[sacm] EPCP and BCP Status

["Haynes Jr., Dan" <[e-mail]>]

Hi Everyone,

Sorry in advance for the long email, but Jess mentioned at IETF 106, it was asked whether or not EPCP should be a BCP or Informational draft. Given that, I tried to go back and dig up some information and here’s what I found :).

Originally, EPCP was a Standards Track draft and in mid-2018, we changed its status to BCP (between -02 and -03). Also, around that time, there was a question on-list [1] as to whether or not it should be Standards Track or Informational where we re-iterated its BCP status.

1.      Is it going to be a Standard Track draft? Since I see you mentioned in the abstract it mainly describes the best practices, maybe an Informational draft is more suitable?

[Danny]: I think I forgot to change that in the last draft, but, we would like to see this draft published as a BCP since it discusses the best practices for using IETF and TCG standards for endpoint assessment.

In early 2019, we made further changes to the draft to better align it with the needs of a BCP draft (see attached slides).

Unfortunately, I couldn’t find any concrete information as to why its status was changed to BCP, but, I want to say someone suggested it and as a group we thought it made sense at the time. Without that concrete information, we should look at BCP 9 [2] which states:


                    The BCP subseries of the RFC series is designed to be a way to

                  standardize practices and the results of community deliberations.  A

                  BCP document is subject to the same basic set of procedures as

                  standards track documents and thus is a vehicle by which the IETF

                  community can define and ratify the community's best current thinking

                  on a statement of principle or on what is believed to be the best way

                  to perform some operations or IETF process function.

Given this, I think it is fair to say that EPCP represents the best way to perform posture collection when the collector resides on the endpoint. Specifically, it outlines six best practices (see Section 2 of EPCP) as well as how you can implement those best practices using existing IETF/ISO/TCG standards.

With all that said, does EPCP make sense as a BCP? Or, are there specific things that it is missing that make it a better candidate for an Informational draft?

Thanks,

Danny

[1] https://mailarchive.ietf.org/arch/msg/sacm/h4DU9TFF6LxEKmMySV-ftYD21GM
[2] https://tools.ietf.org/html/bcp9#page-1-15


Thanks,

Danny