[PATCH] changed major transforms to handle CCIs as references instead of idents

Jeffrey Blank blank at eclipse.ncsc.mil
Wed May 2 22:09:05 UTC 2012



> (1) Who is the "authoritative source" on mapping CCIs back to 800-53? /

The CCI list defines all the CCIs, and maps them back to 800-53.  The
CCI is an invention of DISA FSO, and maintained by them.
More explanation here:
http://iase.disa.mil/cci/index.html

I also put the list in scap-security-guide in the references folder.


> For right or wrong it's been my experience that C&A teams care about
> 800-53 mappings and really haven't heard of CCIs. Because of this I
> believe it'd be incredibly beneficial for us to provide some mapping
> back to NIST 800-53. I know DISA did a CCI to OS SRG mapping, and kindly
> put some NIST 800-53 refs in there, but I have the understanding that is
> not "authoritative." I'd be more than happy to be wrong though!

It all depends on what the C&A person wants to see (which likely depends
on where they are in USG).  A DoD C&A person probably wants to see
guidance from a STIG applied.  A STIG-compliant system (because the STIG
satisfies the requirements listed in the SRG, which is really a
selection of CCIs) can be mapped back to 800-53 controls.

Of course, we have some items that we've individually mapped back to
800-53 controls (which may be very platform specific or which may simply
indicate a best practice which happens to comport with an 800-53
control).  Not all of these may not fit into a CCI, which is why "nist="
also exists as a direct reference.


> Is there an authoritative source of CCI to NIST mappings, 

That's what the CCI list is.

> and if so,
> perhaps we could create some transformational pixie dust that takes our
> CCI mapping and correlates it back to 800-53? This would also free us
> from having to manually perform a <ref nist=*> for the rules.

Yes -- that's exactly why I have the CCI list in references.  It's so
that we can write a transform to do exactly this.

If you want to write a ticket and assign it to me...


> [1] 
> http://people.redhat.com/swells/scap-security-guide-0.1/policytables/rhel6-table-srgmap.html
> 
> 
> 
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/scap-security-guide


More information about the scap-security-guide mailing list