[PATCH 21/33] Mapped CCI-001340 to requirement_unclear.

Shawn Wells shawn at redhat.com
Thu Jul 5 21:26:06 UTC 2012


On 7/5/12 4:52 PM, Willy Santos wrote:
> CCI-001340 requires maintaining reviewer/releaser identity and credentials within the established chain of custody for all information reviewed or released. This mapping is a request for input/discussion.
>
> Signed-off-by: Willy Santos <wsantos at redhat.com>
> ---
>   rhel6/src/input/auxiliary/srg_support.xml |    2 +-
>   1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/rhel6/src/input/auxiliary/srg_support.xml b/rhel6/src/input/auxiliary/srg_support.xml
> index 4fa76d6..021bf4d 100644
> --- a/rhel6/src/input/auxiliary/srg_support.xml
> +++ b/rhel6/src/input/auxiliary/srg_support.xml
> @@ -38,7 +38,7 @@ The requirement is impractical or out of scope.
>   <description>
>   It is unclear how to satisfy this requirement.
>   </description>
> -<ref disa="20,31,218,219,224,1097,1158,1239,1291,1294,1295,1310,1311,1328" />
> +<ref disa="20,31,218,219,224,1097,1158,1239,1291,1294,1295,1310,1311,1328,1340" />
>   </Group> <!-- end requirement_unclear -->
>   
>   <Group id="new_rule_needed">

SRG-OS-000210 	CCI-001340 	The operating system must maintain 
reviewer/releaser identity and credentials within the established chain 
of custody for all information reviewed or released. 	When it comes to 
data review and data release, there must be a correlation between the 
reviewed data and the person who performs the review. If the reviewer is 
a human or if the review function is automated but separate from the 
release/transfer function, the operating system associates the identity 
of the reviewer of the information to be released with the information 
and the information label.


impractical_guidance, we are not writing a cross domain guard.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://fedorahosted.org/pipermail/scap-security-guide/attachments/20120705/056a9fff/attachment.html>


More information about the scap-security-guide mailing list