A colleague tipped me off to NIST's "HIPAA Security Rule Toolkit."
Quickly playing with their tool, it's a java-based GUI that embeds OCIL
checklists for HIPAA compliance.
http://scap.nist.gov/hipaa/
For example, a screen shot:
We've played with creating OCIL content for SSG in the past, at least
for select profiles like STIG/USGCB. Would inclusion of OCIL be
particularly useful to anyone?
Trying to think through this could actually be used...
- Perhaps STIG profile could extend a "STIG-OCIL" which reflects DISA
FSO organizational controls.
- Need some way to provide an "answers file," so that every scan does
not get asked 100+ questions
- If using downstream tooling (e.g. Satellite or ACAS?), scan a group of
systems ("ApplicationX in EnvironmentY") which provides "Application
Level" OCIL results, while endpoints are scanned against STIG
configuration baseline?
- Something else?
--
Shawn Wells
Office of the Chief Technologist
U.S. Public Sector
shawn(a)redhat.com | 443.534.0130