About
What SecBaseline is
SecBaseline is a suite of tools for the people who actually harden systems. It takes security baselines (DISA STIGs and CIS Benchmarks) and explains them in language an engineer can act on, relates them back to NIST 800-53 so you can see where one piece of work covers more than one obligation, expresses the same control data as machine-readable OSCAL when a program requires it, and drafts System Security Plans from the controls actually applied to each system.
This site is the front door. The work happens in the individual tools.
The approach
Mappings are computed, not generated
Control relationships come from published framework mappings: CCI to NIST 800-53, CIS Controls to NIST, and the equivalents each body maintains. They are looked up and computed, never produced by an AI model. If a mapping is not published, SecBaseline does not invent one.
AI explains; it does not decide
Language models are used to turn dense control text into plain English and to draft remediation prose. They are never used to decide whether one control satisfies another. That judgment stays with the published mappings and, ultimately, with you.
Unmapped controls stay visible
When a finding has no published mapping into another framework, it is shown explicitly as unmapped rather than quietly dropped. A gap you can see is a gap you can plan around.
OSCAL is validated, not improvised
Conversion to and from OSCAL is deterministic, and every document is checked against NIST's published OSCAL JSON Schema. A model may explain a validation error in plain English or draft narrative text you review. It never fabricates OSCAL structure, identifiers, or control content.
Important
Mapping-based coverage reflects published mappings, not verified technical equivalence. Two controls linked through NIST 800-53 may still differ in scope, strictness, or implementation detail. Treat a mapping as a strong starting point for your own review, not as proof that one requirement satisfies another.
Browse the full tool directory to see what is available today and what is in development.