org.cispec

org.cispec is a standard set of labels for describing things your organisation tracks and manages — software, hardware, industrial control systems, cryptographic assets, evidence, access credentials, contracts, facilities, or anything else whose state affects service delivery, cost, risk, or compliance. Each label is a key-value pair: the key names a specific fact (org.cispec.owner), and the value records that fact for a specific asset.

The things you track are called Change Items (CIs). CI is a standard ITIL term; it does not refer to continuous integration.

This document is the specification. It is also the index: every term in the namespace resolves at its own address under this domain and is linked from here and from every other term that relates to it.

What this is

org.cispec.* labels are plain strings — they work in any system that can store key-value metadata: Dockerfile labels, Kubernetes annotations, container registries, CMDBs, spreadsheets, JSON documents, EDI messages. No library, no SDK, no runtime dependency on this site. Copy the label key, apply it, done.

Each label key names a specific fact. The label’s value records that fact for a specific asset. [email protected] means Alice is accountable for this asset. org.cispec.version=1.3.0 means the asset is at version 1.3.0. Validation — checking that required labels are present and values are well-formed — is handled by cimatrix.

The terms on this site form a connected set: most terms link to related terms so you can find adjacent facts quickly. “Every asset where [email protected]” is a valid query against any system storing these labels. This specification defines what the terms mean; how you query them is up to your own tooling.

Predecessor namespace

org.cispec supersedes net.matrix.*, a label namespace developed in 2016 for CMDB and container workload labelling that is no longer actively maintained. If you have existing net.matrix.* labels, the migration is a direct prefix replacement — key names and value formats are unchanged, only the prefix changes. Treat this as a breaking change (MAJOR semver bump) for any system that consumes the label namespace.

Requirement language

The key words MUST, MUST NOT, REQUIRED, SHOULD, SHOULD NOT, RECOMMENDED, MAY, and OPTIONAL are used as defined in RFC 2119. Each term page states, inline, which of these levels apply to it and in what context — there is no separate conformance document. A label set is conformant for a given context when every term marked REQUIRED for that context is present and well-formed.

Core terms are REQUIRED for Declared conformance on any Change Item regardless of type: organization, orgunit, owner, role, application, and version. Every asset gets these six labels — a server, a pharmaceutical lot, a classified document, an AI model, a facility. If a label set is missing any of them it is not conformant.

Extended terms are RECOMMENDED or OPTIONAL depending on context — they apply when the asset has the relevant characteristic. A physical asset has a location; a purely logical one does not. A CI under a formal contract has a contract-ref; most do not. Extended terms are never required for Declared conformance unless the term page says otherwise for a specific CI type.

Minting new terms

If the existing terms don’t cover a fact you need to track, use your own namespace prefix — net.example.my-term, not org.cispec.my-term. The same approach Java packages, Android application IDs, and D-Bus service names use: your domain, your prefix, your terms.

If you believe a missing fact belongs in org.cispec.* itself and would be useful across organisations, propose it. Two tests determine whether a term belongs here:

A term MUST resolve. Every org.cispec.<term> MUST be reachable via GET or HEAD over public, TLS-verified, non-split-horizon DNS at <term>.cispec.org or cispec.org/<term>/. Validation tooling (cimatrix) verifies resolution using mTLS and domain key verification at validation time, not at minting time. A term that only resolves inside a private or split-horizon DNS view is not a legitimate member of the public namespace.

A term MUST be necessary. Before proposing org.cispec.<term>, confirm both of the following:

1. The term identifies, attests, or relates to a tracked Change Item affecting IT/OT service delivery, asset management, cost accounting, or chain of custody. Terms describing facts with no bearing on a tracked, managed change — cosmetic attributes, opinions, anything that would never appear in a configuration management database — MUST NOT be minted here.
2. No existing core or extended term, used with an appropriately structured or qualified value, already expresses the same fact. A role-qualified identity (org.cispec.owner with a value like shift-supervisor:[email protected]) is reuse of an existing term, not grounds for a new one.

Apply both tests honestly before proposing a term.

What this site does, and what it doesn’t

This site defines what each label means. cimatrix checks whether a label set is present and well-formed. Neither this site nor cimatrix knows whether the values are accurate — that is the implementing organisation’s responsibility.

cimatrix is a command-line tool you run in your own pipeline. It checks that a given artefact’s org.cispec.* labels are syntactically correct, required terms are present, and term identifiers resolve over public TLS. Nothing is sent to an external service — validation runs entirely on the machine where you invoke it.

cimatrix does not reach into your CMDB, ERP, or directory. It does not know whether [email protected] is the real owner of the asset. That is your organisation’s responsibility to assert honestly. How your own systems answer “what does this label’s value actually point to right now” is out of scope for both this site and cimatrix.

Document identifiers

Each term page on this site carries its own sub-arc OID under iso.org.dod.internet.42387.2 and a UUIDv5 deterministically derived from that OID’s dotted-decimal form (namespace 6ba7b810-9dad-11d1- 80b4-00c04fd430c8, the standard DNS namespace per RFC 4122 §4.3). These identify the document defining a term, not the term’s own label value — org.cispec.owner’s page has a document OID and GUID; the string org.cispec.owner itself, as a label applied to a Change Item, does not.

The document-identifier tree is rooted at 42387.2. The table below lists every currently assigned identifier.

A new category arc is allocated only when a term genuinely does not fit any existing category — the same necessity discipline that governs minting a new term at all.

Index

The canonical, single-page index of every currently assigned document identifier:

| location | 1.3.6.1.4.1.42387.2.7 | 1192ce5e-1a38-5939-b4c8-be1263cb37fc | | classification | 1.3.6.1.4.1.42387.2.8 | ff8c27e8-562e-5b8d-a887-ebb1daeeb039 | | retention | 1.3.6.1.4.1.42387.2.8.1 | b87b96e5-f583-5c4e-8cfc-49b0bb9739a7 | | boundary | 1.3.6.1.4.1.42387.2.8.2 | 1eaea5b2-5b84-5829-ae8b-850ec19d0ff0 | | sla | 1.3.6.1.4.1.42387.2.9 | 78ee1d87-4cab-5636-a51d-60b9c45ee3f5 | | commonname | 1.3.6.1.4.1.42387.2.9.1 | 4b7c32ea-11f0-5afa-bac9-08ee71694c37 | | asset-tag | 1.3.6.1.4.1.42387.2.6.2.1 | f5bc9f9b-9561-5f8d-811c-33e5ce0ade50 | | manufacturer | 1.3.6.1.4.1.42387.2.6.2.2 | d957a085-ddfe-55e3-a34f-6e886194e470 | | make | 1.3.6.1.4.1.42387.2.6.2.3 | 8a7106c6-dcca-5f76-b59d-7bd2f391bb75 | | model | 1.3.6.1.4.1.42387.2.6.2.4 | 6ddca6e5-bb57-505c-b995-70a5b05ff783 |

| cost | 1.3.6.1.4.1.42387.2.3.2 | 9d633303-4b6e-5c01-bbc0-2554769f3aa5 | | unit-cost | 1.3.6.1.4.1.42387.2.3.3 | 13b2c028-55ec-59a4-b274-c01ddddc33cf | | billing-model | 1.3.6.1.4.1.42387.2.3.4 | dbee024f-8cc0-52d6-b300-d1aac6b07372 | | depreciation | 1.3.6.1.4.1.42387.2.3.5 | 0e456549-e677-5ad3-8c7f-49210439cb48 | | contract-ref | 1.3.6.1.4.1.42387.2.3.6 | bc197921-a7a6-5d33-90f2-763de7e0eaa3 | | usage | 1.3.6.1.4.1.42387.2.3.7 | c8c1a366-27f8-56fc-991c-0a4f2c9b383d | | vendor | 1.3.6.1.4.1.42387.2.3.8 | b57413eb-ea61-5ce2-a9a9-274832e2eea0 | | expiry | 1.3.6.1.4.1.42387.2.4.3 | 9714b5bf-3536-5fc9-a53a-b8f0cf1a65db | | acquired | 1.3.6.1.4.1.42387.2.4.4 | b07863b7-ed3e-5f79-9160-67efc0ebfe86 |

| serial-number | 1.3.6.1.4.1.42387.2.6.2.5 | a7746230-ebc5-5ddf-830d-60250cbb8799 | | net-type | 1.3.6.1.4.1.42387.2.6.4.1 | 908d6b60-25a3-5e42-b8f6-626a86445abf | | ip-address | 1.3.6.1.4.1.42387.2.6.4.2 | fd4da795-a1a7-5415-a850-6c4d42ef644e | | mac-address | 1.3.6.1.4.1.42387.2.6.4.3 | 025348b7-866f-57af-9f56-b8dbb4e5a43e | | case-id | 1.3.6.1.4.1.42387.2.6.5.1 | 354202bb-76bc-5709-9310-7e54cc05f03e | | collection-method | 1.3.6.1.4.1.42387.2.6.5.2 | a97c5cfd-a9eb-5811-84b2-607d3e8abc10 | | assurance-level | 1.3.6.1.4.1.42387.2.6.6.1 | b21848ce-8791-5472-a3c0-2bb4074ac050 | | key-type | 1.3.6.1.4.1.42387.2.6.6.2 | 936e9ec5-0d4b-5e02-bac2-4e6af6f3ab08 | | facility-class | 1.3.6.1.4.1.42387.2.6.7.1 | 62053022-2d93-5d38-ad74-62a22699c40f | | capacity | 1.3.6.1.4.1.42387.2.6.7.2 | d2cfe509-b432-5f4d-844d-ae3c8df8c79c | | contract-type | 1.3.6.1.4.1.42387.2.6.8.1 | 813f67e2-6932-584a-993d-3d64e6a80c78 | | counterparty | 1.3.6.1.4.1.42387.2.6.8.2 | bfb13628-0034-501b-8404-f05df058bfbf | | algorithm | 1.3.6.1.4.1.42387.2.6.9.1 | d7fc8fc7-41b8-5365-b370-983eb3ca6cd4 | | key-length | 1.3.6.1.4.1.42387.2.6.9.2 | cb348b85-ab41-5808-bf2e-6b3dd60a2706 |

| fqdn | 1.3.6.1.4.1.42387.2.6.4.4 | e39b64b6-6144-5939-9cc1-aa8a91fd796b | | exposure | 1.3.6.1.4.1.42387.2.8.3 | 9aeb523a-c902-5fef-9398-709b424208ff | | scan-policy (experimental) | 1.3.6.1.4.1.42387.2.8.4 | 14e4a997-48d2-5319-8308-7ab97eadf2d4 | | config-baseline (experimental) | 1.3.6.1.4.1.42387.2.8.5 | fe80be18-0f77-57cd-b57d-29cc26688589 |

Retired arcs: .2.6.1.1 (application, now core at .2.1.4), .2.6.1.2 (role, now core at .2.1.3), .2.6.3 (purdue-level, folded into environment as qualified value).

All CI-type extension sub-arcs are now populated: .2.6.2.* hardware, .2.6.4.* network, .2.6.5.* evidence extended, .2.6.6.* access/credential, .2.6.7.* facility, .2.6.8.* contract, .2.6.9.* crypto. Physical category extends .2.7.*; governance/compliance .2.8.*; service management .2.9.*.

Versioning

This specification follows semver 2.0.

• MAJOR — a term is renamed, removed, or its semantics change in a way that breaks existing conformant labels.
• MINOR — a new term is added, or a new requirement-level annotation is introduced.
• PATCH — editorial corrections and clarifications only.

The current specification version is 1.0. A label set SHOULD record the specification version it was authored against using org.cispec.specversion.

OSCAL interoperability

FedRAMP RFC-0024 (January 2026) mandates machine-readable authorization packages in OSCAL format for all FedRAMP providers, with an initial deadline of September 30, 2026. org.cispec terms map directly onto OSCAL’s component inventory model:

This mapping is non-normative — neither this specification nor OSCAL requires the other. It is provided to assist FedRAMP implementors generating OSCAL-based System Security Plans and component inventory from org.cispec-labelled assets.

Specification status

The coloured strip on the left edge of every page signals this specification’s current position in the adoption lifecycle. Status and version are independent — a version number tracks content changes to the spec; status tracks where the spec sits in real-world adoption. A spec at 3.2.1 can still be Draft; a spec at 0.9.4 can be Adopted.

Gate conditions for advancement — based on implementation evidence, not version numbers, following the same principle as RFC 6410:

• Draft → Stable: spec published with at least one reference implementation. cimatrix is that implementation for org.cispec.
• Stable → Adopted: two independent implementations confirmed in production use outside Da Planet Security’s own tooling.

Current status: Draft (v1.0).

Licence

BSD-2-Clause. SPDX-License-Identifier: BSD-2-Clause. IANA PEN: 42387. D&B DUNS: 039-271-257.