# Source catalog

<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->

184 authoritative sources, mapped to 150 skills. Each skill that has any carries its own list at `references/sources.md` inside the skill, which is where an agent reads it while answering.

**References, never copies.** The catalog holds a URL and a judgment about it, never source material. That is what keeps it live — a pointer to a regulator's site is right the moment the rule changes, and a snapshot is wrong the day after it is taken.

## What you may do with it

**125 of 184 are quotable**, with attribution where the license asks for it. The rest are free to read and not free to reproduce, which is the single most useful thing this catalog records — most of what a professional must cite is not open.

| License | Sources | What an agent may do |
|---|---|---|
| Public domain (US government) | 92 | Quote freely |
| Public domain | 5 | Quote freely |
| CC BY | 8 | Quote with attribution |
| Open data | 1 | Use the data; read the terms before redistributing |
| Free to use with attribution | 19 | Quote with the publisher's required credit |
| CC BY-SA (share-alike) | 3 | Quote with attribution; do not fold into this repository |
| Free to read, all rights reserved | 46 | **Read and cite only. Never reproduce.** |
| Free behind an account | 5 | **Cite it; the user fetches it.** |
| Sold | 5 | **Cite the identifier only, never the text.** |

## By subject

### Data and workforce

| Source | Publisher | License | Skills |
|---|---|---|---|
| [29 CFR Part 1607 — Uniform Guidelines on Employee Selection Procedures](https://www.ecfr.gov/current/title-29/subtitle-B/chapter-XIV/part-1607) | US Equal Employment Opportunity Commission | Public domain (US government) | `data-analytics:ai-ml-governance`, `people:hiring-and-interviewing`, `people:performance-management` |
| [29 CFR Part 541 — exemption regulations](https://www.ecfr.gov/current/title-29/subtitle-B/chapter-V/subchapter-A/part-541) | US Department of Labor, Wage and Hour Division | Public domain (US government) | `people:compensation-and-leveling`, `people:employment-compliance`, `people:org-design` |
| [29 CFR Part 825 — Family and Medical Leave Act regulations](https://www.ecfr.gov/current/title-29/subtitle-B/chapter-V/subchapter-C/part-825) | US Department of Labor, Wage and Hour Division | Public domain (US government) | `people:benefits-and-leave`, `people:employment-compliance` |
| [48 CFR Chapter 99 — Cost Accounting Standards](https://www.ecfr.gov/current/title-48/chapter-99) | Cost Accounting Standards Board | Public domain (US government) | `finance:cost-accounting` |
| [Apache Iceberg table specification](https://iceberg.apache.org/spec/) | Apache Software Foundation | Free to use with attribution | `data-analytics:data-engineering`, `data-analytics:data-modeling` |
| [Apache Parquet file format specification](https://parquet.apache.org/docs/file-format/) | Apache Software Foundation | Free to use with attribution | `data-analytics:data-engineering` |
| [Artificial Intelligence and the ADA](https://www.eeoc.gov/eeoc-disability-related-resources/artificial-intelligence-and-ada) | US Equal Employment Opportunity Commission | Public domain (US government) | `data-analytics:ai-ml-governance`, `people:hiring-and-interviewing` |
| [BLS Handbook of Methods](https://www.bls.gov/opub/hom/) | US Bureau of Labor Statistics | Public domain (US government) | `data-analytics:quantitative-analysis`, `people:workforce-planning` |
| [Data Catalog Vocabulary](https://www.w3.org/TR/vocab-dcat-3/) | World Wide Web Consortium | Free to read, all rights reserved | `data-analytics:chief-data-officer`, `data-analytics:data-engineering` |
| [ERISA — laws and regulations](https://www.dol.gov/agencies/ebsa/laws-and-regulations/laws/erisa) | US Department of Labor, Employee Benefits Security Administration | Public domain (US government) | `people:benefits-and-leave` |
| [FIPS 140-3: Security Requirements for Cryptographic Modules](https://csrc.nist.gov/pubs/fips/140-3/final) | NIST | Public domain (US government) | `security:data-protection-and-encryption` |
| [Federal Rules of Civil Procedure](https://www.uscourts.gov/forms-rules/current-rules-practice-procedure/federal-rules-civil-procedure) | Administrative Office of the US Courts | Public domain (US government) | `legal-risk:disputes-and-legal-holds` |
| [General Records Schedules](https://www.archives.gov/records-mgmt/grs) | US National Archives and Records Administration | Public domain (US government) | `data-analytics:chief-data-officer`, `legal-risk:disputes-and-legal-holds` |
| [Handbook for Employers M-274: guidance for completing Form I-9](https://www.uscis.gov/i-9-central/form-i-9-resources/handbook-for-employers-m-274) | US Citizenship and Immigration Services | Public domain (US government) | `people:employment-compliance`, `people:onboarding-and-offboarding` |
| [IRS Publication 15-B: Employer's Tax Guide to Fringe Benefits](https://www.irs.gov/pub/irs-pdf/p15b.pdf) | US Internal Revenue Service | Public domain (US government) | `finance:tax`, `people:benefits-and-leave` |
| [ISO/IEC 42001 — AI management systems](https://www.iso.org/standard/42001.html) | ISO | Sold | `data-analytics:ai-ml-governance` |
| [Interagency Guidance on Leveraged Lending, SR 13-3](https://www.federalreserve.gov/supervisionreg/srletters/sr1303.htm) | Board of Governors of the Federal Reserve System | Public domain (US government) | `finance:capital-structure-and-covenants` |
| [NIST AI 600-1: Generative AI Profile](https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence) | NIST | Public domain (US government) | `data-analytics:ai-ml-governance`, `executive:ai-research-analyst` |
| [NIST AI RMF Playbook](https://airc.nist.gov/airmf-resources/playbook/) | NIST | Public domain (US government) | `data-analytics:ai-ml-governance` |
| [NIST AI Risk Management Framework, AI 100-1](https://www.nist.gov/itl/ai-risk-management-framework) | NIST | Public domain (US government) | `data-analytics:ai-ml-governance`, `data-analytics:chief-data-officer`, `executive:ai-research-analyst` |
| [NIST SP 800-57 Part 1: Recommendation for Key Management](https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final) | NIST | Public domain (US government) | `security:data-protection-and-encryption` |
| [NIST SP 800-92: Guide to Computer Security Log Management](https://csrc.nist.gov/pubs/sp/800/92/final) | NIST | Public domain (US government) | `security:detection-and-monitoring` |
| [NIST/SEMATECH e-Handbook of Statistical Methods](https://www.itl.nist.gov/div898/handbook/) | NIST | Public domain (US government) | `data-analytics:quantitative-analysis` |
| [NYSE Listed Company Manual](https://nyse.wolterskluwer.cloud/listed-company-manual) | New York Stock Exchange | Free to read, all rights reserved | `executive:fundraising-and-investor-relations`, `legal-risk:corporate-governance` |
| [O*NET database](https://www.onetcenter.org/database.html) | National Center for O*NET Development, US Department of Labor | CC BY | `people:learning-and-development`, `people:org-design`, `people:workforce-planning` |
| [OECD Recommendation of the Council on Artificial Intelligence](https://legalinstruments.oecd.org/en/instruments/OECD-LEGAL-0449) | OECD | Free to use with attribution | `data-analytics:ai-ml-governance` |
| [OpenLineage object model](https://openlineage.io/docs/spec/object-model/) | LF AI and Data Foundation | Free to use with attribution | `data-analytics:chief-data-officer`, `data-analytics:data-engineering` |
| [Shapes Constraint Language](https://www.w3.org/TR/shacl/) | World Wide Web Consortium | Free to read, all rights reserved | `data-analytics:data-engineering`, `data-analytics:data-modeling` |
| [Statistical Quality Standards](https://www.census.gov/about/policies/quality/standards.html) | US Census Bureau | Public domain (US government) | `data-analytics:business-intelligence`, `data-analytics:quantitative-analysis` |
| [The Sedona Principles and Commentary on Legal Holds](https://www.thesedonaconference.org/publications) | The Sedona Conference | Free to read, all rights reserved | `legal-risk:disputes-and-legal-holds` |

### Education

| Source | Publisher | License | Skills |
|---|---|---|---|
| [C3 Framework for Social Studies State Standards](https://www.socialstudies.org/standards/c3) | National Council for the Social Studies | Free to read, all rights reserved | `education:standards-alignment` |
| [Common Core State Standards — English Language Arts and Literacy](https://www.thecorestandards.org/ELA-Literacy/) | NGA Center for Best Practices & CCSSO | Free to use with attribution | `education:learning-materials-design`, `education:standards-alignment` |
| [Common Core State Standards — Mathematics](https://www.thecorestandards.org/Math/) | NGA Center for Best Practices & CCSSO | Free to use with attribution | `education:assessment-design`, `education:standards-alignment` |
| [DocsTeach](https://www.docsteach.org/) | US National Archives and Records Administration | Public domain (US government) | `education:learning-materials-design` |
| [Head Start Early Learning Outcomes Framework, birth to five](https://eclkc.ohs.acf.hhs.gov/interactive-head-start-early-learning-outcomes-framework-ages-birth-five) | US Department of Health and Human Services, Office of Head Start | Public domain (US government) | `education:early-childhood-practice`, `education:standards-alignment` |
| [International Literacy Association position statements and briefs](https://www.literacyworldwide.org/get-resources) | International Literacy Association | Free to read, all rights reserved | `education:assessment-design`, `education:learning-materials-design` |
| [Library of Congress classroom materials](https://www.loc.gov/classroom-materials/) | Library of Congress | Public domain (US government) | `education:learning-materials-design` |
| [NAEYC position statements, including Developmentally Appropriate Practice](https://www.naeyc.org/resources/position-statements) | National Association for the Education of Young Children | Free to read, all rights reserved | `education:early-childhood-practice`, `education:learning-materials-design` |
| [NCTM Principles and Standards and position statements](https://www.nctm.org/standards-and-positions/principles-and-standards/) | National Council of Teachers of Mathematics | Free to read, all rights reserved | `education:assessment-design`, `education:learning-materials-design` |
| [NGSS appendices — practices, crosscutting concepts, core ideas](https://www.nextgenscience.org/resources/ngss-appendices) | NGSS Lead States / Achieve | Free to read, all rights reserved | `education:standards-alignment` |
| [NSTA official positions](https://www.nsta.org/nstas-official-positions) | National Science Teaching Association | Free to read, all rights reserved | `education:early-childhood-practice`, `education:standards-alignment` |
| [Next Generation Science Standards](https://www.nextgenscience.org/search-standards) | NGSS Lead States / Achieve | Free to read, all rights reserved | `education:assessment-design`, `education:standards-alignment` |
| [Standards for Mathematical Practice](https://www.thecorestandards.org/Math/Practice/) | NGA Center for Best Practices & CCSSO | Free to use with attribution | `education:assessment-design`, `education:standards-alignment` |

### Finance and tax

| Source | Publisher | License | Skills |
|---|---|---|---|
| [Applicable Federal Rates](https://www.irs.gov/applicable-federal-rates) | US Internal Revenue Service | Public domain (US government) | `finance:tax`, `finance:treasury-and-liquidity` |
| [COSO Internal Control — Integrated Framework](https://www.coso.org/guidance-on-ic) | Committee of Sponsoring Organizations of the Treadway Commission | Sold | `finance:internal-controls-and-audit`, `legal-risk:enterprise-risk` |
| [Daily Treasury Par Yield Curve Rates](https://home.treasury.gov/interest-rates-data-csv-archive) | US Department of the Treasury | Public domain (US government) | `finance:capital-allocation`, `finance:financial-modeling`, `finance:treasury-and-liquidity` |
| [EDGAR full-text search and submissions API](https://www.sec.gov/edgar/search-and-access) | US Securities and Exchange Commission | Public domain (US government) | `corporate-strategy:mergers-and-acquisitions`, `finance:financial-reporting-and-close`, `finance:financial-statement-analysis` |
| [FASB Accounting Standards Codification](https://asc.fasb.org/) | Financial Accounting Standards Board | Free behind an account | `finance:chief-financial-officer`, `finance:financial-reporting-and-close`, `finance:revenue-recognition`, `revenue:pricing-and-packaging`, `revenue:revenue-operations` |
| [FRED — Federal Reserve Economic Data](https://fred.stlouisfed.org/) | Federal Reserve Bank of St. Louis | Open data | `finance:budgeting-and-forecasting`, `finance:financial-modeling`, `finance:treasury-and-liquidity` |
| [IFRS Accounting Standards](https://www.ifrs.org/issued-standards/list-of-standards/) | IFRS Foundation | Free behind an account | `finance:financial-reporting-and-close`, `finance:revenue-recognition` |
| [IRS forms, instructions and publications](https://www.irs.gov/forms-instructions) | US Internal Revenue Service | Public domain (US government) | `finance:tax`, `people:payroll-operations` |
| [Internal Revenue Bulletin](https://www.irs.gov/irb) | US Internal Revenue Service | Public domain (US government) | `finance:chief-financial-officer`, `finance:tax` |
| [PCAOB auditing standards](https://pcaobus.org/oversight/standards/auditing-standards) | Public Company Accounting Oversight Board | Free to read, all rights reserved | `finance:internal-controls-and-audit` |
| [State tax agency directory](https://taxadmin.org/state-tax-agencies/) | Federation of Tax Administrators | Free to read, all rights reserved | `finance:tax` |

### Legal and employment

| Source | Publisher | License | Skills |
|---|---|---|---|
| [California Consumer Privacy Act — Attorney General](https://oag.ca.gov/privacy/ccpa) | California Office of the Attorney General | Public domain | `data-analytics:data-governance`, `legal-risk:privacy-and-data-protection` |
| [Consolidated State Minimum Wage and Overtime tables](https://www.dol.gov/agencies/whd/state/minimum-wage/history) | US Department of Labor | Public domain (US government) | `people:compensation-and-leveling`, `people:employment-compliance`, `people:payroll-operations` |
| [EEOC Laws, Regulations, Guidance and MOUs](https://www.eeoc.gov/laws-guidance) | US Equal Employment Opportunity Commission | Public domain (US government) | `people:employee-relations`, `people:employment-compliance`, `people:hiring-and-interviewing` |
| [Electronic Code of Federal Regulations](https://www.ecfr.gov/) | US Government Publishing Office / NARA | Public domain (US government) | `legal-risk:chief-legal-and-risk-officer`, `legal-risk:regulatory-compliance` |
| [European Data Protection Board guidelines and recommendations](https://www.edpb.europa.eu/our-work-tools/general-guidance/guidelines-recommendations-best-practices_en) | EDPB | Free to use with attribution | `data-analytics:data-governance`, `legal-risk:privacy-and-data-protection` |
| [Legal Information Institute](https://www.law.cornell.edu/) | Cornell Law School | Free to read, all rights reserved | `legal-risk:chief-legal-and-risk-officer`, `legal-risk:contract-review`, `legal-risk:regulatory-compliance` |
| [National Labor Relations Board — decisions and guidance](https://www.nlrb.gov/cases-decisions) | NLRB | Public domain (US government) | `people:employee-relations`, `people:employment-compliance` |
| [OSHA law and regulations](https://www.osha.gov/laws-regs) | US Occupational Safety and Health Administration | Public domain (US government) | `legal-risk:regulatory-compliance`, `operations:business-continuity-and-resilience` |
| [Regulation (EU) 2016/679 — GDPR](https://eur-lex.europa.eu/eli/reg/2016/679/oj) | Publications Office of the European Union | Free to use with attribution | `data-analytics:data-governance`, `legal-risk:privacy-and-data-protection`, `legal-risk:regulatory-compliance` |
| [SPDX License List](https://spdx.org/licenses/) | The Linux Foundation | CC BY | `legal-risk:intellectual-property`, `technology:release-and-deployment` |
| [State Labor Offices directory](https://www.dol.gov/agencies/whd/state/contacts) | US Department of Labor | Public domain (US government) | `people:employment-compliance`, `people:payroll-operations` |
| [USPTO search and guidance](https://www.uspto.gov/) | US Patent and Trademark Office | Public domain (US government) | `legal-risk:intellectual-property` |
| [United States Code](https://uscode.house.gov/) | Office of the Law Revision Counsel, US House of Representatives | Public domain (US government) | `legal-risk:chief-legal-and-risk-officer`, `legal-risk:regulatory-compliance` |
| [Wage and Hour Division](https://www.dol.gov/agencies/whd) | US Department of Labor | Public domain (US government) | `people:chief-human-resources-officer`, `people:employment-compliance`, `people:payroll-operations` |
| [govinfo](https://www.govinfo.gov/) | US Government Publishing Office | Public domain (US government) | `legal-risk:regulatory-compliance` |

### Marketing and advertising

| Source | Publisher | License | Skills |
|---|---|---|---|
| [.com Disclosures: How to Make Effective Disclosures in Digital Advertising](https://www.ftc.gov/business-guidance/resources/com-disclosures-how-make-effective-disclosures-digital-advertising) | US Federal Trade Commission | Public domain (US government) | `demand-generation:landing-page-cro-expert`, `demand-generation:lead-capture`, `demand-generation:paid-advertising`, `marketing:marketing-copywriting` |
| [ASA Statement on Statistical Significance and P-Values](https://www.amstat.org/asa/files/pdfs/p-valuestatement.pdf) | American Statistical Association | Free to read, all rights reserved | `demand-generation:experimentation`, `demand-generation:landing-page-cro-expert`, `demand-generation:marketing-analytics` |
| [App Store Review Guidelines](https://developer.apple.com/app-store/review/guidelines/) | Apple | Free to read, all rights reserved | `demand-generation:app-store-optimization`, `marketing:product-launch`, `product:chief-product-officer`, `revenue:pricing-and-packaging` |
| [CAN-SPAM Act: A Compliance Guide for Business](https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business) | US Federal Trade Commission | Public domain (US government) | `demand-generation:account-based-marketing`, `demand-generation:lead-capture`, `demand-generation:lifecycle-messaging`, `marketing:newsletter-writer`, `revenue:outbound-prospecting` |
| [Canada's Anti-Spam Legislation, S.C. 2010 c. 23](https://laws-lois.justice.gc.ca/eng/acts/E-1.6/index.html) | Department of Justice Canada | Free to use with attribution | `demand-generation:lead-capture`, `demand-generation:lifecycle-messaging`, `marketing:newsletter-writer`, `revenue:outbound-prospecting` |
| [Children's Online Privacy Protection Rule, 16 CFR 312](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-312) | US Federal Trade Commission | Public domain (US government) | `demand-generation:app-store-optimization`, `demand-generation:lead-capture`, `demand-generation:paid-advertising`, `marketing:behavioral-marketing`, `product:product-requirements` |
| [Delivery restrictions and telephone solicitation rules, 47 CFR 64.1200](https://www.ecfr.gov/current/title-47/chapter-I/subchapter-B/part-64/subpart-L/section-64.1200) | US Federal Communications Commission | Public domain (US government) | `demand-generation:lead-capture`, `demand-generation:lifecycle-messaging`, `marketing:behavioral-marketing`, `revenue:outbound-prospecting` |
| [Disclosures 101 for Social Media Influencers](https://www.ftc.gov/business-guidance/resources/disclosures-101-social-media-influencers) | US Federal Trade Commission | Public domain (US government) | `marketing:partnership-marketing`, `marketing:social-post-craft`, `marketing:video-content`, `marketing:youtube-producer` |
| [FTC Business Guidance: Advertising and Marketing](https://www.ftc.gov/business-guidance/advertising-marketing) | US Federal Trade Commission | Public domain (US government) | `marketing:chief-marketing-officer`, `marketing:marketing-campaign-planner`, `marketing:marketing-planning` |
| [Google Play Developer Program Policy](https://play.google.com/about/developer-content-policy/) | Google | Free to read, all rights reserved | `demand-generation:app-store-optimization`, `marketing:product-launch` |
| [Google crawlers and user-triggered fetchers](https://developers.google.com/search/docs/crawling-indexing/overview-google-crawlers) | Google | CC BY | `demand-generation:ai-search-optimization`, `demand-generation:programmatic-seo`, `demand-generation:seo-strategy` |
| [Guide to PECR: cookies and similar technologies](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/cookies-and-similar-technologies/) | UK Information Commissioner's Office | Free to use with attribution | `demand-generation:experimentation`, `demand-generation:marketing-analytics`, `marketing:behavioral-marketing` |
| [Guidelines 05/2020 on consent under Regulation 2016/679](https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-052020-consent-under-regulation-2016679_en) | European Data Protection Board | Free to use with attribution | `demand-generation:landing-page-cro-expert`, `demand-generation:lead-capture`, `demand-generation:marketing-analytics`, `marketing:behavioral-marketing` |
| [Guides Against Deceptive Pricing, 16 CFR 233](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-B/part-233) | US Federal Trade Commission | Public domain (US government) | `demand-generation:landing-page-cro-expert`, `demand-generation:paid-advertising`, `marketing:marketing-copywriting`, `revenue:pricing-and-packaging` |
| [Guides Concerning the Use of Endorsements and Testimonials in Advertising, 16 CFR 255](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-B/part-255) | US Federal Trade Commission | Public domain (US government) | `marketing:partnership-marketing`, `marketing:public-relations`, `marketing:social-post-craft`, `marketing:youtube-producer`, `revenue:referral-programs` |
| [MRC standards and guidelines](https://mediaratingcouncil.org/standards-and-guidelines) | Media Rating Council | Free to read, all rights reserved | `demand-generation:marketing-analytics`, `demand-generation:paid-advertising`, `marketing:video-content` |
| [Native Advertising: A Guide for Businesses](https://www.ftc.gov/business-guidance/resources/native-advertising-guide-businesses) | US Federal Trade Commission | Public domain (US government) | `demand-generation:paid-advertising`, `marketing:content-strategy`, `marketing:partnership-marketing`, `marketing:public-relations` |
| [Policy Statement Regarding Advertising Substantiation](https://www.ftc.gov/legal-library/browse/ftc-policy-statement-regarding-advertising-substantiation) | US Federal Trade Commission | Public domain (US government) | `demand-generation:paid-advertising`, `marketing:marketing-copywriting`, `marketing:positioning-and-messaging`, `marketing:product-launch` |
| [Product data specification](https://support.google.com/merchants/answer/7052112) | Google | Free to read, all rights reserved | `demand-generation:listing-distribution`, `demand-generation:paid-advertising` |
| [RFC 9309: Robots Exclusion Protocol](https://www.rfc-editor.org/rfc/rfc9309.html) | IETF | Free to read, all rights reserved | `demand-generation:ai-search-optimization`, `demand-generation:programmatic-seo`, `demand-generation:seo-strategy` |
| [Schema.org vocabulary](https://schema.org/) | Schema.org community group | CC BY-SA (share-alike) | `demand-generation:listing-distribution`, `demand-generation:programmatic-seo`, `demand-generation:seo-strategy` |
| [Spam policies for Google web search](https://developers.google.com/search/docs/essentials/spam-policies) | Google | CC BY | `demand-generation:ai-search-optimization`, `demand-generation:programmatic-seo`, `demand-generation:seo-strategy`, `marketing:content-strategy` |
| [Standard Definitions: final dispositions of case codes and outcome rates for surveys](https://aapor.org/standards-and-ethics/standard-definitions/) | American Association for Public Opinion Research | Free to read, all rights reserved | `demand-generation:marketing-analytics`, `marketing:customer-research` |
| [Structured data markup that Google Search supports](https://developers.google.com/search/docs/appearance/structured-data/search-gallery) | Google | CC BY | `demand-generation:listing-distribution`, `demand-generation:programmatic-seo`, `demand-generation:seo-strategy` |
| [Web Content Accessibility Guidelines 2.2](https://www.w3.org/TR/WCAG22/) | World Wide Web Consortium | Free to read, all rights reserved | `customer-experience:self-service-and-knowledge`, `demand-generation:landing-page-cro-expert`, `marketing:newsletter-writer`, `marketing:video-content`, `marketing:visual-content`, `product:design-system`, `product:interface-craft`, `product:interface-redesign`, `product:ux-product-auditor` |

### Pmo and operations

| Source | Publisher | License | Skills |
|---|---|---|---|
| [17 CFR Part 243 — Regulation FD](https://www.ecfr.gov/current/title-17/chapter-II/part-243) | US Securities and Exchange Commission | Public domain (US government) | `executive:fundraising-and-investor-relations`, `legal-risk:corporate-governance` |
| [2010 ADA Standards for Accessible Design](https://www.ada.gov/law-and-regs/design-standards/2010-stds/) | US Department of Justice | Public domain (US government) | `marketing:events-and-field-marketing`, `operations:facilities-and-workplace` |
| [21 CFR Part 117 — preventive controls for human food](https://www.ecfr.gov/current/title-21/chapter-I/subchapter-B/part-117) | US Food and Drug Administration | Public domain (US government) | `operations:procurement-and-sourcing`, `operations:quality-management`, `operations:supply-chain-and-logistics` |
| [29 CFR Part 1910 — occupational safety and health standards](https://www.ecfr.gov/current/title-29/subtitle-B/chapter-XVII/part-1910) | US Occupational Safety and Health Administration | Public domain (US government) | `operations:facilities-and-workplace`, `people:learning-and-development` |
| [49 CFR Part 395 — hours of service of drivers](https://www.ecfr.gov/current/title-49/subtitle-B/chapter-III/subchapter-B/part-395) | Federal Motor Carrier Safety Administration | Public domain (US government) | `operations:capacity-and-demand-planning`, `operations:supply-chain-and-logistics` |
| [9 CFR Part 417 — Hazard Analysis and Critical Control Point systems](https://www.ecfr.gov/current/title-9/chapter-III/subchapter-E/part-417) | US Department of Agriculture, Food Safety and Inspection Service | Public domain (US government) | `operations:process-design`, `operations:quality-management` |
| [Country Commercial Guides](https://www.trade.gov/country-commercial-guides) | US Department of Commerce, International Trade Administration | Public domain (US government) | `corporate-strategy:market-entry`, `operations:supply-chain-and-logistics` |
| [Delaware General Corporation Law](https://delcode.delaware.gov/title8/c001/index.html) | State of Delaware | Public domain | `executive:chief-executive`, `executive:fundraising-and-investor-relations`, `legal-risk:corporate-governance` |
| [Exempt offerings and Regulation D](https://www.sec.gov/education/smallbusiness/exemptofferings) | US Securities and Exchange Commission | Public domain (US government) | `executive:chief-executive`, `executive:fundraising-and-investor-relations` |
| [Federal Acquisition Regulation](https://www.acquisition.gov/browse/index/far) | US General Services Administration, on behalf of the FAR Council | Public domain (US government) | `finance:cost-accounting`, `operations:procurement-and-sourcing`, `operations:vendor-management` |
| [GAO Agile Assessment Guide](https://www.gao.gov/products/gao-24-105506) | US Government Accountability Office | Public domain (US government) | `pmo:change-and-adoption`, `pmo:head-of-pmo`, `pmo:project-delivery` |
| [GAO Cost Estimating and Assessment Guide](https://www.gao.gov/products/gao-20-195g) | US Government Accountability Office | Public domain (US government) | `pmo:estimating-and-contingency`, `pmo:portfolio-governance`, `pmo:program-management` |
| [GAO Schedule Assessment Guide: best practices for project schedules](https://www.gao.gov/products/gao-16-89g) | US Government Accountability Office | Public domain (US government) | `pmo:dependency-and-risk-management`, `pmo:project-delivery`, `pmo:schedule-development-and-analysis` |
| [Hart-Scott-Rodino premerger notification program](https://www.ftc.gov/enforcement/premerger-notification-program) | US Federal Trade Commission | Public domain (US government) | `corporate-strategy:chief-strategy-officer`, `corporate-strategy:mergers-and-acquisitions` |
| [ISO 9001 — Quality management systems: requirements](https://www.iso.org/standard/62085.html) | ISO | Sold | `operations:process-design`, `operations:quality-management`, `operations:vendor-management` |
| [Incoterms rules](https://iccwbo.org/business-solutions/incoterms-rules/) | International Chamber of Commerce | Sold | `operations:procurement-and-sourcing`, `operations:supply-chain-and-logistics` |
| [Interagency Guidance on Third-Party Relationships: Risk Management](https://www.federalreserve.gov/newsevents/pressreleases/bcreg20230606a.htm) | Federal Reserve, FDIC and OCC | Public domain (US government) | `operations:procurement-and-sourcing`, `operations:service-level-management`, `operations:vendor-management` |
| [Merger Guidelines](https://www.ftc.gov/reports/merger-guidelines-2023) | US Department of Justice and Federal Trade Commission | Public domain (US government) | `corporate-strategy:chief-strategy-officer`, `corporate-strategy:mergers-and-acquisitions`, `corporate-strategy:portfolio-strategy` |
| [NASA Systems Engineering Handbook](https://www.nasa.gov/reference/systems-engineering-handbook/) | NASA | Public domain (US government) | `pmo:portfolio-governance`, `pmo:program-management`, `pmo:project-delivery` |
| [NIST SP 800-61: Incident Response Recommendations and Considerations](https://csrc.nist.gov/pubs/sp/800/61/r3/final) | NIST | Public domain (US government) | `customer-experience:escalation-management`, `operations:incident-management`, `security:detection-and-monitoring`, `security:incident-response` |
| [National Incident Management System doctrine](https://www.fema.gov/emergency-managers/nims) | Federal Emergency Management Agency | Public domain (US government) | `operations:business-continuity-and-resilience`, `operations:incident-management` |
| [The Green Book: appraisal and evaluation in central government](https://www.gov.uk/government/publications/the-green-book-appraisal-and-evaluation-in-central-governent) | HM Treasury | Free to use with attribution | `corporate-strategy:portfolio-strategy`, `pmo:benefits-realization`, `pmo:estimating-and-contingency`, `pmo:portfolio-governance` |

### Revenue and product

| Source | Publisher | License | Skills |
|---|---|---|---|
| [15 U.S.C. 7001 — Electronic Signatures in Global and National Commerce Act](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title15-section7001&num=0&edition=prelim) | US Congress, via the Office of the Law Revision Counsel | Public domain (US government) | `customer-experience:customer-onboarding-and-implementation`, `revenue:deal-negotiation`, `revenue:revenue-operations` |
| [15 U.S.C. 8403 — Restore Online Shoppers' Confidence Act](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title15-section8403&num=0&edition=prelim) | US Congress, via the Office of the Law Revision Counsel | Public domain (US government) | `product:product-requirements`, `revenue:activation`, `revenue:pricing-and-packaging`, `revenue:retention` |
| [16 CFR Part 310 — Telemarketing Sales Rule](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-310) | US Federal Trade Commission | Public domain (US government) | `revenue:outbound-prospecting`, `revenue:revenue-operations`, `revenue:sales-enablement` |
| [18 U.S.C. 2511 — interception of communications](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title18-section2511&num=0&edition=prelim) | US Congress, via the Office of the Law Revision Counsel | Public domain (US government) | `customer-experience:support-operations`, `revenue:outbound-prospecting` |
| [36 CFR Part 1194 — Section 508 information and communication technology standards](https://www.ecfr.gov/current/title-36/subtitle-B/chapter-XI/part-1194) | US Access Board | Public domain (US government) | `product:product-requirements`, `product:ux-product-auditor`, `revenue:sales-enablement` |
| [Age Appropriate Design Code](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/childrens-information/childrens-code-guidance-and-resources/) | UK Information Commissioner's Office | Free to use with attribution | `product:interface-craft`, `product:product-requirements`, `revenue:activation` |
| [CCPA regulations, California Code of Regulations title 11](https://cppa.ca.gov/regulations/consumer_privacy_act.html) | California Privacy Protection Agency | Public domain | `marketing:behavioral-marketing`, `product:interface-craft`, `product:interface-redesign`, `product:ux-product-auditor` |
| [California Automatic Renewal Law, Business and Professions Code 17600-17606](https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?division=7.&chapter=1.&part=3.&lawCode=BPC&article=9.) | California Legislative Counsel | Public domain | `product:interface-craft`, `product:product-requirements`, `revenue:pricing-and-packaging`, `revenue:retention` |
| [California Labor Code 2751 — commission agreements in writing](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=LAB&sectionNum=2751) | California Legislative Counsel | Public domain | `revenue:revenue-operations`, `revenue:sales-compensation-and-territory` |
| [Commission Guidance on Management's Discussion and Analysis, Release 33-10751](https://www.federalregister.gov/documents/2020/02/25/2020-02296/commission-guidance-on-managements-discussion-and-analysis-of-financial-condition-and-results-of) | US Securities and Exchange Commission | Public domain (US government) | `data-analytics:business-intelligence`, `finance:unit-economics`, `revenue:revenue-operations` |
| [Compendium of U.S. Copyright Office Practices](https://www.copyright.gov/comp3/) | US Copyright Office | Public domain (US government) | `legal-risk:intellectual-property`, `product:brand-identity`, `product:visual-reference-generation` |
| [EN 301 549 — accessibility requirements for ICT products and services](https://www.etsi.org/deliver/etsi_en/301500_301599/301549/03.02.01_60/en_301549v030201p.pdf) | ETSI | Free to read, all rights reserved | `product:product-requirements`, `product:ux-product-auditor`, `revenue:sales-enablement` |
| [Fact Sheet 17F: exemption for outside sales employees](https://www.dol.gov/agencies/whd/fact-sheets/17f-overtime-outside-sales) | US Department of Labor, Wage and Hour Division | Public domain (US government) | `people:employment-compliance`, `revenue:sales-compensation-and-territory` |
| [Federal Plain Language Guidelines](https://www.plainlanguage.gov/guidelines/) | Plain Language Action and Information Network | Public domain (US government) | `customer-experience:self-service-and-knowledge`, `customer-experience:support-operations` |
| [Human Interface Guidelines](https://developer.apple.com/design/human-interface-guidelines) | Apple | Free to read, all rights reserved | `product:design-system`, `product:interface-craft`, `product:interface-redesign` |
| [Non-GAAP financial measures — compliance and disclosure interpretations](https://www.sec.gov/corpfin/non-gaap-financial-measures) | US Securities and Exchange Commission, Division of Corporation Finance | Public domain (US government) | `finance:capital-structure-and-covenants`, `finance:unit-economics` |
| [PCI Data Security Standard](https://www.pcisecuritystandards.org/document_library/) | PCI Security Standards Council | Free behind an account | `customer-experience:support-operations`, `security:data-protection-and-encryption`, `security:detection-and-monitoring` |
| [Regulation (EU) 910/2014 — eIDAS](https://eur-lex.europa.eu/eli/reg/2014/910/oj) | Publications Office of the European Union | Free to use with attribution | `revenue:deal-negotiation`, `revenue:revenue-operations` |
| [SIL Open Font License](https://openfontlicense.org/) | SIL International | Free to read, all rights reserved | `product:brand-identity`, `product:design-system` |
| [Trademark Manual of Examining Procedure](https://tmep.uspto.gov/) | US Patent and Trademark Office | Public domain (US government) | `legal-risk:intellectual-property`, `product:brand-identity` |
| [Unicode Common Locale Data Repository](https://cldr.unicode.org/) | Unicode Consortium | Free to use with attribution | `product:design-system`, `product:interface-craft`, `product:product-requirements` |
| [Uniform Commercial Code, Article 2 — Sales](https://www.law.cornell.edu/ucc/2) | American Law Institute and Uniform Law Commission | Free to read, all rights reserved | `revenue:deal-negotiation`, `revenue:revenue-operations` |
| [WAI-ARIA and the ARIA Authoring Practices Guide](https://www.w3.org/WAI/ARIA/apg/) | World Wide Web Consortium | Free to read, all rights reserved | `product:design-system`, `product:interface-craft`, `product:interface-redesign`, `product:ux-product-auditor` |

### Security

| Source | Publisher | License | Skills |
|---|---|---|---|
| [CIS Critical Security Controls](https://www.cisecurity.org/controls) | Center for Internet Security | Free behind an account | `security:chief-information-security-officer` |
| [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) | CISA | Public domain (US government) | `security:incident-response`, `security:vulnerability-management` |
| [FedRAMP baselines and automation content](https://www.fedramp.gov/rev5/documents-templates/) | GSA | Public domain (US government) | `legal-risk:regulatory-compliance`, `security:chief-information-security-officer`, `security:security-architecture-review` |
| [ISO/IEC 27001 — Information security management systems](https://www.iso.org/standard/27001) | ISO | Sold | `legal-risk:regulatory-compliance`, `security:chief-information-security-officer` |
| [MITRE ATT&CK](https://attack.mitre.org/) | The MITRE Corporation | Free to use with attribution | `security:detection-and-monitoring`, `security:incident-response`, `security:security-architecture-review`, `security:threat-modeling` |
| [NIST Cybersecurity Framework 2.0](https://www.nist.gov/cyberframework) | NIST | Public domain (US government) | `security:chief-information-security-officer`, `security:security-architecture-review` |
| [NIST SP 800-53 Rev. 5 — Security and Privacy Controls for Information Systems](https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final) | NIST | Public domain (US government) | `security:access-and-identity`, `security:chief-information-security-officer`, `security:security-architecture-review` |
| [National Vulnerability Database](https://nvd.nist.gov/) | NIST | Public domain (US government) | `security:vulnerability-management` |
| [OWASP Application Security Verification Standard](https://owasp.org/ASVS/) | OWASP Foundation | CC BY-SA (share-alike) | `security:security-architecture-review` |
| [OWASP Top 10](https://owasp.org/www-project-top-ten/) | OWASP Foundation | CC BY-SA (share-alike) | `security:security-architecture-review`, `security:threat-modeling` |
| [SANS Information Security Policy Templates](https://www.sans.org/information-security-policy/) | SANS Institute | Free to read, all rights reserved | `legal-risk:regulatory-compliance`, `security:chief-information-security-officer` |

### Technology and it

| Source | Publisher | License | Skills |
|---|---|---|---|
| [47 CFR Part 9 — 911 requirements](https://www.ecfr.gov/current/title-47/chapter-I/subchapter-B/part-9) | US Federal Communications Commission | Public domain (US government) | `it-operations:telephony-and-conferencing` |
| [AWS Well-Architected Framework](https://docs.aws.amazon.com/wellarchitected/latest/framework/welcome.html) | Amazon Web Services | Free to read, all rights reserved | `it-operations:cloud-administration`, `technology:cloud-infrastructure`, `technology:solution-architecture` |
| [Agent Skills documentation](https://platform.claude.com/docs/en/agents-and-tools/agent-skills/overview) | Anthropic | Free to read, all rights reserved | `technology:skill-authoring` |
| [Automated Technical Debt Measure](https://www.omg.org/spec/ATDM/) | Object Management Group | Free to read, all rights reserved | `technology:technical-debt-management` |
| [Azure Well-Architected Framework](https://learn.microsoft.com/en-us/azure/well-architected/) | Microsoft | Free to read, all rights reserved | `it-operations:cloud-administration`, `technology:cloud-infrastructure` |
| [CIS Benchmarks](https://www.cisecurity.org/cis-benchmarks) | Center for Internet Security | Free behind an account | `it-operations:cloud-administration`, `it-operations:endpoint-management`, `it-operations:systems-administration`, `it-operations:virtualization-operations` |
| [Conventional Commits 1.0.0](https://www.conventionalcommits.org/en/v1.0.0/) | Conventional Commits project | CC BY | `technology:branch-and-worktree-workflow` |
| [Git reference manual](https://git-scm.com/docs) | Git project | Free to read, all rights reserved | `technology:branch-and-worktree-workflow`, `technology:parallel-agent-delivery` |
| [Google Cloud Architecture Framework](https://cloud.google.com/architecture/framework) | Google Cloud | Free to read, all rights reserved | `it-operations:cloud-administration`, `technology:cloud-infrastructure` |
| [Model Context Protocol specification](https://modelcontextprotocol.io/specification/latest) | Model Context Protocol project | Free to read, all rights reserved | `technology:ai-workflow-architect` |
| [NIST SP 1800-5: IT Asset Management](https://csrc.nist.gov/pubs/sp/1800/5/final) | NIST / National Cybersecurity Center of Excellence | Public domain (US government) | `it-operations:chief-information-officer`, `it-operations:it-asset-management` |
| [NIST SP 800-124: Guidelines for Managing the Security of Mobile Devices](https://csrc.nist.gov/pubs/sp/800/124/r2/final) | NIST | Public domain (US government) | `it-operations:endpoint-management` |
| [NIST SP 800-145: The NIST Definition of Cloud Computing](https://csrc.nist.gov/pubs/sp/800/145/final) | NIST | Public domain (US government) | `it-operations:cloud-administration`, `technology:cloud-infrastructure` |
| [NIST SP 800-207: Zero Trust Architecture](https://csrc.nist.gov/pubs/sp/800/207/final) | NIST | Public domain (US government) | `it-operations:cloud-administration`, `it-operations:identity-lifecycle-administration`, `it-operations:network-administration` |
| [NIST SP 800-34: Contingency Planning Guide for Federal Information Systems](https://csrc.nist.gov/pubs/sp/800/34/r1/upd1/final) | NIST | Public domain (US government) | `it-operations:backup-and-recovery`, `operations:business-continuity-and-resilience`, `operations:incident-management` |
| [NIST SP 800-40: Guide to Enterprise Patch Management Planning](https://csrc.nist.gov/pubs/sp/800/40/r4/final) | NIST | Public domain (US government) | `it-operations:endpoint-management`, `it-operations:systems-administration`, `security:vulnerability-management` |
| [NIST SP 800-63: Digital Identity Guidelines](https://csrc.nist.gov/pubs/sp/800/63/4/final) | NIST | Public domain (US government) | `it-operations:identity-lifecycle-administration`, `security:access-and-identity` |
| [OpenAPI Specification](https://spec.openapis.org/oas/latest.html) | OpenAPI Initiative, Linux Foundation | Free to use with attribution | `technology:api-design` |
| [OpenID Connect Core 1.0](https://openid.net/specs/openid-connect-core-1_0.html) | OpenID Foundation | Free to read, all rights reserved | `it-operations:identity-lifecycle-administration` |
| [OpenTelemetry specification and semantic conventions](https://opentelemetry.io/docs/specs/otel/) | OpenTelemetry project, Cloud Native Computing Foundation | CC BY | `technology:observability-and-reliability` |
| [RFC 1035: Domain Names — Implementation and Specification](https://www.rfc-editor.org/rfc/rfc1035.html) | IETF | Free to read, all rights reserved | `it-operations:network-administration` |
| [RFC 1918: Address Allocation for Private Internets](https://www.rfc-editor.org/rfc/rfc1918.html) | IETF | Free to read, all rights reserved | `it-operations:network-administration` |
| [RFC 3261: SIP — Session Initiation Protocol](https://www.rfc-editor.org/rfc/rfc3261.html) | IETF | Free to read, all rights reserved | `it-operations:telephony-and-conferencing` |
| [RFC 7644: System for Cross-domain Identity Management Protocol](https://www.rfc-editor.org/rfc/rfc7644.html) | IETF | Free to read, all rights reserved | `it-operations:identity-lifecycle-administration` |
| [RFC 9110: HTTP Semantics](https://www.rfc-editor.org/rfc/rfc9110.html) | IETF | Free to read, all rights reserved | `technology:api-design` |
| [RFC 9457: Problem Details for HTTP APIs](https://www.rfc-editor.org/rfc/rfc9457.html) | IETF | Free to read, all rights reserved | `technology:api-design` |
| [RFC 9700: Best Current Practice for OAuth 2.0 Security](https://www.rfc-editor.org/rfc/rfc9700.html) | IETF | Free to read, all rights reserved | `it-operations:identity-lifecycle-administration`, `technology:api-design` |
| [Regulation (EU) 2024/1689 — the AI Act](https://eur-lex.europa.eu/eli/reg/2024/1689/oj) | Publications Office of the European Union | Free to use with attribution | `data-analytics:ai-ml-governance`, `legal-risk:regulatory-compliance`, `technology:chief-technology-officer` |
| [Secure Cloud Business Applications (SCuBA)](https://www.cisa.gov/scuba) | CISA | Public domain (US government) | `it-operations:collaboration-platform-administration` |
| [Security Technical Implementation Guides](https://public.cyber.mil/stigs/) | Defense Information Systems Agency, US Department of Defense | Public domain (US government) | `it-operations:endpoint-management`, `it-operations:network-administration`, `it-operations:systems-administration`, `it-operations:virtualization-operations` |
| [Semantic Versioning 2.0.0](https://semver.org/) | Semantic Versioning project | CC BY | `technology:api-design`, `technology:branch-and-worktree-workflow` |
| [Site Reliability Engineering and The SRE Workbook](https://sre.google/sre-book/table-of-contents/) | Google | Free to read, all rights reserved | `technology:observability-and-reliability` |
| [Trace Context](https://www.w3.org/TR/trace-context/) | World Wide Web Consortium | Free to read, all rights reserved | `technology:observability-and-reliability` |
| [WebRTC: Real-Time Communication in Browsers](https://www.w3.org/TR/webrtc/) | World Wide Web Consortium | Free to read, all rights reserved | `it-operations:telephony-and-conferencing` |

## Keeping it honest

`scripts/check-sources.py` runs on every push and verifies structure, the license vocabulary, that every skill named resolves, and that a skill with sources actually points at them. Reachability is checked weekly by its own workflow instead, because a publisher being briefly down is not a reason to fail an unrelated pull request.

Sources are maintained in `sources/*.toml`. See `sources/README.md` for the format and the full license vocabulary.