Downloads, OSCAL baseline

The Pavois control catalogue is published as OSCAL 1.1.2, the NIST format CIS and NIST adopt, so any OSCAL-aware GRC tool can consume the baseline directly. Everything here is generated by pavois oscal from the single source (docs/reference/baseline.yml + rules.yml) and versioned.

Baseline

• Name, Pavois Effective-Configuration Hardening Baseline
• Version, 0.2.0 · OSCAL 1.1.2
• Versioning, semantic: MAJOR = ids removed/renamed, MINOR = controls or mappings added, PATCH = fixes (tracked in the CHANGELOG).

Catalog

Every control grouped by domain, each carrying its evidence type (method), the qualified verdict (proves-running / proves-persistent / proves-reboot-survivable), the real effective check, per-OS CIS/STIG numbers and norm links:

• pavois-catalog.json, the full catalogue (~2.0 MB)
• SHA-256 checksum, verify the download before trusting it

Per-OS profiles

One profile per supported OS (selects the applicable controls):

Debian 12 · Debian 13 · Fedora · RHEL 10 / Rocky 10 / AlmaLinux 10 · RHEL 8 / Rocky 8 / AlmaLinux 8 · RHEL 9 / Rocky 9 / AlmaLinux 9 · Ubuntu 22.04 · Ubuntu 24.04 · Ubuntu 26.04

How to consume it

Import the catalog, and the profile for your OS, into any OSCAL tool (e.g. intuitem/ciso-assistant) to project your framework requirements onto the Pavois controls. Always check the published SHA-256 first.

What's not in this bundle yet

This is the catalog + profiles, the standard. An OSCAL assessment-results export (a specific scan's findings rendered as OSCAL, audit-ready) is on the roadmap. Today a scan exports JSON / SARIF / JUnit / HTML / CSV, see Evidence & exports, and the catalog already carries the evidence-type and verdict props, so a scan's results can be tied back to it.