NIST requirement mapping question

Joe Nall joe at nall.com
Thu Jan 26 20:09:24 UTC 2012


Has any work been done to be able to say what checks are mapped to a single NIST control?
For example:
AC-3:
 userowner_shadow_file
 groupowner_shadow_file
 groupowner_group_file
 ...

IIUC, the current tools generate something more akin to
 userowner_shadow_file:
   AC-3, CM-6
where AC-3 and CM-6 are in the same nist ref

joe



More information about the scap-security-guide mailing list