DISA FSO Severity Ratings

Shawn Wells shawn at redhat.com
Tue Oct 23 03:08:28 UTC 2012


For those working on hashing out the Severity Category Codes (e.g. CAT 
levels) of the <rule>'s, our friends at DISA FSO have provided an 
updated "category code definitions" table. Thank you!

I have posted it the the STIG Wiki Page:
https://fedorahosted.org/scap-security-guide/wiki/rhel6stig

And a direct link:
https://fedorahosted.org/scap-security-guide/raw-attachment/wiki/rhel6stig/Severities-20121019.pdf

Note that we must use "low," "medium," and "high" and not the CAT 
levels, so;

CAT I  == High
CAT II == Medium
CAT III = Low

As a reminder, all rules default to "low" unless otherwise specified via 
the "severity" tag, examples:
system/network/uncommon.xml:36:<Rule id="disable_protocol_sctp" 
severity="medium">
services/obsolete.xml:180:<Rule id="no_rsh_trust_files" severity="high">

-- 
Shawn Wells
Technical Director,
U.S. Intelligence Programs
(e) shawn at redhat.com
(c) 443.534.0130



More information about the scap-security-guide mailing list