Skip to content

Commit fe28a90

Browse files
luiscosioluiscosio
committed
Initial commit
0 parents  commit fe28a90

34 files changed

Lines changed: 71548 additions & 0 deletions

‎.gitignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
.DS_Store
2+
__pycache__

‎CLAUDE.md‎

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
# CLAUDE.md
2+
3+
This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
4+
5+
## Project Overview
6+
7+
This is a web application for viewing and managing security control overlays that constitute IL6 (Information Level 6) — the DoD standard for cloud service providers working with classified secret information. It displays NIST SP 800-53 controls with security overlays including FedRAMP High, CNSSI 1253, Classified Information Overlay, and FedRAMP+.
8+
9+
## Architecture
10+
11+
- **Frontend**: Single-page application using vanilla JavaScript embedded in `index.html` (no build process)
12+
- **Data Pipeline**: Python scripts extract data from PDF overlays → JSON files → JavaScript web app
13+
- **Hosting**: https://il6.sl5taskforce.org/ (GitHub: https://github.com/SL5TaskForce/IL6-control-catalog)
14+
15+
## Common Development Commands
16+
17+
### Python Data Extraction
18+
```bash
19+
# Extract overlay data from PDFs (requires PyMuPDF/fitz)
20+
python cnssi_1253/extract_cnssi_1253.py cnssi_1253/CNSSI_1253_2022.pdf
21+
python classified_information/extract_classified_information.py classified_information/classified_information_overlay_2022.pdf
22+
23+
# Debug specific pages
24+
python cnssi_1253/extract_cnssi_1253.py cnssi_1253/CNSSI_1253_2022.pdf --debug-page 10
25+
26+
# Sort NIST controls naturally
27+
python nist_catalog/nist_sorter.py input.json output.json
28+
```
29+
30+
### Development
31+
- No build process - edit `index.html` directly
32+
- No package manager - pure vanilla JavaScript
33+
- Deploy by pushing to GitHub
34+
35+
## Code Structure
36+
37+
### Frontend (`index.html`)
38+
- **Data Loading**: `loadData()` fetches all JSON files
39+
- **Rendering**: `renderControls()` displays filtered controls
40+
- **State**: Global variables store control data and overlay states
41+
- **Events**: Toggle overlays, search, filter by family, expand/collapse controls
42+
43+
### Data Pipeline
44+
Each overlay directory contains:
45+
- PDF source document
46+
- Python extractor script (`extract_*.py`)
47+
- Generated JSON data file
48+
- Common pattern: PDF → Python extractor → JSON → Web app
49+
50+
### Key Data Structures
51+
```javascript
52+
// Control format
53+
{
54+
"id": "AC-1",
55+
"text": "Control description...",
56+
"family": "Access Control",
57+
"enhancements": [...],
58+
"discussion": "..."
59+
}
60+
61+
// Overlay format varies by type
62+
// FedRAMP: {"assessment_procedures": [...]}
63+
// CNSSI: {"selections": {...}, "parameter_value": "...", "justification": "..."}
64+
// Classified: {"justification": "...", "parameter_value": "...", "guidance": "..."}
65+
```
66+
67+
## Important Patterns
68+
69+
1. **Control ID Format**: `[A-Z]{2}-\d{1,2}` (base) or `[A-Z]{2}-\d{1,2}\(\d+\)` (enhancement)
70+
2. **Overlay Toggle Logic**: Each overlay can be enabled/disabled, affecting control visibility
71+
3. **Enhancement Display**: Controls with enhancements have expandable sections
72+
4. **Modal System**: Click control IDs to preview in modal
73+
5. **Natural Sorting**: Controls sorted as AC-1, AC-2, ..., AC-10 (not lexically)
74+
75+
## Adding New Overlays
76+
77+
1. Create directory for new overlay
78+
2. Add PDF source document
79+
3. Create Python extractor following existing patterns (see `cnssi_1253/extract_cnssi_1253.py` as template)
80+
4. Generate JSON data
81+
5. Add overlay loading in `loadData()` function
82+
6. Add toggle UI in overlay panel
83+
7. Update `getOverlayInfo()` to handle new overlay format
84+
85+
## Testing
86+
87+
No automated tests exist. Manual testing process:
88+
1. Run Python extractors on PDFs
89+
2. Verify JSON output structure
90+
3. Load in browser and test filtering/toggling
91+
4. Check control display and enhancements
92+
5. Test search functionality
93+
94+
## Dependencies
95+
96+
- **Python**: PyMuPDF (fitz) for PDF extraction
97+
- **JavaScript**: None (vanilla JS only)
98+
- **Deployment**: GitHub Pages

‎CNAME‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
il6.sl5taskforce.org

‎README.md‎

Lines changed: 223 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,223 @@
1+
# IL6 Control Catalog
2+
3+
An interactive web application for exploring security control overlays that constitute **Information Level 6 (IL6)** — the DoD standard for cloud service providers working with classified secret information.
4+
5+
🌐 **Live Site:** [https://il6.sl5taskforce.org/](https://il6.sl5taskforce.org/)
6+
7+
---
8+
9+
## Overview
10+
11+
IL6 is based on the **NIST SP 800-53** control catalog and is defined as the union of multiple security overlays:
12+
13+
| Overlay | Description | Precedence |
14+
|---------|-------------|------------|
15+
| **FedRAMP High** | Federal Risk and Authorization Management Program baseline | Lowest |
16+
| **CNSSI 1253** | Committee on National Security Systems security categorization | ↑ |
17+
| **Classified Information Overlay** | Additional controls for classified environments | ↑ |
18+
| **FedRAMP+** | DoD-specific enhancements to FedRAMP | Highest |
19+
20+
Where overlays disagree, each takes precedence over the ones below it.
21+
22+
---
23+
24+
## Features
25+
26+
- 📋 **Complete NIST SP 800-53 Control Catalog** — Browse all controls and enhancements
27+
- 🏷️ **Overlay Badges** — Instantly see which overlays apply to each control
28+
- 🔍 **Search & Filter** — Find controls by ID, name, or text; filter by control family
29+
- 👁️ **Show/Hide Unselected** — Focus on controls with active overlays or see everything
30+
- 📖 **Detailed Views** — Expand controls to see full text, discussions, related controls, and overlay-specific parameters
31+
- 🔗 **NIST Links** — Direct links to official NIST documentation for each control
32+
- 📱 **Responsive Design** — Works on desktop and mobile
33+
34+
---
35+
36+
## Quick Start
37+
38+
Simply open `index.html` in a web browser — no build process or server required.
39+
40+
```bash
41+
# Clone the repository
42+
git clone https://github.com/SL5TaskForce/IL6-control-catalog.git
43+
cd IL6-control-catalog
44+
45+
# Open in browser
46+
open index.html # macOS
47+
start index.html # Windows
48+
xdg-open index.html # Linux
49+
```
50+
51+
Or serve locally:
52+
53+
```bash
54+
python -m http.server 8000
55+
# Visit http://localhost:8000
56+
```
57+
58+
---
59+
60+
## Project Structure
61+
62+
```
63+
control-overlays-selector/
64+
├── index.html # Main web application (vanilla JS)
65+
├── CLAUDE.md # AI assistant guidance
66+
├── README.md # This file
67+
│
68+
├── nist_catalog/ # NIST SP 800-53 source data
69+
│ ├── nist_sp_800-53_control_catalog.json
70+
│ └── nist_sorter.py
71+
│
72+
├── fedramp_high/ # FedRAMP High overlay
73+
│ └── extracted_fedramp_high_overlay.json
74+
│
75+
├── fedramp_plus/ # FedRAMP+ overlay
76+
│ ├── fedramp_plus_overlay.pdf
77+
│ └── extracted_fedramp_plus_overlay.json
78+
│
79+
├── cnssi_1253/ # CNSSI 1253 overlay
80+
│ ├── CNSSI_1253_2022.pdf
81+
│ ├── extract_cnssi_1253.py
82+
│ └── extracted_cnssi_1253.json
83+
│
84+
└── classified_information/ # Classified Information overlay
85+
├── classified_information_overlay_2022.pdf
86+
├── extract_classified_information.py
87+
└── extracted_classified_information.json
88+
```
89+
90+
---
91+
92+
## Data Pipeline
93+
94+
The application uses a PDF → JSON → Web pipeline:
95+
96+
```
97+
┌─────────────────┐ ┌─────────────────┐ ┌─────────────────┐
98+
│ PDF Source │ ──► │ Python Script │ ──► │ JSON Data │
99+
│ Documents │ │ (extraction) │ │ (structured) │
100+
└─────────────────┘ └─────────────────┘ └─────────────────┘
101+
│
102+
▼
103+
┌─────────────────┐
104+
│ Web App (JS) │
105+
│ index.html │
106+
└─────────────────┘
107+
```
108+
109+
### Extracting Data from PDFs
110+
111+
```bash
112+
# Requires PyMuPDF (fitz)
113+
pip install PyMuPDF
114+
115+
# Extract CNSSI 1253 overlay
116+
python cnssi_1253/extract_cnssi_1253.py cnssi_1253/CNSSI_1253_2022.pdf
117+
118+
# Extract Classified Information overlay
119+
python classified_information/extract_classified_information.py \
120+
classified_information/classified_information_overlay_2022.pdf
121+
122+
# Debug specific pages
123+
python cnssi_1253/extract_cnssi_1253.py cnssi_1253/CNSSI_1253_2022.pdf --debug-page 10
124+
```
125+
126+
---
127+
128+
## Development
129+
130+
### No Build Required
131+
132+
This is a vanilla JavaScript application with zero dependencies. Edit `index.html` directly and refresh your browser.
133+
134+
### Key Functions
135+
136+
| Function | Purpose |
137+
|----------|---------|
138+
| `loadData()` | Fetches all JSON files on page load |
139+
| `renderControls()` | Displays filtered controls |
140+
| `getOverlayInfo(controlId)` | Returns overlays applicable to a control |
141+
| `renderOverlay(overlay)` | Renders overlay details |
142+
143+
### Data Structures
144+
145+
**Control Format:**
146+
```javascript
147+
{
148+
"id": "AC-1",
149+
"name": "Policy and Procedures",
150+
"text": "Control description...",
151+
"family": "AC",
152+
"discussion": "...",
153+
"relatedControls": ["AC-2", "PM-9"],
154+
"isEnhancement": false
155+
}
156+
```
157+
158+
**Overlay Formats vary by type:**
159+
```javascript
160+
// FedRAMP: Assessment procedures
161+
{ "assessment_procedures": [...] }
162+
163+
// CNSSI: CIA selections
164+
{ "selections": { "confidentiality": {...}, "integrity": {...}, "availability": {...} } }
165+
166+
// Classified: Justification and parameters
167+
{ "justification": "...", "parameter_value": "..." }
168+
```
169+
170+
---
171+
172+
## Adding a New Overlay
173+
174+
1. **Create directory** for the new overlay
175+
2. **Add PDF source** document
176+
3. **Create Python extractor** (see existing extractors as templates)
177+
4. **Generate JSON** data file
178+
5. **Update `loadData()`** in `index.html` to load the new JSON
179+
6. **Add overlay toggle** in the UI (if needed)
180+
7. **Update `getOverlayInfo()`** to handle the new overlay format
181+
182+
---
183+
184+
## Deployment
185+
186+
The site is deployed at [https://il6.sl5taskforce.org/](https://il6.sl5taskforce.org/). Push to the main branch to trigger deployment.
187+
188+
---
189+
190+
## Dependencies
191+
192+
| Component | Dependency |
193+
|-----------|------------|
194+
| **Web App** | None (vanilla JavaScript) |
195+
| **PDF Extraction** | Python 3, PyMuPDF (`pip install PyMuPDF`) |
196+
| **Deployment** | GitHub Pages |
197+
198+
---
199+
200+
## Contributing
201+
202+
Contributions are welcome! Please:
203+
204+
1. Fork the repository
205+
2. Create a feature branch
206+
3. Test your changes locally
207+
4. Submit a merge request
208+
209+
---
210+
211+
## License
212+
213+
Created by the **[SL5 Task Force](https://sl5.org)** for the security community.
214+
215+
---
216+
217+
## Related Resources
218+
219+
- [NIST SP 800-53 Rev 5](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final) — Security and Privacy Controls
220+
- [FedRAMP](https://www.fedramp.gov/) — Federal Risk and Authorization Management Program
221+
- [CNSSI 1253](https://www.cnss.gov/CNSS/issuances/Instructions.cfm) — Security Categorization and Control Selection
222+
- [DoD Cloud Computing SRG](https://public.cyber.mil/dccs/) — Defense Information Systems Agency Cloud Security
223+

‎classified_information/classified_information_overlay_2022.pdf‎

466 KB
Binary file not shown.

0 commit comments

Comments
 (0)