A free reference,
used at your own risk.

One person, not an organization.

cyber.trackr.live is built and maintained by Robert Weber as a personal side project. There is no company behind it, no team, no SLA, and no support contract. When “I” appears on this page, that’s who it means.

Cyber Trackr is not affiliated with, endorsed by, or sponsored by the Department of Defense, DISA, NIST, or any other government agency. Treat anything you find here as a convenience layer over those agencies’ published work, not a substitute for it.

A reference desk — not advice.

The site is a browseable mirror of public DoD and NIST compliance data, plus a few helper tools (CKL viewer, plan generator, baseline heat map, search). It exists to make that material easier to find and cross-reference.

Nothing here is legal, regulatory, security, or compliance advice. Output from the plan generator is a starting draft, not an authoritative System Security Plan. The CKL viewer renders and edits checklists in your browser; the resulting files are your work, not mine. If a control, mapping, or rule on this site differs from the authoritative source, the authoritative source wins. Always.

Always go back to the source before you ship.

For decisions that touch a real ATO package, audit, or live system, verify against the official publishers:

• STIGs and SCAP — public.cyber.mil/stigs
• NIST 800-53, OSCAL, baseline catalogs — csrc.nist.gov
• FedRAMP baselines — fedramp.gov

The data on this site is redistributed unmodified and synced on a manual cadence (the footer shows the last DISA and NIST sync timestamps). Between syncs, the upstream sources may have moved on.

No accounts, no tracking, nothing to leak.

There are no user accounts on this site. There is no analytics provider tracking your visits across the web. The server logs the same kind of HTTP request data every web server logs — IP, user agent, path, status — and that’s it.

The Plan Generator and CKL Viewer keep their drafts in your browser’s localStorage. That data never leaves your device. You can clear it any time by clearing site data in your browser.

No warranty, express or implied.

The service is provided as-is and as-available, without warranty of any kind — including, without limitation, warranties of merchantability, fitness for a particular purpose, accuracy, completeness, timeliness, or non-infringement. I make a good-faith effort to keep the data current and the site working, but I make no guarantee of either.

To the maximum extent permitted by applicable law, in no event shall I be liable for any indirect, incidental, special, consequential, or punitive damages, or any loss of profits, revenue, data, or goodwill, arising out of or related to your use of (or inability to use) this site — even if I’ve been advised of the possibility of such damages.

Be a good neighbor.

• Verify before you act. Cross-check anything you pull from here against the authoritative source listed in § III before using it in an audit, ATO package, or production system.
• Don’t hammer the API. The REST API has no auth and no rate limits, but it runs on one shared box. Reasonable, polite use is welcome; scraping the entire dataset in a tight loop is not. If you need a bulk pull, the data files are also available on the GitHub repo.
• Don’t attack the site. No probing for vulnerabilities, no automated injection attempts, no traffic that’s clearly designed to break things. If you found a real security issue and want to report it, use the contact form below.
• Stay legal. If your use of the site or its data violates an applicable law or regulation in your jurisdiction, don’t use it.

The code is open. The data is public domain.

The application code that powers this site is licensed under GNU AGPL-3.0-or-later. You can read it, run it, fork it, and modify it — with the catch that if you run a modified version as a network service, you have to publish your changes under the same license. The full text is in the LICENSE file in the repo.

The compliance datasets (STIGs, SCAP, CCI, NIST 800-53, OSCAL profiles) are works of the U.S. Government, in the public domain within the United States, and redistributed here unmodified. The AGPL on the surrounding code does not apply to them. Full attributions are in NOTICE.md.

The site can change. So can these terms.

Features may be added, modified, or removed at any time. The site itself may go offline for maintenance, due to a hosting issue, or because I decide to stop running it. There’s no commitment of continuous availability.

These terms may be updated when the project changes meaningfully. The “Last updated” date at the top reflects the current revision. If you’ve been relying on the site for something material, it’s worth re-reading this page once in a while.

U.S. law, common-sense reading.

These terms are governed by the laws of the United States and the Commonwealth of Virginia, without regard to conflict-of-law principles. If any clause turns out to be unenforceable, the rest of the terms still apply.