🔄 NIST 800-53 CIS Reference Update (2026-09-13)

[github-actions]

Summary

This automated PR updates the CIS reference file showing the
latest CIS→NIST mappings.

⚠️ MANUAL ACTION REQUIRED

Review changes and update product control files accordingly:

1. Review the diff to see what changed in CIS mappings
2. Apply changes to products/{p}/controls/nist_800_53/*.yml
3. Preserve human-added rules or notes in the real files
4. Commit manual updates to the real control files in this PR

Changes

• +0/-3 lines modified in CIS reference files
• Reference files in shared/references/controls/

File Roles

File	Purpose	By
shared/references/.../{p}.yml	Ref metadata	🤖
shared/references/.../{p}/*.yml	Ref families	🤖
products/{p}/controls/nist_800_53.yml	Product metadata	👤
products/{p}/controls/nist_800_53/*.yml	Product families	👤

Details

• Triggered by: Weekly scheduled workflow
• Date: 2026-09-13 14:17:43 UTC
• OSCAL: NIST SP 800-53 Revision 5

🤖 Generated by weekly sync workflow

[github-actions]

Detailed Changes in CIS Reference Files

Changed Family Files

None

📁 Family files diff

Tip: Family files (ac.yml, au.yml, cm.yml, etc.) make it
easier to review changes by control area.

[openshift-ci]

Hi @github-actions[bot]. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[macko1]

/ok-to-test

[red-hat-konflux-kflux-prd-rh02]

All PipelineRuns for this commit have already succeeded. Use /retest <pipeline-name> to re-run a specific pipeline or /test to re-run all pipelines.

[macko1]

/retest

[red-hat-konflux-kflux-prd-rh02]

All PipelineRuns for this commit have already succeeded. Use /retest <pipeline-name> to re-run a specific pipeline or /test to re-run all pipelines.

[macko1]

/test

[openshift-ci]

@github-actions[bot]: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-openshift-platform-compliance	a830598	link	true	/test e2e-aws-openshift-platform-compliance
ci/prow/4.12-images	a830598	link	true	/test 4.12-images

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[github-actions]

🔄 Workflow Re-run Update

The CIS-NIST sync workflow ran again at 2026-09-20 14:17:32 UTC.
The reference files are still up to date with the same changes as this PR.

Automated comment from workflow run 35515937614

[ggbecker]

No additional changes are needed in the product-specific RHEL 9 NIST control files.

The three rules removed by this PR:

• file_owner_at_allow from AC-3
• group_unique_name from CM-1
• file_ownership_home_directories from CM-6

were already removed from products/rhel9/controls/nist_800_53/ in commit 0c013cc7de.

This was done to keep the RHEL 9 NIST mappings consistent with the RHEL 9 CIS profile, which explicitly excludes these rules. PR #15121 only removes the corresponding stale entries from the generated shared CIS-to-NIST reference files.

Therefore, applying additional changes to the RHEL 9 NIST control files would produce no diff. The RHEL 8 and RHEL 10 mappings remain unchanged because this exclusion is specific to RHEL 9.