Skip to content
RMF Field Guide

Changelog

Every change to the guide and the template kit, newest first. Each entry is one merged pull request; the ID at its start is the requirement it delivers. The page is rebuilt from the project history whenever a change is published, and each kit release has its own section. Content marked draft has not yet been reviewed by the author.

Unreleased

Section titled “Unreleased”

Site and template kit

Section titled “Site and template kit”
  • PROG-03 Program artifact checklist, as a page and a .csv (#138)
  • TPL-09 Consolidated Information Security and Privacy Policy; the starter kit uses it (#137)
  • PRES-05 Add GoatCounter analytics and count template downloads (#125)
  • TPL-01 Add a report template type (#51)

Content

Section titled “Content”
  • MP policy and media sanitization record (#91)
  • MA policy and maintenance log (#87)
  • SA artifacts (acquisition security requirements, external service review) (#85)
  • SA policy (with the privacy-only SA-8(33)) (#79)
  • Links to the CA artifacts (#77)
  • CA artifacts (assessment plan and report, Continuous Monitoring Strategy, information exchange agreement) (#76)
  • CA policy (#73)
  • SI standards (patch and flaw remediation, system monitoring) (#70)
  • Home page About (#63)
  • SI policy (#62)
  • About page, AI transparency (#61)
  • PT artifacts (#60)
  • PT policy (#59)
  • SC standards (#58)
  • SC policy (#56)
  • Roadmap page (#57)
  • PS policy, access agreement, and onboarding, transfer and termination checklist (#55)
  • Contingency plan, BIA, test plan and after-action report (#54)
  • CP policy (#53)
  • AT policy, training plan and training record log (#52)
  • RA artifacts (#50)
  • RA policy (#49)
  • PL policy (#48)
  • Rules of Behavior and system inventory (#47)
  • Information Security Program Plan and Risk Management Strategy (#46)
  • PM policy, organization-wide (#45)

Project notes

Section titled “Project notes”
  • Docs: refresh the roadmap counts and trim PROGRESS.md (#130)
  • Docs: refresh PROGRESS.md and the log to match main (#127)
  • Docs: record analytics options for PRES-05 to revisit later (#117)
  • Docs: split working records (PROGRESS.md, progress log, source registry) (#110)
  • Docs: roadmap refresh after row 29 (#100)
  • Docs: roadmap refresh (counts, Phase 6 detail) (#94)
  • Docs: documentation pass (architecture, README, PRD 3.7, CLAUDE.md, footer, roadmap) (#90)
  • Progress: handoff notes after row 20 (#80)
  • PRD 3.6: PM and privacy guidance in Phase 3 (#68)
  • PRD 3.5: Moderate guidance in Phase 3 (#65)
  • Progress: handoff notes and the subagent workflow (#64)
  • PRD 3.1: finish the program kit first, then methods, then AI (#44)
  • PRD v3: methods and AI security guide (#43)
  • Progress: Phase 2 exit criteria met, kit v1.0.0 released (#42)

Other changes

Section titled “Other changes”
  • G25: guidance for PL-9, RA-8, SI-18 and SI-19, with SI-18(4) and an SC-7(24) paragraph (#136)
  • G24: guidance for PT-1 to PT-8, with PT-5(2), PT-6(1), PT-6(2), PT-7(1) and PT-7(2) (#135)
  • G23: guidance for PM-25 to PM-32, with PM-30(1) (#134)
  • G22: guidance for PM-17 to PM-24, with PM-20(1) (#133)
  • Fix: M-17-12 duties after row 31 (#132)
  • Row 31: IR artifacts and the IR-2(3) and IR-8(1) clauses (#131)
  • Fix: Risk Management Strategy federal block, RA-7 risk acceptance, EO 13587 for PM-12 (#129)
  • G21: guidance for PM-9 to PM-16, with PM-16(1) (#128)
  • DEPS-01 Apply all available dependency updates in one PR (#126)
  • Row 30: AU artifacts (audit logging standard, log review procedure) and the AU-3(3) clause (#119)
  • G20: guidance for PM-1 to PM-8, with PM-5(1) and PM-7(1) (#118)
  • G19: guidance for AT-1, AT-3, AT-4 and PS-1 to PS-9, with PS-4 and PS-7 template fixes (#114)
  • Row 28: IA artifact (identification and authentication standard) (#113)
  • G18: guidance for RA-1, RA-2, RA-7, RA-9, PL-1, PL-4, PL-8, PL-10 and PL-11 (#112)
  • Row 27: AC artifacts (account management procedure, access request form, access review record, remote access standard) and the AC-3(14) clause (#111)
  • G17: guidance for CP-1, CP-3, CP-4, CP-6, CP-7, CP-8 and CP-10 (#109)
  • Row 26: SR artifacts (Supply Chain Risk Management Plan, supplier assessment questionnaire) (#108)
  • Fix: -1 guidance tables use the shared dissemination value exactly (#105)
  • G16: guidance for IR-1, IR-2, IR-3, IR-5, IR-6 and IR-7 (#106)
  • Fix: search for control IDs returns the control first (NAV-01) (#107)
  • G15: guidance for SR-1, SR-2, SR-3, SR-5, SR-6, SR-8, SR-10, SR-11 and SR-12 (#104)
  • Fix: attribute ASLR and DEP to SI-16, not SC-39 (#103)
  • Row 25: SR policy (all Low, Moderate and High SR clauses; Moderate clause count complete) (#102)
  • G14: guidance for SI-1, SI-3, SI-5, SI-7, SI-8, SI-10, SI-11, SI-12 and SI-16 (#101)
  • Row 29: CM artifacts (Configuration Management Plan, baseline configuration standard, change request form, component inventory) (#99)
  • Fix: PE-17 devices and Rules of Behavior telework line (#98)
  • G13: guidance for PE-10, PE-11, PE-12, PE-13, PE-14, PE-15, PE-16 and PE-17 (#97)
  • G12: guidance for PE-1, PE-2, PE-3, PE-4, PE-5, PE-6, PE-8 and PE-9 (#96)
  • Row 24: PE policy, physical access list and visitor log (#95)
  • G11: guidance for SC-17, SC-18, SC-20, SC-21, SC-22, SC-23 and SC-39 (#93)
  • G10: guidance for MP-1, MP-2, MP-3, MP-4, MP-5, MP-6 and MP-7 (#92)
  • G9: guidance for SC-1, SC-2, SC-4, SC-5, SC-10, SC-12 and SC-15 (#89)
  • G8: guidance for MA-1, MA-2, MA-3, MA-4, MA-5 and MA-6 (#88)
  • G7: guidance for CM-1, CM-3, CM-4, CM-5, CM-9, CM-10, CM-11 and CM-12 (#86)
  • G6: guidance for AU-1, AU-3, AU-4, AU-5, AU-7, AU-8, AU-9 and AU-11 (#84)
  • W2: typical values for the -1 controls (#83)
  • W1: worksheet generator fixes (#82)
  • G5: guidance for SA-1, SA-2, SA-3, SA-4, SA-5, SA-8, SA-10, SA-11, SA-15 and SA-22 (#81)
  • G4: guidance for AC-14, AC-18, AC-19, AC-20, AC-21 and AC-22 (#78)
  • G3: guidance for AC-1, AC-4, AC-5, AC-7, AC-8, AC-11 and AC-12 (#75)
  • G2: guidance for CA-1, CA-3, CA-6 and CA-9 (#74)
  • G1: guidance for IA-1, IA-3, IA-4, IA-6, IA-7, IA-8, IA-11 and IA-12 (#71)
  • UX1: readable tables that fit the page (#69)
  • G0: restore guidance marker on 14 control pages and check it (#67)

v1.0.0 (2026-09-28)

Section titled “v1.0.0 (2026-09-28)”

Site and template kit

Section titled “Site and template kit”
  • TPL-10 Release kit v1.0.0 (#41)
  • PRES-06 Professional Word styling (#40)
  • QA-03 Spell check with cspell (#39)
  • CTRL-04, CTRL-05, CTRL-06 Baseline pages, coverage page, status badges (#38)
  • FEAT-04 Changelog generated from git history (#35)
  • PROG-02 Starter kit (#30)
  • PROG-01, PROG-05 Staged program path aligned with RMF Prepare (#21)
  • QA-05 Template lint (#20)
  • TPL-05 Word downloads, family packs and the full kit (#19)
  • TPL-08 Decision worksheet per family (#18)
  • TPL-06 Policy statements and artifacts on control pages (#17)
  • TPL-07 Generated template pages (#16)
  • TPL-04 Annotated and clean editions, federal sections (#15)
  • TPL-03 Assemble family policies per baseline (#14)
  • TPL-02 Render fill-in variables for site, .md and .docx (#13)
  • TPL-01 Template sources as validated content collections (#12)
  • CTRL-08 Control and parameter data for templates (#11)
  • PRES-03 Automated accessibility check (axe via pa11y-ci) (#10)
  • PRES-01 Social preview image (#9)
  • NAV-01 Search for control IDs like AC-2(3) (#8)
  • LINK-01 Referenced by on control pages (#7)
  • QA-02 Markdown lint (completes QA-01) (#6)
  • QA-04 Front matter validation (#5)
  • CTRL-01 to CTRL-03 Keep hand-set front matter, pin NIST source, generator tests (#3)

Content

Section titled “Content”
  • Guidance for SC-7, SC-8, SC-13, SC-28, SI-2, SI-4 (draft) (#37)
  • Guidance for IA-2, IA-5, IR-4, IR-8, PL-2, RA-3, RA-5, SA-9 (draft) (#36)
  • Guidance for CA-2, CA-5, CA-7, CM-2, CM-6, CM-7, CM-8, CP-2, CP-9 (draft) (#32)
  • Guidance for AC-3, AC-6, AC-17, AT-2, AU-2, AU-6, AU-12 (draft) (#31)
  • Plan of Action and Milestones form (draft) (#29)
  • System Security Plan template (draft); cite SP 800-18 Rev. 2 (#28)
  • Incident Response Plan template; template titles in search (NAV-01) (#27)
  • Incident Response policy clauses (draft) (#26)
  • Identification and Authentication policy clauses (draft) (#25)
  • Configuration Management policy clauses (draft) (#24)
  • Audit and Accountability policy clauses (draft) (#23)
  • Access Control policy clauses (draft) (#22)

Project notes

Section titled “Project notes”
  • Progress: Phase 2 status after merging #11 to #33 (#34)
  • Progress: session handoff notes (#33)
  • Progress: PRES-04 done, Phase 1 next-up list (#4)
  • PRD v2.1, author identity: templates, program path, SSDF, About page (#2)

Other changes

Section titled “Other changes”
  • Fix home page 404s, add PRD, link check CI and workflow hardening (#1)
  • Fix broken internal links under the /nist-guide base path
  • Fix missing styling by setting correct site base path
  • Initial commit

Independent guidance, not an official NIST publication. Control text is from NIST SP 800-53 Rev. 5 and SP 800-53A (public domain). Original content is licensed CC BY 4.0; program templates and the downloadable kit are dedicated to the public domain under CC0 1.0.