Going forward, we're going to use <reference> tags inside of OVAL checks to track if they've been tested. An example is as follows:

<reference source="MED" ref_id="20130731" ref_url="test_attestation" />

Source should uniquely identify the tester (here, I used my initials); ref_id should be in the format YYYYMMDD. We'll probably be adding empty tags into all the checks to get everyone started. This is similar to the <tested> tag in XCCDF, which is converted into an XCCDF <reference> tag during our build process.

Here is an example of the <reference> tag in an existing check. Note that it comes just after the description tag, inside of <metadata>.

<def-group>
  <definition class="compliance" id="file_permissions_etc_group" version="1">
    <metadata>
      <title>Verify permissions on 'group' file</title>
      <affected family="unix">
        <platform>Red Hat Enterprise Linux 6</platform>
      </affected>
      <description>File permissions for /etc/group should be set correctly.</description>
      <reference source="MED" ref_id="20130731" ref_url="test_attestation"/>
    </metadata>
    <criteria>
      <criterion test_ref="file_permissions_etc_group_test" />
    </criteria>
  </definition>
  <unix:file_test check="all" check_existence="all_exist" comment="Testing /etc/group permissions" id="file_permissions_etc_group_test" version="1">
    <unix:object object_ref="file_permissions_etc_group_object" />
    <unix:state state_ref="file_permissions_etc_group_state" />
  </unix:file_test>
  <unix:file_state id="file_permissions_etc_group_state" version="1">
    <unix:uread datatype="boolean">true</unix:uread>
    <unix:uwrite datatype="boolean">true</unix:uwrite>
    <unix:uexec datatype="boolean">false</unix:uexec>
    <unix:gread datatype="boolean">true</unix:gread>
    <unix:gwrite datatype="boolean">false</unix:gwrite>
    <unix:gexec datatype="boolean">false</unix:gexec>
    <unix:oread datatype="boolean">true</unix:oread>
    <unix:owrite datatype="boolean">false</unix:owrite>
    <unix:oexec datatype="boolean">false</unix:oexec>
  </unix:file_state>
  <unix:file_object comment="/etc/group" id="file_permissions_etc_group_object" version="1">
    <unix:path>/etc</unix:path>
    <unix:filename>group</unix:filename>
  </unix:file_object>
</def-group>

- Maura Dailey