On 9/16/14, 5:58 AM, Trey Henefield wrote:
That is a great breakdown Shawn!
I think it would it be useful to create profiles that align with the
RMF IA control baselines (low, moderate, high)
Definitely. I started on this path sometime ago via the nist-cl-il-al
profile. I then got distracted by other things and never finished.
The idea was that nist-c{onfidentiality}l-i{ntegriy}l-a{availability}l
could be inherited by a m/m/m, which then gets inherited by a h/h/h
profile.
Check out the profile. It has the various low/low/low NIST 800-53
requirements in comments, but they need mapping to an SSG rule.
and also include profiles that build upon the IA control baseline
profiles to additionally support the current 5 overlays (CNSSI No. 1253).
The CSCF
is against the Cross Domain overlay.... I think there may be
others they had to meet too. Luke?