CCI Explorer

Search a Control Correlation Identifier and follow it in three directions: to the controls it satisfies, to the CCIs that share those controls, and to the STIG and SRG findings it sits inside.

5149 CCIs 3847 mapped to Rev 5 734 Rev 4 only 337 in a published STIG or SRG CCI List version 2026-07-14

CCI number

Any form of the number works: the full identifier, the six digit sequence, or just the number. Leave the box empty to browse the list.

Try:

Loading the CCI list...

The explorer searches the CCI list in your browser, so it needs scripting on. The underlying data is /cci-index.json, built from the DISA CCI List, the NIST SP 800-53 Rev 5 catalog and the nine DISA benchmarks published on this site.

Where this comes from

QUOTED: every CCI definition, its status, type, contributor and publication date, and the NIST reference strings are taken from the DISA CCI List (5149 entries, version 2026-07-14). The STIG findings are taken from the DISA XCCDF benchmarks published on this site.
DERIVED: the "related CCIs" grouping is computed by this site. Two CCIs are related when they share a NIST SP 800-53 control, using Rev 5 references where a CCI has them and falling back to Rev 4 where it does not. The first tier is an exact match on the control; the second widens that to the same base control across enhancements. It is a reading aid, not part of the CCI list.
DERIVED: the Rev 5 control titles shown next to each mapping come from the NIST SP 800-53 Rev 5 catalog, not from the CCI list itself.

Benchmarks searched: AAA Services SRG, Application Security and Development STIG, Application Server SRG, Database SRG, Firewall SRG, General Application (GAPP) SRG, General Purpose Operating System SRG, Red Hat Enterprise Linux 10 STIG, Web Server SRG.