A colleague tipped me off to NIST's "HIPAA Security Rule Toolkit." Quickly playing with their tool, it's a java-based GUI that embeds OCIL checklists for HIPAA compliance.

http://scap.nist.gov/hipaa/

For example, a screen shot:



We've played with creating OCIL content for SSG in the past, at least for select profiles like STIG/USGCB. Would inclusion of OCIL be particularly useful to anyone?

Trying to think through this could actually be used...

- Perhaps STIG profile could extend a "STIG-OCIL" which reflects DISA FSO organizational controls.
- Need some way to provide an "answers file," so that every scan does not get asked 100+ questions
- If using downstream tooling (e.g. Satellite or ACAS?), scan a group of systems ("ApplicationX in EnvironmentY") which provides "Application Level" OCIL results, while endpoints are scanned against STIG configuration baseline?
- Something else?

-- 
Shawn Wells
Office of the Chief Technologist
U.S. Public Sector
shawn@redhat.com | 443.534.0130