Catalog inventory¶

Evidentia bundles framework catalogs in-tree. This page is the compliance-angled view: it groups those catalogs by region and standard family and, for each group, tells you what you may redistribute (the tier), how much control text the file actually carries (the text depth), and where a placeholder needs your licensed copy.

For the flat, sortable, always-current table of every catalog id, version, tier, text depth and category, see the auto-generated Reference: Catalogs page (regenerated from the live frameworks.yaml manifest on every CI run). This page does not duplicate that table; it explains the posture behind it. Run evidentia catalog list to enumerate catalogs at runtime; the Text column is the text depth.

Redistribution tier and text depth¶

Every catalog carries two independent facts.

The redistribution tier is the legal posture: what Evidentia may bundle and what you may redistribute.

Tier	Redistribution	Typical sources
A	Public-domain or open-licensed; bundled and freely redistributable	US federal works, Apache-2.0 upstreams
B	Free to use with attribution	MITRE ATT&CK / CAPEC / CWE, CISA KEV
C	Copyrighted; only the public numbering and neutral titles ship, as a placeholder	ISO, CIS, PCI DSS, SOC 2, HITRUST, COBIT
D	Government regulation or statute, restated as obligations	GDPR, NIS2, DORA, US state privacy laws

The text depth is what is actually in the file, derived from the entries by evidentia_core.models.catalog.derive_text_depth and never declared:

Text depth	Meaning
`full`	Every non-withdrawn entry carries statement text that differs from its title
`partial`	Some entries do
`headings`	None does: the catalog carries control numbering and titles only

Through v0.12 this page said "Tier A = full authoritative control text". That was not true: the tier never measured text, and many Tier-A catalogs carry headings only. The manifest column is regenerated from the files by scripts/catalogs/regenerate_manifest.py, and scripts/check_catalog_truth.py fails the consistency gate whenever the column, the families or the crosswalk identifiers disagree with the files. The block below is written by that script.

The current distribution across all 107 catalogs, derived from the manifest and the catalog files themselves (the text depth is computed, never declared):

Tier	Catalogs	Full text	Headings only
A	58	29	29
B	4	4	0
C	24	0	24
D	21	3	18

A Tier-C catalog (for example iso-27001-2022, pci-dss-4.0.1, soc2-tsc) ships only the public control numbering (ISO 27001 Annex A ids, SOC 2 CC1 to CC9 / A1 / C1 / P1 to P8 / PI1, and so on) and a license_url. It provides a starting structure: gap analysis against it keys off the control ids, but the control text your auditors read must come from your licensed copy. All Tier-C catalogs are flagged placeholder: true and license_required: true in the manifest, so they are unambiguous at runtime.

A heading-only Tier-A or Tier-D catalog is different in kind: nothing is withheld for licensing reasons, the bundled file simply captures the framework's structure (ids, titles, families) and not the statement text. Gap analysis works the same way; the difference shows in the Text column, in control_description on each gap, and in what evidentia explain has to work with. Filling those catalogs in is tracked on the roadmap; the point of the column is that the product says which ones they are.

Per-catalog license statements are the license and source_url columns of the manifest; evidentia catalog license-info <id> prints them together with the tier and the text depth.

By region / standard family¶

US federal and financial-sector catalogs¶

These catalogs include federal publications, state regulation and licensed industry standards. The manifest records each catalog's redistribution tier and text depth. The FDA Section 524B categories and OCC / FRB model-risk guidance contain editorial summaries. Statement presence does not certify completeness or an authoritative reproduction.

NIST SP 800-53 Rev 5: the full 1,196-entry catalog (182 of them withdrawn upstream and flagged as such) plus the Low / Moderate / High / Privacy baselines (resolved from usnistgov/oscal-content, CC0), and the legacy 16-control nist-800-53-mod sample retained for backward compatibility. The baselines and the sample belong to the nist-800-53-rev5 crosswalk family.
FedRAMP Rev 5: Low / Moderate / High / LI-SaaS baselines (same family), plus the CR26 Key Security Indicator and Requirements catalogs.
CMMC 2.0: Level 1 has the 15 FAR-based headings from the current DoD guide. Levels 2 and 3 also contain headings only.
NIST SP 800-171 Rev 2 and Rev 3, 800-172, AI RMF 1.0, Privacy Framework 1.0, SSDF 800-218 (headings only); CSF 2.0 (full text).
HIPAA (Security / Privacy / Breach), GLBA Safeguards, CJIS v6, IRS Pub 1075, CMS ARS 5.1, FDA 21 CFR Part 11 and CISA CPGs 2.0 (34 goals across six functions; headings only).
FFIEC IT Examination Handbook: six new heading catalogs cover Architecture, Infrastructure, and Operations; Business Continuity Management; Development, Acquisition, and Maintenance; Retail Payment Systems; Supervision of Technology Service Providers; and Wholesale Payment Systems. Alongside Audit, Management, Information Security and Outsourcing, these cover the ten current booklet titles. Booklet coverage does not imply all handbook text is bundled. Superseded Operations and the retired Cybersecurity Assessment Tool remain available with notices.
NY DFS Part 500: Tier-D regulatory headings with the 2023 amendment and 2025 transition dates, scoped to covered entities.
NERC CIP: Tier-C licensed headings for 13 current US standards. Future approvals and the pending revision are separate notices; they do not add assessed controls.
OCC Bulletin 2026-13 / FRB SR 26-2 (model risk; supersedes the SR 11-7 / OCC 2011-12 line; full text).

The manifest records the source and redistribution terms for each catalog.

International¶

Tier-A control frameworks: Australian Essential Eight and ISM, Canada ITSG-33, NZ NZISM, UK Cyber Essentials and NCSC CAF 3.2 (headings only); EU AI Act (22 editorial article summaries with scoped application dates); and the 3 OpenSSF OSPS Baseline maturity catalogs (M1 / M2 / M3, verbatim under upstream Apache-2.0, full text; they belong to the osps-baseline crosswalk family; see the OSPS Baseline mapping showcase page).
Tier-D obligations and regulations: EU GDPR, Canada PIPEDA and UK DPA 2018 restate their obligations in full (categorized obligation); EU NIS2 and EU DORA are control-category regulations captured at heading level.

US State Privacy (15 catalogs, all Tier-D obligations)¶

The bundled set covers fifteen US state consumer-privacy laws: California (CCPA/CPRA), Colorado, Connecticut, Delaware, Florida, Iowa, Maryland, Minnesota, Montana, New Hampshire, Oregon, Tennessee, Texas, Utah, Virginia. State statutes are not copyrightable under the government-edicts doctrine, so all 15 are bundled; each captures the statute's obligation structure at heading level (headings), not the statutory text.

Threat Intelligence (4 catalogs, all Tier-B, full text)¶

Cross-reference frameworks that ride alongside control catalogs: MITRE ATT&CK Enterprise, CAPEC, CWE (2024 Top-25 sample), and the CISA KEV sample. Tier-B because they are free to use with attribution; the KEV sample is a daily-refreshable subset of the full catalog.

License-required placeholders (Tier-C, headings only)¶

These are the frameworks whose control text is copyrighted, so Evidentia ships only the public numbering, neutral titles and a license_url:

ISO/IEC: 27001:2022, 27002:2022, 27017:2015, 27018:2019, 27701:2019, 42001:2023 (the 38 Annex A control identifiers under their nine objectives), 22301:2019, 14971.
CIS: Critical Security Controls v8.1 and the AWS / Azure / GCP / Kubernetes / RHEL 9 Foundations Benchmarks.
Others: PCI DSS v4.0.1, COBIT 2019, HITRUST CSF v11, IEC 62443, SCF 2024, SOC 2 Trust Services Criteria, ANSI/AAMI SW96 and NERC CIP.
Swift CSCF: the verified v2026 attestation edition has 32 headings. The retained v2024 file is historical; its original source table has not been verified.

To use one of these for a real assessment, obtain the authoritative text from the source (license_url is in the manifest and on the Reference: Catalogs page) and load your licensed copy with evidentia catalog import. See Contributing a catalog for the catalog schema if you are hand-authoring one.

Pinned native source coverage¶

Australian ISM 2026.09.4: 1,143 indexed controls and 49 principles retained as native context. The 24 former heading IDs are retired without automatic replacements. Select current controls explicitly; existing evidence is not rewritten. Publisher attribution and exceptions remain with the retained source README.
CISA SCuBA for Microsoft 365: eight pinned Markdown baselines provide 128 policy identities. The accompanying reference JSON has 127 records and remains separate. This catalog does not execute ScubaGear checks or cover Google Workspace. Repository CC0, Microsoft-adapted CC BY 4.0 notices and product-license prerequisites remain attached to their source documents.
BSI Grundschutz++: an external-only importer accepts the exact three operator-selected files for profile bsi-grundschutz-plus-plus-367d7750; source text is not bundled. Import does not grant or accept rights for the operator.
FINOS CCC: adoption remains deferred for owner legal review. FINOS sources and normalized catalogs remain excluded from this release; future adoption requires an explicit reviewed scope.

Native source occurrence counts describe retained structure, not additional assessment controls. See Manage catalogs for source browsing, import and storage limits.

Adding a catalog or holding a version¶

Add a new framework: 3-file PR; see Contributing a catalog.
Hold a catalog version: no catalog pin command exists or is scheduled. So that an authoritative-source refresh does not shift your assessment baseline, import the catalog version you assessed against with evidentia catalog import; a user-imported catalog shadows the bundled one under the same framework id, and evidentia catalog where <framework> shows which copy resolves. Catalog content is a non-frozen surface (api-stability.md "Bundled catalog content"): it evolves as NIST / ISO / EU sources publish updates.