If you've ever had to check code or infrastructure against a compliance framework, you know the drill: someone reads a 100-page PDF, then reads your codebase, then makes a judgment call. It's slow, inconsistent, and it can't be automated.

So I built a pipeline to fix that — for real.

The problem

CMMC Level 1 and NIST SP 800-171 Rev 2 are two of the most common compliance frameworks small defense contractors and government-adjacent companies have to meet. Both exist only as dense regulatory text. There's no official machine-readable version.

That means every compliance check is manual. Every AI coding assistant reviewing your infrastructure has zero built-in awareness of these requirements. Every CI/CD pipeline has to skip compliance checks entirely or rely on someone remembering to look.

** What I built**

A Python pipeline that:

  1. Pulls the real regulatory source data — NIST's official CPRT export for SP 800-171, and the verbatim text of 48 CFR § 52.204-21 for CMMC Level 1
  2. Normalizes it into a structured SQLite schema
  3. Generates a JSON rule for every single control, with a machine-actionable instruction attached

Here's what one rule actually looks like:

\json
{
"rule_id": "nist_sp_800-171_rev_2_3.1.1",
"framework": "NIST SP 800-171 Rev 2",
"control_id": "3.1.1",
"title": "ACCESS CONTROL — 3.1.1",
"requirement": "Limit system access to authorized users, processes acting on behalf of authorized users, and devices.",
"agent_guidance": "When generating or reviewing code/infrastructure, ensure compliance with NIST SP 800-171 Rev 2 control 3.1.1. Flag any implementation that does not satisfy: Limit system access to authorized users, processes acting on behalf of authorized users, and devices.",
"generated_at": "2026-07-15T16:42:56.026218+00:00"
}
\\

That agent_guidance field is the interesting part — it's written specifically to drop straight into an AI coding agent's system prompt as a compliance guardrail.

Three ways to actually use this

1. AI coding agent system prompt

\`python
import json

with open("nist_800-171_rules.json") as f:
rules = json.load(f)

guardrails = "\n".join(r["agent_guidance"] for r in rules)
system_prompt = f"Apply these compliance rules when writing or reviewing code:\n{guardrails}"
`\

2. CI/CD compliance gate — iterate the rules as a pipeline step, flag PRs that touch relevant systems without addressing applicable controls, use rule_id as a stable reference for tracking exceptions over time.

3. GRC platform import — most GRC tools have their own framework mappings; control_id gives you a clean join key.

What I learned building the pipeline

The hardest part wasn't the rule generation — it was source data. NIST's REST API for CPRT returns a 403 for direct automated access, so it has to be manually exported from their catalog first. And their JSON schema is genuinely inconsistent between versions — I had a bug where severity data was silently defaulting to "UNKNOWN" for weeks because CVSS v3 nests baseSeverity inside cvssData, while CVSS v2 puts it as a sibling field. Classic "the data looked fine until I actually checked it" bug.

Where this is going

I ended up with 125 rules across both frameworks — full coverage, not a sample. I've packaged the complete output (both JSON files) as a one-time license if anyone wants the finished dataset instead of building the pipeline themselves: [link]. But honestly, the more interesting part to me is the pattern itself — turning static regulatory text into something an AI agent can actually reason about, rather than a document a human has to remember to check.

Curious if anyone else has tackled compliance-as-code for other frameworks (SOC 2, ISO 27001, HIPAA) — would love to compare notes on parsing approaches in the comments.