{
  "$schema": "https://grc.engineering/schemas/registry-manifest-v0.1.json",
  "_comment": "Machine-readable index of pinned OSCAL artifacts. Updated by tooling/registry-publish.sh. See ADR-010.",
  "registry_version": "0.1.0",
  "last_updated": "2026-04-12",
  "artifacts": [
    {
      "id": "nist-800-171r2",
      "title": "NIST SP 800-171 Rev 2 Catalog",
      "type": "catalog",
      "authority": "community",
      "upstream": "FATHOM5CORP/oscal (CC0-1.0)",
      "versions": [
        {
          "version": "v0.1.0",
          "path": "nist-800-171r2/v0.1.0/catalog.json",
          "sha256": "bb6979f7aee26a5f367b4337569a973b720142b04709d4a36f55cde49ec413ec",
          "oscal_version": "1.2.1",
          "notes": "FATHOM5CORP upstream with oscal-version bump to 1.2.1, NCName ID fixes, whitespace cleanup. Trestle-validated."
        },
        {
          "version": "v1.0.0",
          "path": "nist-800-171r2/v1.0.0/catalog.json",
          "sha256": "0e93c466da76f37a2a7907c0fa992738c439ef1ed15cf89336db83d412d124eb",
          "oscal_version": "1.2.1",
          "notes": "Pinned from FATHOM5CORP/oscal CC0-1.0. 14 groups, 110 controls."
        }
      ],
      "current": "v1.0.0"
    },
    {
      "id": "nist-800-171r3",
      "title": "NIST SP 800-171 Rev 3 Catalog",
      "type": "catalog",
      "authority": "official",
      "upstream": "usnistgov/oscal-content",
      "versions": [
        {
          "version": "v1.0.0",
          "path": "nist-800-171r3/v1.0.0/catalog.json",
          "sha256": "b358febb1f1be25bf69728c4bb6f6bd42836bdd7660c19df97c207f28ca3606a",
          "oscal_version": "1.1.2",
          "notes": "Official NIST catalog from usnistgov/oscal-content."
        }
      ],
      "current": "v1.0.0"
    }
  ],
  "pending": [
    {
      "id": "nist-800-171r2-profile",
      "title": "CMMC L2 Profile (NIST SP 800-171 Rev 2 include-all)",
      "type": "profile",
      "blocker": "Depends on Rev 2 catalog; author profile selecting all 110 controls",
      "tracked_in": "O-7"
    },
    {
      "id": "hipaa-security-rule",
      "title": "HIPAA Security Rule Catalog",
      "type": "catalog",
      "blocker": "No public OSCAL catalog exists. 3-4 engineer-days to author.",
      "tracked_in": "ADR-009"
    }
  ]
}