Hmmm, do we have a transform that creates a table in line with what's called for in NIST SP 800-70 Appendix E, for proper submission, sans perhaps the "Impact" column (which lacks a corresponding XCCDF element).
This was not driven by the USGCB Profile. I'll do that next
(soon, as I must adapt, undoubtedly augment, the RHEL6 USGCB
profile and field a draft variant by Monday, and it will likely
address all Rules found in scap-security-guide, including ones
that will be deemed optional). Note that not all Rules have CCEs.
Perhaps some should.
It will be rather easy to adapt for submission in the SP800-70
format. Reference is made to a "spreadsheet", which I think is a
primitive type of document from a past age. The document name must
end in ".xls" or ".xlsx", but no normative specification for
document content is provided, so just about anything goes, as was
obviously the case with the RHEL5 USGCB content.
The names, format, etc. can be changed. I'll push this into
version control once it is acceptable.
800-53 rev 4 is just out in draft.