/control-lookup

description: "Look up controls by framework and ID or keyword"

/grc:control-lookup

Look up controls by framework and ID or keyword.

Usage

/grc:control-lookup [framework] [id-or-keyword]

Arguments

• **framework**: The compliance framework to search. Accepts: `nist`, `fedramp`, `fisma`, `cmmc`, `soc2`, `iso27001`, `pci`, `hipaa`, `cis`, `cobit`, `ccm`, `gdpr`, `dod`, `dow`, `il2`/`il4`/`il5`/`il6`, `srg`, `20x`, `cr26`, `ksi`, `itar`, `usml`, `ddtc`
• **id-or-keyword**: A control ID (e.g., `ac-2`, `CC6.1`, `A.8.1`) or a keyword (e.g., `multi-factor`, `encryption`, `logging`)

Examples

/grc:control-lookup nist ac-2
/grc:control-lookup soc2 CC6.1
/grc:control-lookup pci 8.3
/grc:control-lookup nist encryption
/grc:control-lookup iso27001 A.8.5
/grc:control-lookup cis 5.2
/grc:control-lookup il5 ac-2
/grc:control-lookup ksi KSI-IAM-APM
/grc:control-lookup itar 120.54

Behavior

When invoked:

1. **Identify the framework** from the first argument. Normalize aliases:

• `nist` / `800-53` → NIST 800-53 Rev 5
• `fedramp` → FedRAMP (NIST 800-53 + FedRAMP parameters)
• `cmmc` / `800-171` → CMMC 2.0 / NIST 800-171
• `soc2` / `soc` → SOC 2 Trust Services Criteria
• `iso` / `iso27001` / `27001` → ISO 27001:2022
• `pci` / `pcidss` → PCI DSS v4.0.1
• `hipaa` → HIPAA Security Rule
• `cis` → CIS Controls v8.1
• `cobit` → COBIT 2019
• `ccm` / `csa` → CSA CCM v4
• `gdpr` → GDPR
• `dod` / `dow` / `il2` / `il4` / `il5` / `il6` / `srg` → DoD/DoW Impact Levels (DISA CSP SRG). Read `skills/grc-knowledge/frameworks/dod-impact-levels.md` and `skills/grc-knowledge/mappings/nist-to-dod-il.md`; for the underlying FedRAMP baseline controls also read the OSCAL family JSON as for `fedramp`. When the argument is a specific IL (e.g., `il5`), report that level's full composition (baseline + FedRAMP+ + CNSSI 1253 additions).
• `20x` / `cr26` / `ksi` → FedRAMP 20x / Consolidated Rules for 2026. Read `skills/grc-knowledge/frameworks/fedramp-20x.md`. KSI IDs use the `KSI-THEME-KEY` scheme (e.g., `KSI-IAM-APM`); CR26 rule IDs use `SET-SUBSET-KEY` (e.g., `VDR-CSO-DET`). For exact current rule/KSI text, fetch the machine-readable sources listed in that file's documentation index rather than answering from the summary alone.
• `itar` / `usml` / `ddtc` → ITAR (22 CFR 120–130). Read `skills/grc-knowledge/frameworks/itar.md`. ITAR "IDs" are CFR sections (e.g., `120.54`, `126.1`) or USML categories (Roman numerals I–XXI) — note the 2022 reorganization renumbered most definitions, and that file's structure table maps old→new section numbers.

2. **For NIST or FedRAMP lookups, read the OSCAL family JSON first** for authoritative control data:

• Determine the family ID from the control ID (e.g., `AC-2` → family `ac`, `IA-5(1)` → family `ia`)
• For `nist`: read `skills/grc-knowledge/oscal/nist-800-53-rev5/{family}.json`
• For `fedramp`: read `skills/grc-knowledge/oscal/fedramp-moderate-rev5/{family}.json`
• **IMPORTANT: Use the Read tool to read the file directly. Do NOT use Bash, Python, jq, or any other scripting tool to extract data from OSCAL files.** The JSON is structured and you can find the target control by scanning for its `"id"` field. For large family files, you may read the file in chunks using offset/limit parameters to locate the control.
• **ID normalization**: OSCAL uses lowercase with dots for enhancements — `AC-2` → `ac-2`, `AC-2(1)` → `ac-2.1`
• **Extract from OSCAL** (jq paths shown for reference — extract visually from the JSON, do not run jq):
• Control statement: `.controls[] | select(.id == "ac-2") | .parts[] | select(.name == "statement")`
• Parameters: `.controls[].params[]` — look for `id`, `label`, `guidelines`, `select`/`choice` constraints. FedRAMP files include `.constraints[].description` with required values (e.g., "at least every 3 years")
• Guidance: `.parts[] | select(.name == "guidance")`
• Assessment objectives: `.parts[] | select(.name == "assessment-objective")` — nested tree of testable objectives with `.prose` for each leaf
• Assessment methods: `.parts[] | select(.name == "assessment-method")` — three methods per control:
• EXAMINE (`.props[] | select(.name == "method") | .value == "EXAMINE"`): lists documents/artifacts an assessor reviews
• INTERVIEW: lists roles an assessor interviews
• TEST: lists processes/mechanisms an assessor tests
• Each method's objects are in `.parts[] | select(.name == "assessment-objects") | .prose`
• Enhancements: `.controls[].controls[]` (nested under parent)
• Related controls: `.links[] | select(.rel == "related")`
• Then read the markdown framework file from `skills/grc-knowledge/frameworks/` for cross-framework mapping, audit context, and narrative guidance

3. **For all other frameworks**, read the appropriate framework reference file from `skills/grc-knowledge/frameworks/`

4. **If a control ID is provided**, locate the specific control in the OSCAL JSON by matching `.controls[] | select(.id == "{control-id}")` and return ALL of the following sections in this exact order:

• Control ID and full title
• Framework and version
• Description — from `.parts[] | select(.name == "statement")`
• Baseline assignment (if applicable — Low/Moderate/High for NIST/FedRAMP, IG level for CIS, CMMC level)
• FedRAMP parameter values (if FedRAMP and parameters exist)
• **Assessment Objectives** — **MANDATORY for NIST/FedRAMP**. Find the control's `.parts[] | select(.name == "assessment-objective")` and recursively walk the nested `.parts[]` tree. For each leaf node (a part that has `.prose` but no child `.parts[]`), output its label from `.props[] | select(.name == "label") | .value` and its `.prose`. Output ALL leaf objectives — do not summarize, truncate, or skip any. This MUST be its own separate section in the output.
• **Assessment Methods** — **MANDATORY for NIST/FedRAMP**. Find the co