docs: record the control catalogue decision and restructure Package 5

[joey-huckabee]

Records your eight answers as ADR-0009
and rebuilds Package 5 around them.

Question	Decision
Catalogue	800-53 Rev 5 spine, SRG + STIG + CIS cross-references
Baseline	High
Consumer	External assessor, RMF package input
Scope	Image, deployment, and host expectations
Enhancements	Base controls first, enhancements second
Origination	Explicit property and responsible role per control
Sources	Pinned by URL, release, SHA-256
Sequencing	Spine complete, then cross-references

Why these were answered together

Each one changes the shape of every control entry. Deciding them as the writing
proceeds produces a document whose early entries do not match its later ones —
so they are one decision, not eight.

Two clarifications the record makes

CIS was reclassified, not rejected. It is a hardening benchmark rather than
a control catalogue, so it cannot carry an authorization conversation or serve
as a spine. As a cross-reference it is the most directly checkable of the three
against a container image, which is where its value is.

800-53 is the spine because OSCAL is NIST's own format and ships a Rev 5
catalogue, so identifiers resolve natively. Making SRG or STIG the spine would
mean maintaining a mapping layer between the identifiers and the format
carrying them, for no gain.

The pairing that needed care

Host expectations in scope plus an assessor as the reader is the risky
combination: an assessor ingesting this into an SSP may read a host expectation
as a satisfied claim, and host controls are furthest from anything this repo
can test.

Your origination answer is what makes that scope safe rather than reckless —
every control carries a machine-readable origination value and a responsible
role, so an assessor can filter on what this component actually claims instead
of inferring it from prose.

The ADR states the counterfactual plainly: had the origination answer been the
prose option, the honest response would have been to narrow the scope instead.

Package 5, restructured into four stages

Foundation — source register, pin the catalogues, define the OSCAL
structure, and add the structural checks.

Control authoring — classify, author the High base controls, assessment
methods, cross-references, then enhancements.

Publication — schema-validated OSCAL plus generated CSV and human-readable
views from one source.

Scanning, threat model, and operational policy — the existing SCAP, threat
model, crypto boundary, vulnerability policy, and qualification ledger items.

The structural checks sit before the bulk authoring, not after. A property
that is merely conventional gets omitted under deadline — which is exactly when
the overclaim it prevents becomes most likely.

The package also now states that Package 8 precedes it, because the mapping
cites requirement identifiers and draws evidence from the trace matrix.

Consequences, stated bluntly

~370 base controls, well over a thousand with enhancements, each revisited by
the cross-reference pass. Measured in weeks. A High baseline also means many
controls will record organization-inherited or not applicable — accurate, and
it will look sparse to anyone expecting satisfied claims.

The ADR's enforcement section says plainly that nothing is checked today,
and names the three obligations that need it.

🤖 Generated with Claude Code