(1) Who is the "authoritative source" on mapping CCIs back
to 800-53? /
The CCI list defines all the CCIs, and maps them back to 800-53. The
CCI is an invention of DISA FSO, and maintained by them.
More explanation here:
http://iase.disa.mil/cci/index.html
I also put the list in scap-security-guide in the references folder.
For right or wrong it's been my experience that C&A teams
care about
800-53 mappings and really haven't heard of CCIs. Because of this I
believe it'd be incredibly beneficial for us to provide some mapping
back to NIST 800-53. I know DISA did a CCI to OS SRG mapping, and kindly
put some NIST 800-53 refs in there, but I have the understanding that is
not "authoritative." I'd be more than happy to be wrong though!
It all depends on what the C&A person wants to see (which likely depends
on where they are in USG). A DoD C&A person probably wants to see
guidance from a STIG applied. A STIG-compliant system (because the STIG
satisfies the requirements listed in the SRG, which is really a
selection of CCIs) can be mapped back to 800-53 controls.
Of course, we have some items that we've individually mapped back to
800-53 controls (which may be very platform specific or which may simply
indicate a best practice which happens to comport with an 800-53
control). Not all of these may not fit into a CCI, which is why "nist="
also exists as a direct reference.
Is there an authoritative source of CCI to NIST mappings,
That's what the CCI list is.
and if so,
perhaps we could create some transformational pixie dust that takes our
CCI mapping and correlates it back to 800-53? This would also free us
from having to manually perform a <ref nist=*> for the rules.
Yes -- that's exactly why I have the CCI list in references. It's so
that we can write a transform to do exactly this.
If you want to write a ticket and assign it to me...