Is OpenControl decided on?
It's not an approved standard from NIST, there seem to be standards in place, or being developed, that would support what it's trying to do, and it's *extremely* loosely defined to the point of constant misinterpretation. (Please let's not go down the route of "the implementation is the standard", that way lies madness of the 90's).
I also still have had issues with actually maintaining the content once is has been reasonably formed in the first place.
Though the controls are *extremely* odious, it seems like the tooling needs to go into the content management experience as opposed to a git workflow that we expect ISSOs to be able to use (I simply haven't found it yet).
I LOVE the idea, but the practical execution and maintenance over time has yet to be proven.
On the centralized DB idea, it's XML, import translations to SQL (or anything else) should be an XSLT away!
I don't think that dictating any database in particular is a good idea for SCAP but I do think that making it easy to put the data into processable chunks would be a good idea. That said, it's pretty easy to parse the XML and I think some consolidated libs in the most common languages would go a long way (Python, Ruby, PERL(maybe?), SQL99+ standard output for automatic DB creation in <DB of choice>).
Thinking about this, it might be nice to have a standardized SCAP server with a standardized API for queries. That I could 100% get behind so that everything could be vendor agnostic.
Thanks,