DIACAP vs DIARMF & STIGs & CCEs.

Greg Elin gregelin at gitmachines.com
Mon Sep 15 21:02:20 UTC 2014


I was wondering if anyone was available to explain DIACAP transition to
DIARMF and what it means for STIGS and SSG?

Happy to have a public email thread, but also happy to take it offline.

Here is my summary understanding.

DoD developed its own list of information assurance controls under DIACAP
(DoD Information Assurance Certification and Accreditation Process).

In recent years (2010-2012), the DIACAP started transitioning to  DIARMF
(DoD Information Assurance Risk Management Framework) to align it with NIST
RMF, and to bring the catalog of controls into alignment with the controls
listed in 800-53, with some special overlays available for Defense-related
systems.

As of Spring 2014, that transition is complete.

But I'm trying to make sure I understand how the STIGs play into all of
this. When I look at the STIGs, I see different control number tracking
than from the 800-53s or the CCEs.

Is it the case that the Control catalog is now 800-53r4 for both civilian
and DoD, but DoD is using STIGs to get to platform specific details while
civilian side is using CCEs?

If there were just 5 or 6 documents about current/active control catalogs,
what would they be? 800-137, 800-53, 8510.1 and/or ... ???

Thanks...

Greg Elin
http://govready.org - Making FISMA compliance easier for innovators

email: gregelin at gitmachines.com
phone: 917-304-3488
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20140915/b23ad90d/attachment.html>


More information about the scap-security-guide mailing list