How this crosswalk is built

The rule

1. Only owners' files. Every link on the crosswalk, on practice and control pages and in every download is one the standard's owner published, in a file we keep with its SHA-256 checksum.
2. Chains stay chains. When a link crosses publications, we show the official steps that produce it and never store a shortcut of our own. NIST published no SP 800-171 Rev 2 → SP 800-53 Rev 5 table, so a Rev 5 control is shown with its path: D Rev 2 Appendix D → SP 800-53 Rev 4 → NIST's Rev 4 → Rev 5 comparison; S the source controls NIST lists for the Rev 3 requirement; C SP 800-172 Appendix C.
3. Our notes are labelled. Our reading of a link appears as an “Expert CMMC note”, never as a crosswalk link or in a crosswalk column.
4. Other sites are leads only. A third-party mapping can prompt us to check something; any change it leads to cites the owner's file, never the third party.
5. The server checks it. A new or changed link must name an official file and the place in it, and the pair must appear in that file's table, or it is refused.

When official files disagree

We follow this order, highest first, and say so in a note marked NIST on every page the disagreement touches:

1. Regulation (32 CFR Part 170, the FAR, the DFARS) for what CMMC requires.
2. The publication of record (the final PDF) for NIST requirement text and its appendices.
3. NIST's machine-readable release of the same publication (OSCAL).
4. NIST's supplemental workbooks (change analyses, the CUI overlay, the Rev 4 → Rev 5 comparison).

Report an error

If a link, a note or a checksum looks wrong, email [email protected] with the practice or control number and the official document and page you are reading. We check it against the owner's file and correct the site through the same review as every other change.

Back to the crosswalk.