Has any work been done to be able to say what checks are mapped to a single NIST control?
IIUC, the current tools generate something more akin to
where AC-3 and CM-6 are in the same nist ref
I know DCID 6/3 is going away, but I would like to map the DCID requirements to the rules in the scap-security-guide.
1) Has this been done in a non-public repo since the source is FOUO?
2) Would it be acceptable to commit the DCID paragraph numbers to the git tree without any expository text?
e.g. <ref dcid="1.1, 2.2, 3.3"/>
The approach taken in the scap-security-guide seems to be to map low level actions back to high level controls. How do I determine if the set of actions completely or only partially satisfies the control?