Control ID Formats
Correct ID formatting is critical. The Pretorin API returns errors on malformed IDs. When unsure, discover IDs first with pretorin frameworks families <id> or pretorin frameworks controls <id>.
NIST 800-53 Rev 5 / FedRAMP
Framework IDs: nist-800-53-r5, fedramp-low, fedramp-moderate, fedramp-high
Family IDs
Family IDs are lowercase slugs, not short codes:
| Correct | Incorrect |
|---|---|
access-control | ac |
audit-and-accountability | au |
identification-and-authentication | ia |
system-and-communications-protection | sc |
configuration-management | cm |
incident-response | ir |
risk-assessment | ra |
Control IDs
Control IDs are zero-padded with a hyphen:
| Correct | Incorrect |
|---|---|
ac-01 | ac-1, AC-1, ac1 |
ac-02 | ac-2, AC-2, ac2 |
au-02 | au-2, AU-2 |
sc-07 | sc-7, SC-7 |
Enhancement IDs append a dot-suffix or parenthetical suffix:
| Format | Example |
|---|---|
| Dot notation | ac-02.1 |
| Parenthetical | ac-02(1) |
CMMC 2.0
Framework IDs: cmmc-l1, cmmc-l2, cmmc-l3
Family IDs
CMMC family IDs include a level suffix:
| Correct | Incorrect |
|---|---|
access-control-level-1 | access-control, ac |
access-control-level-2 | access-control, ac-l2 |
incident-response-level-2 | incident-response, ir |
system-and-communications-protection-level-3 | sc, sc-l3 |
Control IDs
CMMC control IDs use dotted notation with a level prefix and are case-sensitive:
| Correct | Incorrect |
|---|---|
AC.L2-3.1.1 | ac-01, 3.1.1 |
SC.L3-3.13.2 | sc-07, 3.13.2 |
AC.L1-3.1.22 | ac.l1-3.1.22 |
Use uppercase for the family prefix (e.g., AC, not ac).
NIST 800-171 Rev 3
Framework ID: nist-800-171-r3
Family IDs
Family IDs use the same lowercase slug convention as NIST 800-53:
| Correct | Incorrect |
|---|---|
access-control | ac, 3.1 |
incident-response | ir, 3.6 |
identification-and-authentication | ia, 3.5 |
Control IDs
Control IDs use dotted notation with leading zeros:
| Correct | Incorrect |
|---|---|
03.01.01 | 3.1.1, ac-01 |
03.01.02 | 3.1.2, ac-02 |
03.13.01 | 3.13.1, sc-01 |
SOC 2
Framework ID: soc2
Pretorin’s SOC 2 catalog is an expert-reviewed control register organized by trust-services domain, not by the raw Common Criteria codes.
Family IDs
SOC 2 family IDs are lowercase domain slugs (one per trust-services domain plus an AI-controls domain):
| Correct | Incorrect |
|---|---|
security | CC6, common-criteria, cc |
availability | A1, avail |
confidentiality | C1, conf |
privacy | P1 |
processing-integrity | PI1, processing_integrity |
ai-controls | AI, ai |
Control IDs
SOC 2 control IDs use a prefixed, zero-padded format — PTR-SOC2-<DOMAIN>-NNN, where the domain code is uppercase and the number is three digits:
| Correct | Incorrect |
|---|---|
PTR-SOC2-SEC-001 | CC6.1, sec-1, 6.1 |
PTR-SOC2-AVL-004 | A1.4, avl-4 |
PTR-SOC2-AI-016 | AI.16, ai-16 |
Domain codes: SEC (security), AVL (availability), CONF (confidentiality), PRIV (privacy), PI (processing-integrity), AI (ai-controls). SOC 2 IDs are case-sensitive — keep the prefix and domain code uppercase. When unsure, discover the exact IDs with pretorin frameworks controls soc2 --family security.
Auto-Normalization
The CLI and MCP tools automatically normalize NIST 800-53 and FedRAMP control IDs: uppercase is lowered and single-digit numbers are zero-padded. For example, AC-2 becomes ac-02 and SC-7.1 becomes sc-07.1. CMMC, NIST 800-171, and SOC 2 IDs are passed through unchanged — use the exact format shown above.
Discovery Workflow
When a user provides an informal control reference (e.g., “AC-2” or “access control”):
- Call
pretorin frameworks families <framework_id>to find the correct family slug - Call
pretorin frameworks controls <framework_id> --family <family_slug>to find the correct control ID - Use the discovered ID in subsequent calls
Quick Reference
| Framework | Family Format | Control Format | Example |
|---|---|---|---|
| NIST 800-53 | access-control | ac-01 | pretorin frameworks control nist-800-53-r5 ac-02 |
| FedRAMP | access-control | ac-01 | pretorin frameworks control fedramp-moderate ac-02 |
| CMMC | access-control-level-2 | AC.L2-3.1.1 | pretorin frameworks control cmmc-l2 AC.L2-3.1.1 |
| 800-171 | access-control | 03.01.01 | pretorin frameworks control nist-800-171-r3 03.01.01 |
| SOC 2 | security | PTR-SOC2-SEC-001 | pretorin frameworks control soc2 PTR-SOC2-SEC-001 |