Design reviews,traced to controls.
Free working tools for security architects. Scope a design review or a STRIDE threat model, then trace every finding to NIST SP 800-53, CSF 2.0 and SP 800-171 Rev. 3, using NIST's own published data.
- 800-53
- Rev. 5, OSCAL 5.2.0
- CSF
- 2.0 + NIST informative references
- 800-171
- Rev. 3, 97 active requirements
- Checked
- Scale
- NTS
Sheet set: tools
Each runs in your browser. Nothing you enter is sent to a server.
Pick what the system does; get a scoped design-review checklist. Each question is traced to SP 800-53 controls, CSF 2.0 outcomes and SP 800-171 Rev. 3. Export to Markdown or CSV.
List the elements of your data-flow diagram; the worksheet generates STRIDE-per-element questions with candidate controls, flags trust-boundary crossings and exports.
Look up one control across 800-53, CSF 2.0 and 800-171 Rev. 3
Measured from the source
Counts computed from NIST's machine-readable releases, checked .
SP 800-53 base controls and enhancements in 20 families; 182 of them are withdrawn.
Active SP 800-171 Rev. 3 requirements, and the distinct SP 800-53 controls NIST lists as their sources.
CSF 2.0 subcategories, and the control-level SP 800-53 references NIST maps to them.
Sheet index: guides
| Sheet | Title |
|---|---|
| AR-101 | How to run a security architecture reviewA practical workflow for security design reviews, from scoping and diagrams to findings traced to NIST SP 800-53, CSF 2.0 and SP 800-171 controls. |
| TM-101 | STRIDE threat modeling, with a worked exampleHow to apply STRIDE per element to a data-flow diagram, with a worked example of a document upload service and candidate NIST SP 800-53 controls for each threat. |
| FW-101 | NIST SP 800-53 vs. SP 800-171 Rev. 3, measured from the source dataHow SP 800-171 Rev. 3 derives from SP 800-53, with counts computed from NIST's OSCAL releases, the source-control links, and what that means for system design. |
| FW-102 | The CSF 2.0 to SP 800-53 mapping, and how to use it in designWhat NIST's official CSF 2.0 to SP 800-53 Rev. 5.2.0 informative references contain, measured from the CPRT export, and how architects can use them without overreading. |
| CR-101 | What an IT security architect does, and what federal data says about payThe security architect role through the NICE work role and its real deliverables, with federal wage statistics and an honest note on why salary figures disagree. |
| CR-102 | Security architect certifications compared, from the issuers' own pagesISSAP, Microsoft SC-100, CompTIA SecurityX and AWS Security Specialty side by side, with prerequisites and exam details checked on issuer pages. |