Read this first. Nothing in this library is accredited, endorsed or approved by the ACSC, NIST or any assessment authority. Components are contributed assertions: read the assurance state before relying on one.
OSCAL Ops Library
Component definitions describing configurations that address security controls. Search a control; find the configuration.
8
component definitions
9
controls addressed
2
pinned catalogue releases
Catalogues
| Catalogue | Authority | Release | Covered controls | Licence |
|---|---|---|---|---|
| Information Security Manual | Australian Cyber Security Centre | v2026.09.4 | 8 of 1192 | CC-BY-4.0 |
| SP 800-53 Revision 5 | NIST | v1.4.0 | 1 of 1196 | CC0-1.0 |
Components
| Component | Latest | Assurance | Frameworks |
|---|---|---|---|
| Debian 13 ISM Word-Count Enforcement Component Definition debian-13-pam-wordcount | 1.0.0 unpublished | technically-tested | Information Security Manual v2026.09.4 |
| Debian 13 Passphrase Hardening Capability Component Definition debian-13-passphrase-hardening | 1.0.0 unpublished | technically-tested | |
| Debian 13 Password Hashing Component Definition debian-13-password-hashing | 1.0.0 unpublished | technically-tested | SP 800-53 Revision 5 v1.4.0 |
| Debian 13 pam_pwquality Enforcement Base Component Definition debian-13-pwquality-base | 1.0.0 unpublished | technically-tested | Information Security Manual v2026.09.4, SP 800-53 Revision 5 v1.4.0 |
| Debian 13 ISM Dictionary Checking Component Definition debian-13-pwquality-dictionary | 1.0.0 unpublished | technically-tested | Information Security Manual v2026.09.4, SP 800-53 Revision 5 v1.4.0 |
| Debian 13 ISM Minimum Passphrase Length Component Definition debian-13-pwquality-minlen | 1.0.0 unpublished | technically-tested | Information Security Manual v2026.09.4 |
| Debian 13 ISM No Complexity Requirement Component Definition debian-13-pwquality-no-complexity | 1.0.0 unpublished | technically-tested | Information Security Manual v2026.09.4 |
| Debian 13 ISM Predictable Construction Rules Component Definition debian-13-pwquality-predictability | 1.0.0 unpublished | technically-tested | Information Security Manual v2026.09.4 |
Mirroring
Every page, document and file here is static, uses relative links, and is listed in SHA256SUMS. Copy the site to any web server, or rebuild it from source. Builds are reproducible, so a mirror built inside an air-gapped network can be checked byte for byte against the published SHA256SUMS.