A number of the CCI's state the system shall "support the capability to...", such as "shall have the capability to centralize audit records" in CCI-000154.

To ensure we support this capability we need to ensure a certain amount of packages are installed (in this case, audit). I'd like to generate a set of required/recommended packages for a base installation that SSG needs. For example, iptables and audit would be on the top of the list.

We've tap danced around the idea of creating a recommended minimum packages before, however now there seems to be a pressing requirement to do so. What are everyone's thoughts on this? I've long been for it.

Note we shouldn't say "install only these packages," but rather "you'll need MINIMALLY these packages to secure your system"