provenance limbs." }, { "uuid": "f58c378e-eb4d-4dc6-8cb3-35e5f9ade5e1", "control-id": "ism-2080", "description": "Implemented by the combination. debian-13-pwquality-no-complexity imposes no character-class requirement, and debian-13-pam-wordcount applies only to passwords that are a sequence of words, passing single-token passwords through untouched. The stack as a whole therefore imposes no complexity requirement while still enforcing the ism-1558 word count.\n\nVerified: an all-lowercase single-token password is accepted through a real password change with every component applied.", "props": [ { "name": "implementation-status", "ns": "https://ns.oscalops.net/component-definitions", "value": "implemented" }, { "name": "applicability", "ns": "https://cyber.gov.au/ns/ism/oscal/3.0", "value": "NC" }, { "name": "applicability", "ns": "https://cyber.gov.au/ns/ism/oscal/3.0", "value": "OS" }, { "name": "applicability", "ns": "https://cyber.gov.au/ns/ism/oscal/3.0", "value": "P" }, { "name": "applicability", "ns": "https://cyber.gov.au/ns/ism/oscal/3.0", "value": "S" }, { "name": "applicability", "ns": "https://cyber.gov.au/ns/ism/oscal/3.0", "value": "TS" }, { "name": "correlates-nist-statement", "ns": "https://ns.oscalops.net/component-definitions", "value": "ia-5.1_smt.h" }, { "name": "correlation-strength", "ns": "https://ns.oscalops.net/component-definitions", "value": "equivalent" }, { "name": "assessment-method", "ns": "https://ns.oscalops.net/component-definitions", "value": "test" }, { "name": "assessment-frequency", "ns": "https://ns.oscalops.net/component-definitions", "value": "annual" } ], "links": [ { "href": "#bc3163e9-4609-4a10-87ea-98fb25ef4e45", "rel": "reference", "text": "Verification script" } ], "responsible-roles": [ { "role-id": "system-administrator", "party-uuids": [ "1b4346aa-044e-4e42-a524-53d40f60f879" ] } ], "remarks": "A character-class module cannot provide both. pam_passwdqc can enforce a word count but, tested, also rejects a 15-character single-token password, breaching ism-2080; see debian-13-pam-wordcount." } ] }, { "uuid": "e6b50f95-653e-4df1-89aa-6f77deb4b8be", "source": "https://raw.githubusercontent.com/usnistgov/oscal-content/v1.4.0/nist.gov/SP800-53/rev5/json/NIST_SP-800-53_rev5_catalog.json", "description": "The scope of IA-5 and IA-5(1) across this capability's components, from oscal-content release v1.4.0.", "props": [ { "name": "catalog-release", "ns": "https://ns.oscalops.net/component-definitions", "value": "v1.4.0" }, { "name": "catalog-authority", "ns": "https://ns.oscalops.net/component-definitions", "value": "NIST" } ], "links": [ { "href": "#afd178e1-5b19-45b3-8179-db808eae36de", "rel": "reference", "text": "Pinned SP 800-53 catalogue release" } ], "implemented-requirements": [ { "uuid": "8959444e-e1f3-44d4-8d02-3c677df4ba99", "control-id": "ia-5.1", "description": "Across its components this capability satisfies IA-5(1)(a) through debian-13-pwquality-dictionary, (b), (f) and (g) through debian-13-pwquality-base, (d) through debian-13-password-hashing, and (h) through the rule components and the word count together, which is why (h) is claimed here. (c) and (e) apply to the system but are claimed by no component, and are recorded below so an SSP leveraging this capability sees them.", "props": [ { "name": "implementation-status", "ns": "https://ns.oscalops.net/component-definitions", "value": "partial" }, { "name": "correlates-ism-control", "ns": "https://ns.oscalops.net/component-definitions", "value": "ism-0421 ism-1557 ism-0422 ism-1558 ism-2078 ism-2079 ism-2080 ism-2081" }, { "name": "correlation-strength", "ns": "https://ns.oscalops.net/component-definitions", "value": "equivalent" }, { "name": "assessment-method", "ns": "https://ns.oscalops.net/component-definitions", "value": "examine" }, { "name": "assessment-frequency", "ns": "https://ns.oscalops.net/component-definitions", "value": "annual" } ], "statements": [ { "statement-id": "ia-5.1_smt.c", "uuid": "e01e68ef-a425-5855-bdec-489cf8c4114d", "description": "Password transmission security is a property of the access transport, not of the local PAM password stack. No component of this capability makes a claim here.", "props": [ { "name": "implementation-status", "ns": "https://ns.oscalops.net/component-definitions", "value": "out-of-scope" } ], "responsible-roles": [ { "role-id": "system-administrator", "party-uuids": [ "1b4346aa-044e-4e42-a524-53d40f60f879" ] } ], "remarks": "Claimed by the SSH and TLS transport components of the system, which must be assessed separately." }, { "statement-id": "ia-5.1_smt.e", "uuid": "6c0a0bc0-5174-5597-a46f-ff9c0a15955d", "description": "Forcing selection of a new password on account recovery is an account-lifecycle action, not a password-policy setting. No component of this capability makes a claim here.", "props": [ { "name": "implementation-status", "ns": "https://ns.oscalops.net/component-definitions", "value": "out-of-scope" } ], "responsible-roles": [ { "role-id": "system-administrator", "party-uuids": [ "1b4346aa-044e-4e42-a524-53d40f60f879" ] } ], "remarks": "Implemented operationally with 'chage -d 0' as part of the account recovery procedure." }, { "statement-id": "ia-5.1_smt.h", "uuid": "6c3f7cdc-2de1-5d34-8774-940ef5e97cef", "description": "The composition and complexity rules bound to ia-05.01_odp.02 are enforced by debian-13-pwquality-minlen, -no-complexity and -predictability together with the word count from debian-13-pam-wordcount. No component enforces all of them, so the element is claimed here. Verified end to end for all three applicability tiers.", "props": [ { "name": "implementation-status", "ns": "https://ns.oscalops.net/component-definitions", "value": "implemented" }, { "name": "correlates-ism-control", "ns": "https://ns.oscalops.net/component-definitions", "value": "ism-0421 ism-1557 ism-0422 ism-1558 ism-2080" } ], "responsible-roles": [ { "role-id": "system-administrator", "party-uuids": [ "1b4346aa-044e-4e42-a524-53d40f60f879" ] } ] } ], "responsible-roles": [ { "role-id": "system-administrator", "party-uuids": [ "1b4346aa-044e-4e42-a524-53d40f60f879" ] } ], "set-parameters": [ { "param-id": "ia-05.01_odp.02", "values": [ "a minimum length of 15 characters on non-classified, OFFICIAL: Sensitive and PROTECTED systems, 17 on SECRET systems and 20 on TOP SECRET systems; no character-class complexity requirement; no maximum length below 64 characters; all ASCII printable characters accepted; rejection of dictionary words, account-derived strings, monotonic runs longer than 4 characters and character repeats longer than 3" ], "remarks": "Derived from ism-0421, ism-1557, ism-0422, ism-1558, ism-2079, ism-2080 and ism-2081 so the SP 800-53 organisation-defined parameter and the ISM controls cannot drift apart." } ] }, { "uuid": "dbd2b3b2-aee3-4289-9ded-e1f60863ba93", "control-id": "ia-5", "description": "Scoped claim. This capability addresses only the password authenticator type, and only its content rules and storage. Authenticator issuance, distribution, revocation, and the management of non-password authenticator types are not claimed.\n\nDebian 13 ships PASS_MAX_DAYS 99999, so no forced password expiry is imposed. This is retained deliberately: the ISM password-strength family contains no rotation requirement, and forced rotation is no longer recommended practice.", "props": [ { "name": "implementation-status", "ns": "https://ns.oscalops.net/component-definitions", "value": "partial" }, { "name": "correlation-strength", "ns": "https://ns.oscalops.net/component-definitions", "value": "broader" }, { "name": "scope-limit", "ns": "https://ns.oscalops.net/component-definitions", "value": "password authenticator type only; content rules and storage only" }, { "name": "assessment-method", "ns": "https://ns.oscalops.net/component-definitions", "value": "examine" }, { "name": "assessment-frequency", "ns": "https://ns.oscalops.net/component-definitions", "value": "annual" } ], "responsible-roles": [ { "role-id": "system-security-officer", "party-uuids": [ "1b4346aa-044e-4e42-a524-53d40f60f879" ] } ], "remarks": "No value is bound to ia-05_odp.01 (time period by authenticator type) because this component deliberately imposes no password expiry. An SSP leveraging this component must either bind that parameter itself or record the no-expiry decision as an accepted deviation." } ] } ] } ], "back-matter": { "resources": [ { "uuid": "bc3163e9-4609-4a10-87ea-98fb25ef4e45", "title": "Verification script", "description": "Checks the claims that hold only for the combination, through real password changes on a throwaway account with every component applied. Requires --with-test-account.", "props": [ { "name": "artifact-type", "ns": "https://ns.oscalops.net/component-definitions", "value": "shell-script" } ], "rlinks": [ { "href": "scripts/verify-passphrase-hardening.sh", "media-type": "text/plain" } ], "base64": { "filename": "verify-passphrase-hardening.sh", "media-type": "text/plain", "value": "IyEvYmluL3NoCiMgVmVyaWZ5IHRoZSBjbGFpbXMgZGViaWFuLTEzLXBhc3NwaHJhc2UtaGFyZGVuaW5nIG1ha2VzIGFib3V0IGl0cyBjb21wb25lbnRzIGluCiMgY29tYmluYXRpb24sIG9uIGEgRGViaWFuIDEzICh0cml4aWUpIGhvc3Qgd2l0aCBhbGwgb2YgdGhlbSBhcHBsaWVkLgojCiMgRWFjaCBjb21wb25lbnQgdmVyaWZpZXMgaXRzIG93biBjbGFpbXMuIFRoaXMgY2hlY2tzIG9ubHkgd2hhdCBob2xkcyBmb3IgdGhlCiMgY29tYmluYXRpb24gYW5kIGZvciBubyBjb21wb25lbnQgYWxvbmUsIHRocm91Z2ggcmVhbCBwYXNzd29yZCBjaGFuZ2VzIG9uIGEKIyB0aHJvd2F3YXkgYWNjb3VudCwgc28gaXQgcmVxdWlyZXMgLS13aXRoLXRlc3QtYWNjb3VudDoKIwojICAgaXNtLTE1NTggIHdvcmQgY291bnQgKGRlYmlhbi0xMy1wYW0td29yZGNvdW50KSB0b2dldGhlciB3aXRoIHNlcXVlbmNlLCByZXBlYXQKIyAgICAgICAgICAgICBhbmQgZGljdGlvbmFyeSBydWxlcyAoZGViaWFuLTEzLXB3cXVhbGl0eS1wcmVkaWN0YWJpbGl0eSksIHRocm91Z2ggb25lIHN0YWNrCiMgICBpc20tMjA4MCAgbm8gY29tcGxleGl0eSByZXF1aXJlbWVudCBpbXBvc2VkIGJ5IHRoZSBzdGFjayBhcyBhIHdob2xlOiB0aGUKIyAgICAgICAgICAgICB3b3JkLWNvdW50IGNoZWNrIGxlYXZlcyBzaW5nbGUgdG9rZW5zIGFsb25lCiMKIyBFeGl0IHN0YXR1czogMCBpZiBub3RoaW5nIEZBSUxzLCAxIG90aGVyd2lzZS4KCnNldCAtdQoKWyAiJHsxOi19IiA9ICItLXdpdGgtdGVzdC1hY2NvdW50IiBdIHx8IHsKCWVjaG8gImVycm9yOiB0aGVzZSBjbGFpbXMgY2FuIG9ubHkgYmUgdGVzdGVkIHRocm91Z2ggcmVhbCBwYXNzd29yZCBjaGFuZ2VzOyBwYXNzIC0td2l0aC10ZXN0LWFjY291bnQiID4mMgoJZXhpdCAyCn0KClBBU1NfQ09VTlQ9MApGQUlMX0NPVU5UPTAKUEFSVElBTF9DT1VOVD0wCgpyZXBvcnQoKSB7CgljYXNlICIkMSIgaW4KCQlQQVNTKSBQQVNTX0NPVU5UPSQoKFBBU1NfQ09VTlQgKyAxKSkgOzsKCQlQQVJUSUFMKSBQQVJUSUFMX0NPVU5UPSQoKFBBUlRJQUxfQ09VTlQgKyAxKSkgOzsKCQkqKSBGQUlMX0NPVU5UPSQoKEZBSUxfQ09VTlQgKyAxKSkgOzsKCWVzYWMKCXByaW50ZiAnJS04cyAlLTEzcyAlc1xuJyAiJDEiICIkMiIgIiQzIgp9CgpNSU5fV09SRFM9JChzZWQgLW4gJ3MvLipwYW1faXNtX3dvcmRjb3VudFwuc28uKm1pbndvcmRzPVwoWzAtOV0qXCkuKi9cMS9wJyAvZXRjL3BhbS5kL2NvbW1vbi1wYXNzd29yZCB8IGhlYWQgLTEpClsgLW4gIiRNSU5fV09SRFMiIF0gfHwgeyBbIC1yIC9ldGMvc2VjdXJpdHkvaXNtLXdvcmRjb3VudC5jb25mIF0gJiYgLiAvZXRjL3NlY3VyaXR5L2lzbS13b3JkY291bnQuY29uZjsgfQpbIC1uICIke01JTl9XT1JEUzotfSIgXSB8fCB7IGVjaG8gImVycm9yOiBubyB3b3JkLWNvdW50IGVuZm9yY2VtZW50IGZvdW5kOyBhcHBseSBkZWJpYW4tMTMtcGFtLXdvcmRjb3VudCIgPiYyOyBleGl0IDE7IH0KClRFU1RfVVNFUj0iaXNtY2FwJCQiCnVzZXJhZGQgLU0gLXMgL3Vzci9zYmluL25vbG9naW4gIiRURVNUX1VTRVIiID4vZGV2L251bGwgMj4mMSB8fCB7IGVjaG8gImVycm9yOiBjYW5ub3QgY3JlYXRlIGEgdGhyb3dhd2F5IGFjY291bnQiID4mMjsgZXhpdCAxOyB9CnRyYXAgJ3VzZXJkZWwgLWYgIiRURVNUX1VTRVIiID4vZGV2L251bGwgMj4mMScgRVhJVAphY2NlcHRlZCgpIHsgZWNobyAiJFRFU1RfVVNFUjokMSIgfCBjaHBhc3N3ZCA+L2Rldi9udWxsIDI+JjE7IH0KdmVyZGljdCgpIHsgYWNjZXB0ZWQgIiQxIiAmJiBlY2hvIGFjY2VwdGVkIHx8IGVjaG8gcmVqZWN0ZWQ7IH0KCiMgTG9uZ2VyIHRoYW4gYW55IGFwcGxpY2FiaWxpdHkncyBtaW5pbXVtIGxlbmd0aCwgc28gbGVuZ3RoIGlzIG5ldmVyIHRoZSByZWFzb24uCnNpbmdsZV90b2tlbj12YXVsdG90dGVybWFuZ29xdWlsdHJhdmVuZmpvcmR6ZWJyYXBsaW50aApzaG9ydF9zZXE9JycKaT0xCndoaWxlIFsgIiRpIiAtbHQgIiRNSU5fV09SRFMiIF07IGRvCglzaG9ydF9zZXE9IiR7c2hvcnRfc2VxfW90dGVyJHtpfW1hbmdvICIKCWk9JCgoaSArIDEpKQpkb25lCmZ1bGxfc2VxPSIke3Nob3J0X3NlcX1xdWlsdHJhdmVuIgpzZXF1ZW5jZT0iJHtzaW5nbGVfdG9rZW59YWJjZGVmZ2giCgojIC0tLSBpc20tMjA4MCA6IG5vIGNvbXBsZXhpdHkgcmVxdWlyZW1lbnQgZnJvbSB0aGUgc3RhY2sgYXMgYSB3aG9sZSAtLS0tLS0tLS0tLQppZiBhY2NlcHRlZCAiJHNpbmdsZV90b2tlbiI7IHRoZW4KCXJlcG9ydCBQQVNTICJpc20tMjA4MCIgImFsbC1sb3dlcmNhc2Ugc2luZ2xlIHRva2VuIGFjY2VwdGVkIHRocm91Z2ggcGFtX3B3cXVhbGl0eSBhbmQgdGhlIHdvcmQtY291bnQgY2hlY2sgdG9nZXRoZXIiCmVsc2UKCXJlcG9ydCBGQUlMICJpc20tMjA4MCIgImFsbC1sb3dlcmNhc2Ugc2luZ2xlIHRva2VuIHJlamVjdGVkIGJ5IHRoZSBjb21iaW5lZCBzdGFjazsgYSBjb21wbGV4aXR5IHJ1bGUgaXMgaW1wb3NlZCIKZmkKCiMgLS0tIGlzbS0xNTU4IDogZXZlcnkgZW5mb3JjZWFibGUgbGltYiwgdGhyb3VnaCBvbmUgc3RhY2sgLS0tLS0tLS0tLS0tLS0tLS0tLS0KU0hPUlQ9JCh2ZXJkaWN0ICIkc2hvcnRfc2VxIikKRlVMTD0kKHZlcmRpY3QgIiRmdWxsX3NlcSIpClNFUT0kKHZlcmRpY3QgIiRzZXF1ZW5jZSIpCk5BVFVSQUw9MApmb3IgcGhyYXNlIGluICJ0aGUgcXVpY2sgYnJvd24gZm94IGp1bXBzIG92ZXIgdGhlIGxhenkgZG9nIiBcCgkid2UgYWxsIGxpdmUgaW4gYSB5ZWxsb3cgc3VibWFyaW5lIHllbGxvdyBzdWJtYXJpbmUiOyBkbwoJYWNjZXB0ZWQgIiRwaHJhc2UiICYmIE5BVFVSQUw9JCgoTkFUVVJBTCArIDEpKQpkb25lCmlmIFsgIiRTSE9SVCIgPSByZWplY3RlZCBdICYmIFsgIiRGVUxMIiA9IGFjY2VwdGVkIF0gJiYgWyAiJFNFUSIgPSByZWplY3RlZCBdOyB0aGVuCglpZiBbICIkTkFUVVJBTCIgLWd0IDAgXTsgdGhlbgoJCXJlcG9ydCBQQVJUSUFMICJpc20tMTU1OCIgXAoJCQkid29yZCBjb3VudCBhbmQgbW9ub3RvbmljIHNlcXVlbmNlcyBlbmZvcmNlZCB0b2dldGhlcjsgJE5BVFVSQUwvMiBuYXR1cmFsLWxhbmd1YWdlIHNlbnRlbmNlcyBzdGlsbCBhY2NlcHRlZCIKCWVsc2UKCQlyZXBvcnQgUEFTUyAiaXNtLTE1NTgiICJ3b3JkIGNvdW50LCBzZXF1ZW5jZXMgYW5kIG5hdHVyYWwtbGFuZ3VhZ2Ugc2VudGVuY2VzIGFsbCByZWplY3RlZCIKCWZpCmVsc2UKCXJlcG9ydCBGQUlMICJpc20tMTU1OCIgXAoJCSJjb21iaW5lZCBzdGFjazogJCgoTUlOX1dPUkRTIC0gMSkpIHdvcmRzICRTSE9SVCwgJE1JTl9XT1JEUyB3b3JkcyAkRlVMTCwgbW9ub3RvbmljIHNlcXVlbmNlICRTRVEiCmZpCgplY2hvCmVjaG8gInBhc3NlZDogJFBBU1NfQ09VTlQgIHBhcnRpYWw6ICRQQVJUSUFMX0NPVU5UICBmYWlsZWQ6ICRGQUlMX0NPVU5UIgpbICIkRkFJTF9DT1VOVCIgLWVxIDAgXSB8fCBleGl0IDEK" } }, { "uuid": "36c41fd6-4e7c-4dbf-92bc-604bf58f40f1", "title": "ACSC ISM OSCAL catalogue v2026.09.4", "description": "Australian Cyber Security Centre Information Security Manual OSCAL catalogue, release v2026.09.4: the release this document's control identifiers resolve against.", "props": [ { "name": "release-tag", "ns": "https://ns.oscalops.net/component-definitions", "value": "v2026.09.4" }, { "name": "sha256", "ns": "https://ns.oscalops.net/component-definitions", "value": "237ea09362b8449ed5c5ee85de4725a0468ee73d13af7cf61c26d4e6ac47f12d" } ], "rlinks": [ { "href": "https://raw.githubusercontent.com/AustralianCyberSecurityCentre/ism-oscal/v2026.09.4/ISM_catalog.json", "media-type": "application/json" } ] }, { "uuid": "afd178e1-5b19-45b3-8179-db808eae36de", "title": "NIST SP 800-53 Rev 5 catalogue (oscal-content v1.4.0)", "description": "NIST SP 800-53 Revision 5 catalogue, release v1.4.0: the release this document's control identifiers resolve against.", "props": [ { "name": "release-tag", "ns": "https://ns.oscalops.net/component-definitions", "value": "v1.4.0" }, { "name": "sha256", "ns": "https://ns.oscalops.net/component-definitions", "value": "1645df6a370dcb931db2e2d5d70c2f77bc89c38499a416c23a70eb2c0e595bcc" } ], "rlinks": [ { "href": "https://raw.githubusercontent.com/usnistgov/oscal-content/v1.4.0/nist.gov/SP800-53/rev5/json/NIST_SP-800-53_rev5_catalog.json", "media-type": "application/json" } ] } ] } } }