In the process of mapping CCI IDs from the OS SRG to Rules/Groups in the SSG, we found a number of rules/requirements in the RHEL 5 STIG that are mapping to CCI IDs not in the OS SRG. In the SSG should we be mapping to CCI IDs not on the OS SRG, or is it preferred to map to items only in the OS SRG? Either one could be appropriate. -Willy