Control ID Formats

Correct ID formatting is critical. The Pretorin API returns errors on malformed IDs. When unsure, discover IDs first with pretorin frameworks families <id> or pretorin frameworks controls <id>.

NIST 800-53 Rev 5 / FedRAMP

Framework IDs: nist-800-53-r5, fedramp-low, fedramp-moderate, fedramp-high

Family IDs

Family IDs are lowercase slugs, not short codes:

Control IDs

Control IDs are zero-padded with a hyphen:

Enhancement IDs append a dot-suffix or parenthetical suffix. Both spellings are accepted on input, but the platform’s canonical form zero-pads the enhancement number too:

Compare returned IDs against the canonical form — pretorin frameworks control nist-800-53-r5 sc-07.1 succeeds, but the record it returns is sc-07.01, so an equality check against sc-07.1 will not match.

CMMC 2.0

Framework IDs: cmmc-l1, cmmc-l2, cmmc-l3

Family IDs

Level 2 and Level 3 family IDs carry a level suffix; Level 1 family IDs do not:

A wrong family slug is not an error — pretorin frameworks controls returns “No controls found for this selection”, so confirm the slug with pretorin frameworks families <framework_id> first.

Control IDs

CMMC control IDs use dotted notation with a level prefix and are case-sensitive:

Use uppercase for the family prefix (e.g., AC, not ac).

Every one of the 24 Level 3 control IDs ends in a lowercase e (for “enhanced”), mirroring the NIST SP 800-172 enhanced-requirement numbering. AC.L3-3.1.2e is a valid ID; AC.L3-3.1.2 is not. Dropping the suffix is the most common Level 3 ID error.

NIST 800-171 Rev 3

Framework ID: nist-800-171-r3

Family IDs

Family IDs use the same lowercase slug convention as NIST 800-53:

Control IDs

Control IDs use dotted notation with leading zeros:

SOC 2

Framework ID: soc2

Pretorin’s SOC 2 catalog is an expert-reviewed control register organized by trust-services domain, not by the raw Common Criteria codes.

Family IDs

SOC 2 family IDs are lowercase domain slugs (one per trust-services domain plus an AI-controls domain):

Control IDs

SOC 2 control IDs use a prefixed, zero-padded format — PTR-SOC2-<DOMAIN>-NNN, where the domain code is uppercase and the number is three digits:

Domain codes: SEC (security), AVL (availability), CONF (confidentiality), PRIV (privacy), PI (processing-integrity), AI (ai-controls). SOC 2 IDs are case-sensitive — keep the prefix and domain code uppercase. When unsure, discover the exact IDs with pretorin frameworks controls soc2 --family security.

800-53-Derived Baselines

Framework IDs: dod-cloud-il2, dod-cloud-il4, dod-cloud-il5, dod-onprem, nss-ic, ot-ics, iot-federal

These baselines are tailorings of the NIST 800-53 catalog and reuse its conventions exactly — lowercase family slugs (access-control, system-and-communications-protection) and zero-padded control IDs (ac-01, sc-07), enhancements included. Everything in the NIST 800-53 Rev 5 / FedRAMP section above applies unchanged, including auto-normalization.

They are subsets: a valid 800-53 ID is not necessarily present in the baseline. Confirm with pretorin frameworks controls <framework_id> --family <family_slug>.

Other Catalogs

The remaining catalogs each use their own convention. None of them match the auto-normalizer, so the format below is what you must pass. Discover exact IDs with pretorin frameworks families <framework_id> and pretorin frameworks controls <framework_id>.

Two traps in this set:

• HIPAA and GDPR family IDs are uppercase codes, not lowercase slugs — the opposite of the 800-53 convention. hipaa-nist (the NIST Security Rule mapping) does use lowercase slugs, so the two HIPAA catalogs differ from each other.
• pci-dss-4 exposes two family-slug series. Only the req-PCI-<n> slugs carry controls; the bare req-<n> slugs return zero results without erroring.

Auto-Normalization

The CLI and MCP tools automatically normalize control IDs that match the NIST/FedRAMP shape — a two-letter family code, a hyphen, and a number: uppercase is lowered and the base number is zero-padded. For example, AC-2 becomes ac-02 and SC-7.1 becomes sc-07.1. This covers NIST 800-53, FedRAMP, and every 800-53-derived baseline. Client-side normalization does not pad the enhancement number — the platform does that, so a lookup for sc-07.1 resolves to the canonical sc-07.01. All other IDs — CMMC, NIST 800-171, SOC 2, and everything in Other Catalogs — do not match the pattern and are passed through unchanged, so use the exact format shown above.

Discovery Workflow

When a user provides an informal control reference (e.g., “AC-2” or “access control”):

1. Call pretorin frameworks families <framework_id> to find the correct family slug
2. Call pretorin frameworks controls <framework_id> --family <family_slug> to find the correct control ID
3. Use the discovered ID in subsequent calls

Quick Reference