RHEL6 Draft STIG to DIACAP 8500 controls mapping?

Shawn Wells shawn at redhat.com
Wed Feb 27 21:50:22 UTC 2013


On 2/27/13 11:41 AM, Philip Shuman wrote:
> We are currently trying to map 8500 controls to the RHEL6 draft content (either the version from git or DISA's website would work). The RHEL5 STIG benchmark contains references to the IA controls, which allows the auditors to tie each check back to 8500.
>
> Here is an example from RedHat_5-V1R1_STIG_Benchmark-xccdf:
>
> Rule Title:  The operating system must be a supported release.
> STIG ID: GEN000100
> Rule ID: SV-27049r1_rule
> Vuln ID: V-11940
> IA Controls:VIVM-1
>
> Is there any mapping either between RHEL6 and 8500 or even between RHEL6 and RHEL5 that we could use to map these? It seems none of the RHEL6 identifiers in either the build from git or the DISA website are common with the past STIG content.

The STIGs map back to NIST 800-53, so what you may find a NIST 800-53 to 
DoD 8500.2 mapping useful. You can find that here:

http://www.doncio.navy.mil/uploads/1118AMF13814.pdf

With that said, I would be more than willing to add-in the capability to 
tag rules by DoD 8500.2 section/requirement number if someone is willing 
to go through and do the actual tagging


More information about the scap-security-guide mailing list