the transform (probably best viewed using Chrome, as not all
browsers handle HTML5 details elements well)
the output document
This was not driven by the USGCB Profile. I'll do that next
(soon, as I
must adapt, undoubtedly augment, the RHEL6 USGCB profile and field a
draft variant by Monday, and it will likely address all Rules found in
scap-security-guide, including ones that will be deemed optional). Note
that not all Rules have CCEs. Perhaps some should.
Yes. David is looking into that now.
It will be rather easy to adapt for submission in the SP800-70
Reference is made to a "spreadsheet", which I think is a primitive type
of document from a past age. The document name must end in ".xls" or
".xlsx", but no normative specification for document content is
provided, so just about anything goes, as was obviously the case with
the RHEL5 USGCB content.
Well, it was a first in many ways, and still impressive given all the
constraints (cough cough the underlying formats and dearth of authoring
tools). But we'll continue forward, and when the time comes for
submission, our intention is to use an HTML document which contains a
table, and see how receptive our friends at NIST will be to using open
The names, format, etc. can be changed. I'll push this into
control once it is acceptable.
I wonder if they would be so bold as to put it into a standardized,
machine-parseable format. It would be far more useful if it were
available in more than just an opaque human-readable format.