Use NIST 800-53 rev 5

[degenaro]

Issue description / feature objectives

NIST 800-53 Revision 4 was officially withdrawn on September 23, 2021. Survey the use of Rev 4 in the core, demo, and associated OSCAL Compass repos. Switch to Rev 5 when appropriate (most if not all cases).

Caveats / Assumptions

Create individual issues to divide and conquer.

Completion Criteria

Set of issues (e.g. one or more for trestle, one or more for demos...) created such that use of NIST 800-53 Revision 4 will be minimized or eliminated.

[Prarthana-1910]

Hi @degenaro, I’d like to work on this issue.

From what I understand, this involves identifying all usages of NIST 800-53 Rev 4 across the repos (trestle, demos, OSCAL Compass) and updating them to Rev 5 controls, ensuring compatibility with existing OSCAL models.

My approach:

• Search for Rev4 control IDs and catalogs in the codebase

• Identify schema / profile references tied to Rev4

• Replace with Rev5 equivalents and validate against OSCAL schemas

• Run existing tests and adjust where control structure changes affect outputs

Please let me know if this direction aligns. I can start with the trestle sub-issue (#1977).

[degenaro]

@Prarthana-1910 I believe sub issues #1977, #1978 have been closed by PRs. If there are other places that rev4 appears, please open a sub issue. Else, this epic issue can be closed as well. Thx!

[Prarthana-1910]

I completed a repository-wide audit for residual SP 800-53 Rev4 references.

I found that,

Rev4 content exists in nist-content/nist.gov/SP800-53/rev4/ and examples, which appear to be archival/reference datasets rather than active dependencies.

I did not find source code, profiles, or schemas loading Rev4 catalogs.

However, the CLI tutorial still instructs use of a Rev4 catalog:

docs/tutorials/cli.md (lines ~127–138)

This seems to be instructional documentation rather than legacy support content.
I’ll open a small sub-issue to update the tutorial to Rev5.

[Prarthana-1910]

Hi @degenaro
To ensure everything is fully consistent after the earlier Rev5 updates discussion, I did a fresh repository-wide audit for any remaining SP 800-53 Rev4 references.

This is what I found mainly:

• Remaining Rev4 content exists only under nist-content/nist.gov/SP800-53/rev4/ and example datasets, which appear to be archival/reference material rather than active dependencies.
• No source code, profiles, schemas, or processing logic are using Rev4 catalogs.
• I had previously opened a PR after suspecting additional Rev4 instances in older files. After rechecking (and as discussed in the earlier PR), those updates were already present in develop, so the PR was redundant and has been closed.

Based on this verification, Rev4 is no longer used in functional paths. This epic issue should now be safe to close.