A colleague tipped me off to NIST's "HIPAA Security Rule Toolkit."
Quickly playing with their tool, it's a java-based GUI that embeds
OCIL checklists for HIPAA compliance.
http://scap.nist.gov/hipaa/
For example, a screen shot:
We've played with creating OCIL content for SSG in the past, at
least for select profiles like STIG/USGCB. Would inclusion of OCIL
be particularly useful to anyone?
Trying to think through this could actually be used...
- Perhaps STIG profile could extend a "STIG-OCIL" which reflects
DISA FSO organizational controls.
- Need some way to provide an "answers file," so that every scan
does not get asked 100+ questions
- If using downstream tooling (e.g. Satellite or ACAS?), scan a
group of systems ("ApplicationX in EnvironmentY") which provides
"Application Level" OCIL results, while endpoints are scanned
against STIG configuration baseline?
- Something else?
--
Shawn Wells
Office of the Chief Technologist
U.S. Public Sector
shawn@redhat.com | 443.534.0130