ctrlrslv — APAC Cybersecurity Framework Resolver

What

A single HTTP surface over eleven APAC cybersecurity frameworks. Catalogs, control detail with hoisted properties and derived taxonomies, profiles, resolved profile catalogs, flat control listings, back-matter resources, and byte-identical raw passthrough in JSON, XML and YAML — all addressable through a uniform URL namespace and a universal resolver that accepts any declared OSCAL id.

Why

Compliance frameworks across the region are published as PDFs, policy pages, and the occasional spreadsheet. OSCAL exists to make control sets machine-readable, but the OSCAL conversions are scattered across half-maintained repos with inconsistent shapes, no shared namespace, and no shared query surface. ctrlrslv consolidates the available APAC OSCAL catalogs behind one API so GRC tooling, compliance engineers, and researchers can query across frameworks without re-plumbing every time.

How

Each framework is vendored from its source repo at a pinned commit SHA, recorded in per-framework PROVENANCE.json manifests. A Cloudflare Worker loads the eleven OSCAL catalogs at cold-start, builds case-insensitive indexes with a collision guard, and serves everything through a schema-first OpenAPI 3.1 surface with Swagger UI at /docs. Raw XML and YAML passthrough proxies to the pinned SHA at raw.githubusercontent.com with Cache-Control: immutable. Enriched responses hoist OSCAL properties, surface the OSCAL group and synthetic id-prefix taxonomies, and carry hypermedia links for navigation.

Who

Built by independent security and compliance engineer Baden Hughes. The API code is Apache-2.0; the framework content belongs to each originating agency and is served as-is. Unofficial. Not affiliated with, endorsed by, or supported by any listed agency. For audience: GRC engineers, security and compliance analysts, agency delivery partners, and anyone building automation against these specific frameworks.

Supported frameworks

Eleven frameworks across seven jurisdictions. fid is the URL identifier. source links to the OSCAL repo the vendored data was fetched from; the pinned commit SHA for each is in /provenance.

fid	country	title	version	profiles	source
`sg-mas-trmg`	SG	MAS Technology Risk Management Guidelines	`2021-01-18`	0	`badenh/sg-mas-trmg-oscal`
`sg-ictss-cybersecurity`	SG	ICT&SS Cybersecurity Control Catalog	`2026.03.26`	9	`badenh/sg-ictss-oscal`
`sg-ictss-im8-reform`	SG	Instruction Manual 8 Reform (legacy-UUID sibling)	`2026.03.26`	9	`badenh/sg-ictss-oscal`
`sg-ospar-2.0`	SG	ABS OSPAR v2.0	`2.0`	1	`badenh/sg-ospar2.0-oscal`
`jp-nco-cmgara-fy23`	JP	NISC Common Standards for Cybersecurity (FY2023)	`0.1.0`	1	`badenh/jp-nco-kijyun-cmgara-fy23-oscal`
`my-ncsb`	MY	National Cyber Security Baseline	`1.4`	3	`badenh/my-ncsb-oscal`
`th-ncsa-cscs`	TH	NCSC Cybersecurity Standards for Cloud (BE 2567)	`1.1`	6	`badenh/th-ncsa-be2567-oscal`
`hk-s17`	HK	S17 Baseline IT Security Policy	`8.2`	15	`badenh/hk-s17-baseline-itsecpol-oscal`
`au-aescsf`	AU	Australian Energy Sector Cyber Security Framework v2	`2`	15	`badenh/aescsf-oscal`
`au-ism`	AU	Information Security Manual	`2026.09.4`	8	`AustralianCyberSecurityCentre/ism-oscal upstream`
`nz-nzism`	NZ	New Zealand Information Security Manual	`3.9`	5	`badenh/nzism-oscal`

API samples

Full route list at api.ctrlrslv.org/docs. A few starters:

List every framework

curl https://api.ctrlrslv.org/frameworks

Get an enriched single control (flat props, families, idPrefix)

curl https://api.ctrlrslv.org/frameworks/au-ism/2026.09.4/controls/ism-principle-gov-01

Universal resolver — paste any declared id (case-insensitive)

curl https://api.ctrlrslv.org/frameworks/sg-ospar-2.0/2.0/OSPAR-AI-1

Resolved profile control list

curl https://api.ctrlrslv.org/frameworks/sg-ictss-cybersecurity/2026.03.26/profiles/high-risk-level-2/controls

Byte-identical raw OSCAL (JSON, XML, or YAML; SHA-pinned, immutable cache)

curl https://api.ctrlrslv.org/frameworks/au-aescsf/2/raw/catalog.xml
curl https://api.ctrlrslv.org/frameworks/au-aescsf/2/raw/resolved/mil-1.json

Framework metadata including identity sibling (SG ICT&SS pair)

curl https://api.ctrlrslv.org/frameworks/sg-ictss-cybersecurity

Unofficial. Not affiliated with, endorsed by, or supported by any listed agency. Validate against authoritative sources before relying on API responses for compliance decisions.