[PATCH] changed major transforms to handle CCIs as references instead of idents

Shawn Wells shawn at redhat.com
Fri Apr 27 19:05:54 UTC 2012


On 4/27/12 11:57 AM, Jeffrey Blank wrote:
> +<xsl:if test="$refsource = 'disa'">
> +<xsl:value-of select="$disa-cciuri" />
> +</xsl:if>


I'm not a fan of using the string "disa" to reference the CCI controls. 
 From my understanding CCI's are unique identifiers which can map back 
to several different policies. For example CCI-000370 maps to:
- DISA SRG-OS-00022
- DISA Group V-30388
- DISA OS SRG Rule SV-40055r1
- NIST 800-53 CM-6 (1)
- NIST 800-53 CM-6 (1).1

If we start tagging the CCI's as <ref disa..> I think it will get very 
confusing. Objections to a patch naming them CCI instead of DISA? This 
would allow a tag such as below which I think is cleaner.

<ref nist="CM-6 (1).1, CM-6" cci="000370" ossrg="00022">


More information about the scap-security-guide mailing list