Control ID Formats
Correct ID formatting is critical. The Pretorin API returns errors on malformed IDs. When unsure, discover IDs first with pretorin frameworks families <id> or pretorin frameworks controls <id>.
NIST 800-53 Rev 5 / FedRAMP
Framework IDs: nist-800-53-r5, fedramp-low, fedramp-moderate, fedramp-high
Family IDs
Family IDs are lowercase slugs, not short codes:
| Correct | Incorrect |
|---|---|
access-control | ac |
audit-and-accountability | au |
identification-and-authentication | ia |
system-and-communications-protection | sc |
configuration-management | cm |
incident-response | ir |
risk-assessment | ra |
Control IDs
Control IDs are zero-padded with a hyphen:
| Correct | Incorrect |
|---|---|
ac-01 | ac-1, AC-1, ac1 |
ac-02 | ac-2, AC-2, ac2 |
au-02 | au-2, AU-2 |
sc-07 | sc-7, SC-7 |
Enhancement IDs append a dot-suffix or parenthetical suffix. Both spellings are accepted on input, but the platform’s canonical form zero-pads the enhancement number too:
| Format | Example input | Canonical ID returned |
|---|---|---|
| Dot notation | ac-02.1 | ac-02.01 |
| Parenthetical | ac-02(1) | ac-02.01 |
| Already canonical | ac-02.01 | ac-02.01 |
Compare returned IDs against the canonical form — pretorin frameworks control nist-800-53-r5 sc-07.1 succeeds, but the record it returns is sc-07.01, so an
equality check against sc-07.1 will not match.
CMMC 2.0
Framework IDs: cmmc-l1, cmmc-l2, cmmc-l3
Family IDs
Level 2 and Level 3 family IDs carry a level suffix; Level 1 family IDs do not:
| Framework | Correct | Incorrect |
|---|---|---|
cmmc-l1 | access-control | access-control-level-1, ac |
cmmc-l1 | media-protection | media-protection-level-1, mp |
cmmc-l2 | access-control-level-2 | access-control, ac-l2 |
cmmc-l2 | incident-response-level-2 | incident-response, ir |
cmmc-l3 | system-and-communications-protection-level-3 | sc, sc-l3 |
cmmc-l3 | access-control-level-3-enhanced | access-control-level-3 |
A wrong family slug is not an error — pretorin frameworks controls returns “No controls found for this selection”, so confirm the slug with pretorin frameworks families <framework_id> first.
Control IDs
CMMC control IDs use dotted notation with a level prefix and are case-sensitive:
| Correct | Incorrect |
|---|---|
AC.L2-3.1.1 | ac-01, 3.1.1 |
AC.L1-3.1.22 | ac.l1-3.1.22 |
SC.L3-3.13.4e | SC.L3-3.13.4, sc-07, 3.13.4 |
Use uppercase for the family prefix (e.g., AC, not ac).
Every one of the 24 Level 3 control IDs ends in a lowercase e (for “enhanced”),
mirroring the NIST SP 800-172 enhanced-requirement numbering. AC.L3-3.1.2e is a
valid ID; AC.L3-3.1.2 is not. Dropping the suffix is the most common Level 3 ID
error.
NIST 800-171 Rev 3
Framework ID: nist-800-171-r3
Family IDs
Family IDs use the same lowercase slug convention as NIST 800-53:
| Correct | Incorrect |
|---|---|
access-control | ac, 3.1 |
incident-response | ir, 3.6 |
identification-and-authentication | ia, 3.5 |
Control IDs
Control IDs use dotted notation with leading zeros:
| Correct | Incorrect |
|---|---|
03.01.01 | 3.1.1, ac-01 |
03.01.02 | 3.1.2, ac-02 |
03.13.01 | 3.13.1, sc-01 |
SOC 2
Framework ID: soc2
Pretorin’s SOC 2 catalog is an expert-reviewed control register organized by trust-services domain, not by the raw Common Criteria codes.
Family IDs
SOC 2 family IDs are lowercase domain slugs (one per trust-services domain plus an AI-controls domain):
| Correct | Incorrect |
|---|---|
security | CC6, common-criteria, cc |
availability | A1, avail |
confidentiality | C1, conf |
privacy | P1 |
processing-integrity | PI1, processing_integrity |
ai-controls | AI, ai |
Control IDs
SOC 2 control IDs use a prefixed, zero-padded format — PTR-SOC2-<DOMAIN>-NNN, where the domain code is uppercase and the number is three digits:
| Correct | Incorrect |
|---|---|
PTR-SOC2-SEC-001 | CC6.1, sec-1, 6.1 |
PTR-SOC2-AVL-004 | A1.4, avl-4 |
PTR-SOC2-AI-016 | AI.16, ai-16 |
Domain codes: SEC (security), AVL (availability), CONF (confidentiality), PRIV (privacy), PI (processing-integrity), AI (ai-controls). SOC 2 IDs are case-sensitive — keep the prefix and domain code uppercase. When unsure, discover the exact IDs with pretorin frameworks controls soc2 --family security.
Auto-Normalization
The CLI and MCP tools automatically normalize NIST 800-53 and FedRAMP control IDs: uppercase is lowered and the single-digit base number is zero-padded. For example, AC-2 becomes ac-02 and SC-7.1 becomes sc-07.1. Client-side normalization does not pad the enhancement number — the platform does that, so a lookup for sc-07.1 resolves to the canonical sc-07.01. CMMC, NIST 800-171, and SOC 2 IDs do not match the normalizer’s pattern and are passed through unchanged — use the exact format shown above.
Discovery Workflow
When a user provides an informal control reference (e.g., “AC-2” or “access control”):
- Call
pretorin frameworks families <framework_id>to find the correct family slug - Call
pretorin frameworks controls <framework_id> --family <family_slug>to find the correct control ID - Use the discovered ID in subsequent calls
Quick Reference
| Framework | Family Format | Control Format | Example |
|---|---|---|---|
| NIST 800-53 | access-control | ac-01 | pretorin frameworks control nist-800-53-r5 ac-02 |
| FedRAMP | access-control | ac-01 | pretorin frameworks control fedramp-moderate ac-02 |
| CMMC | access-control-level-2 | AC.L2-3.1.1 | pretorin frameworks control cmmc-l2 AC.L2-3.1.1 |
| 800-171 | access-control | 03.01.01 | pretorin frameworks control nist-800-171-r3 03.01.01 |
| SOC 2 | security | PTR-SOC2-SEC-001 | pretorin frameworks control soc2 PTR-SOC2-SEC-001 |