I was wondering if anyone was available to explain DIACAP transition to DIARMF and what it means for STIGS and SSG?

Happy to have a public email thread, but also happy to take it offline. 

Here is my summary understanding.

DoD developed its own list of information assurance controls under DIACAP (DoD Information Assurance Certification and Accreditation Process). 

In recent years (2010-2012), the DIACAP started transitioning to  DIARMF (DoD Information Assurance Risk Management Framework) to align it with NIST RMF, and to bring the catalog of controls into alignment with the controls listed in 800-53, with some special overlays available for Defense-related systems.

As of Spring 2014, that transition is complete. 

But I'm trying to make sure I understand how the STIGs play into all of this. When I look at the STIGs, I see different control number tracking than from the 800-53s or the CCEs.  

Is it the case that the Control catalog is now 800-53r4 for both civilian and DoD, but DoD is using STIGs to get to platform specific details while civilian side is using CCEs?

If there were just 5 or 6 documents about current/active control catalogs, what would they be? 800-137, 800-53, 8510.1 and/or ... ???

Thanks...

Greg Elin
http://govready.org - Making FISMA compliance easier for innovators

email: gregelin@gitmachines.com
phone: 917-304-3488