On 4/27/12 11:57 AM, Jeffrey Blank wrote:
+<xsl:if test="$refsource = 'disa'">
+<xsl:value-of select="$disa-cciuri" />
+</xsl:if>
I'm not a fan of using the string "disa" to reference the CCI controls.
From my understanding CCI's are unique identifiers which can map back
to several different policies. For example CCI-000370 maps to:
- DISA SRG-OS-00022
- DISA Group V-30388
- DISA OS SRG Rule SV-40055r1
- NIST 800-53 CM-6 (1)
- NIST 800-53 CM-6 (1).1
If we start tagging the CCI's as <ref disa..> I think it will get very
confusing. Objections to a patch naming them CCI instead of DISA? This
would allow a tag such as below which I think is cleaner.
<ref nist="CM-6 (1).1, CM-6" cci="000370"
ossrg="00022">