Add NIST Control Assignments and Minimum Requirements

[JJediny]

Work in Progress: NIST Control Assignments and Minimum Requirements for Low, Moderate, High Systems (w/ NIST/FEDRAMP/DOD Requirements) from http://iasecontent.disa.mil/cloud/SRG/index.html

https://gist.github.com/JJediny/7820bd39c6a2221bbe893271e1d2f969

@gregelin I remember a related issue on OpenSCAP?

[gregelin]

Very interesting…

We’ve also tried to capture some assignment data. We don’t have a structure yet, either. Pretty critical we can represent assignments.

On Aug 5, 2016, at 5:50 PM, John Jediny notifications@github.com wrote:

Work in Progress: NIST Control Assignments and Minimum Requirements for Low, Moderate, High Systems (w/ NIST/FEDRAMP/DOD Requirements) from http://iasecontent.disa.mil/cloud/SRG/index.html http://iasecontent.disa.mil/cloud/SRG/index.html
https://gist.github.com/JJediny/7820bd39c6a2221bbe893271e1d2f969 https://gist.github.com/JJediny/7820bd39c6a2221bbe893271e1d2f969
@gregelin https://github.com/gregelin I remember a related issue on OpenSCAP?

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub #48, or mute the thread https://github.com/notifications/unsubscribe-auth/AABhk8cyNzx0Xth4SHIK0uHUVCAZ45J-ks5qc7A_gaJpZM4JeFv9.

[JJediny]

@gregelin updated the GIST but still a lot of cleaning up and restructuring to do...

After working through it this structure seems to be useful as it adds the answer per the specific system alongside the minimum requirements under system. Also added whether/which control enhancement is required per a Low/Moderate/High system to tell whether an answer is required for a specific system depending on if it is L/M/H according to FIPS determination:

TO DO:

• use key instead of id to be consistent with the rest of Open Control
• finalize structure
• update document with final structure
• review for accurate representation against DOD Cloud guide

# TO DO - Figure out overarching schema as document generated from unstructured text
# Only Half is valid YAML
#####
# DOD Guide uses Impact Level -> which generally equites to FIPS levels
# 2 = Low
# 3-5 = Moderate
# 6 = High
---
- control: AC-1
  applies:
    Low: true
    Moderate: true
    High: true
  assignments:
  - id: a
    requirement: Develops, documents, and disseminates to
    assignment: organization-defined personnel or roles
    answer: All Project Members
    system:
    - High: all personnel
      source: DoD RMF TAG
  - id: b.1
    requirement: Reviews and updates the current Access control policy
    assignment: organization-defined frequency
    answer: Every Year during Annual FISMA Assessment
    system:
    - Moderate: at least every 3 years
      source: FedRAMP v2
  - id: b.2
    requirement: Reviews and updates the current Access control procedures
    assignment: organization-defined frequency
    answer: Every Year during Annual FISMA Assessment
    system:
    - Low: at least annually
      source: FedRAMP v2

[anweiss]

Any thoughts/progress on this?