Identifier nomenclature

JSON contract

Every id on this site is spelled FedRAMP’s way, because FedRAMP already defines the vocabulary — ten identifier types, named in the $defs of the schema this repo vendors alongside the dataset. The canonical form of each is read off that schema rather than designed here. URLs are the lowercase of the canonical id, site-wide.

2026.07.14.0111 namespaces

Control idsdistinct NIST 800-53 controls the dataset names

Named anywhere: 419KSI edges ∪ Rev5 baselines ∪ CTL guidance
Reached by a KSI: 209 of 419the only ones with a page
In some Rev5 baseline: 409 of 419
Carrying CTL guidance: 79 of 41933 of them have no page

Addressability is keyed to KSI edges, not to the id space. A control can normalize cleanly, carry FedRAMP-authored guidance and ODP values, and still have no URL — which is why named and addressable are separate columns below rather than one number.

The vocabulary

Three forms per entity. Canonicalis the machine form — map key, JSON API key, join key — and is FedRAMP’s own spelling wherever FedRAMP defines one. Display is what a human reads. Slug is the URL segment. Where a kind has no FedRAMP $def, the form is ours and says so.

Kind	Canonical	Display	Slug (URL)	FedRAMP `$def`
NIST 800-53 control/control/[id]	ac-2.13	AC-02 (13)	ac-2.13	`control_id` / `rev5_control_id` FedRAMP's primary control identifier, and the dialect the KSI graph is written in. Already a legal URL segment, so canonical and slug are one string.
Control familyno route	AC	AC	ac	not a named `$def` Uppercase two-letter code. FedRAMP constrains it inline on `rev5_controls_list` keys (`^[A-Z]{2}$`) rather than as a named `$def`.
KSI indicator/ksi/[id]	KSI-CNA-DFP	KSI-CNA-DFP	ksi-cna-dfp	`ksi_indicator_id` FedRAMP publishes and cites this exact string, so it is emitted unchanged; only the URL is lowercased.
KSI theme/plan/[class]/[theme]	CNA	CNA	cna	`ksi_theme_key` `ksi_theme_key` (`CNA`) is the machine form; `ksi_theme_id` (`KSI-CNA`) is the same theme spelled long, and is accepted as an alias.
FRR requirement/requirement/[id]	AFC-CSO-EMR	AFC-CSO-EMR	afc-cso-emr	`frr_requirement_id` FedRAMP's pattern carries a negative lookahead excluding `KSI-`, so a KSI id can never be mistaken for a requirement id.
FRR documentno route	AFC	AFC	afc	`frr_document_key` Three-letter document key. Named in the schema, addressed by no route — a nomenclature, not a page.
Certification class/plan/[class]	b	B	b	`class_key` / `class_name` FedRAMP already models the machine/human split here: `class_key` is lowercase, `class_name` uppercase. Low/Moderate/High are accepted as aliases and never emitted — they are interpretation, not dataset fact.
ODP parameterno route	ac-6.1_odp.2	AC-06 (01) ODP 2	ac-6.1_odp.2	not a named `$def` The one id form FedRAMP's schema declines to constrain (`{"type":"string"}`), so its format is ours. Normalized to a `control_id` plus an `_odp` suffix, which makes it a control reference rather than opaque text.
evidence recipe/collect/[recipeId]	iam-credential-report	iam-credential-report	iam-credential-report	not a named `$def` Ours. Kebab-case, from the authored overlays — no FedRAMP counterpart, because an overlay is not upstream fact.
Affected party/for/[party]	Providers	Providers	providers	not a named `$def` Ours, derived from FedRAMP's `affected_party` enum. The enum value is the display form; the slug is its lowercase.
FRD term anchor/glossary#term-[slug]	fedramp-authorized	FedRAMP Authorized	fedramp-authorized	not a named `$def` Ours. A slug of the defined term itself; lossy, so the term text is never recovered from the anchor.

Named is not addressable

How many ids of each kind the dataset names, and how many of those have a prerendered page. The gap is deliberate everywhere it appears: families and documents get a nomenclature rather than a route, ODP ids and glossary anchors resolve inside another page, and the control gap is the KSI graph’s reach.

Namespace	Named	Addressable	Where it is addressed
NIST 800-53 control	419	209	/control/[id]
Control family	19	—	—
KSI indicator	46	46	/ksi/[id]
KSI theme	10	10	/plan/[class]/[theme]
FRR requirement	246	246	/requirement/[id]
FRR document	17	—	—
Certification class	4	3	/plan/[class]
ODP parameter	19	—	—
evidence recipe	64	64	/collect/[recipeId]
Affected party	5	5	/for/[party]
FRD term anchor	75	—	/glossary#term-[slug]

210 controls the dataset names have no page. Of those, 33 carry FedRAMP-authored guidance and ODP values — real content at a URL that would 404. The scope catalog publishes hasPage per control so nothing links into one.

What we accept, and what we emit

The dataset writes control ids three different ways, and NIST writes them a fourth. All of them resolve — type any of these into search and you land on the same control. None of them is ever emitted, stored, or linked to.

Spelling	Where it comes from	Status
ac-2.13	FedRAMP `control_id` — every string in a KSI's `controls[]` array	canonical
AC-02 (13)	FedRAMP `rev5_control_id` — the Rev5 baseline lists	display
AC-06-01	`CTL` object keys — a structural key, not a named identifier type	input only
AC-02.01	this project's former canonical form — a hybrid of two FedRAMP spellings, and itself neither	input only
AC-2 (13) / AC-2(13)	NIST 800-53's own style, which the dataset does not use	input only

Low / Moderate / High are accepted the same way for certification classes, and treated the same way: they are an interpretation of the class letters, not a fact the dataset states, so they resolve as input and are never printed as an id.

Where the patterns come from

These are FedRAMP’s regexes, not ours. They are transcribed from the schema this repo vendors, and a test re-reads that file on every run and fails if a single character has drifted — so the day upstream widens one, a test says so instead of the build rejecting good data.

control_id: ^[a-z]{2}-\d+(?:\.\d+)?$
rev5_control_id: ^[A-Z]{2}-\d{2}(?: $\d{2}$)?$
ksi_indicator_id: ^KSI-[A-Z]{3}-[A-Z0-9]{3}$
ksi_theme_id: ^KSI-[A-Z]{3}$
ksi_theme_key: ^[A-Z]{3}$
frr_requirement_id: ^(?!KSI-)[A-Z]{3}-[A-Z]{3}-[A-Z0-9]{3}$
frr_document_key: ^[A-Z]{3}$
frd_definition_id: ^FRD-[A-Z]{3}$

class_key and class_name are enums upstream rather than patterns: a|b|c|d and A|B|C|D. ODP parameter ids are the one identifier FedRAMP’s schema declines to constrain — typed {"type":"string"} — so their format is ours to define, and we define it as a control_id plus an _odp suffix. All 19 of them resolve to a control that exists, which is what lets an ODP id be a reference instead of opaque text.

Keyboard shortcuts

Go

Move

Act