<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# NIST 800-53 Controls — API Reference

## OSCAL CLI

```bash
# Validate OSCAL catalog
oscal-cli catalog validate catalog.json

# Convert between OSCAL formats
oscal-cli catalog convert catalog.xml --to json -o catalog.json

# Resolve profile to catalog
oscal-cli profile resolve moderate-profile.json -o resolved-catalog.json
```

## Compliance Trestle

```bash
# Initialize trestle workspace
trestle init

# Import NIST 800-53 catalog
trestle import -f nist-800-53-catalog.json -o nist-800-53

# Generate SSP from profile
trestle author ssp-generate -p moderate-profile -o ssp

# Assemble SSP
trestle author ssp-assemble -m ssp -o system-security-plan
```

## InSpec NIST Resources

```bash
# Run NIST 800-53 profile
inspec exec nist-800-53-profile -t ssh://user@target --reporter json

# Filter by control family
inspec exec nist-800-53-profile --controls /nist-ac/ /nist-au/

# AWS target
inspec exec nist-800-53-profile -t aws:// --reporter json
```

## Baseline Control Counts

| Family | Low | Moderate | High |
|--------|-----|----------|------|
| AC | 11 | 20 | 25 |
| AU | 6 | 12 | 16 |
| CM | 6 | 11 | 14 |
| IA | 5 | 9 | 12 |
| IR | 4 | 8 | 10 |
| SC | 7 | 24 | 44 |
| SI | 5 | 12 | 17 |

## OPA Policy Testing

```bash
# Test NIST policies
opa test policy/nist_*.rego -v

# Evaluate against infrastructure data
opa eval --data policy/ --input infra.json "data.nist.access_control.deny"

# Format policies
opa fmt -w policy/nist_*.rego
```
