Re: [scap_interest] Just throwing this out there: Compliance Frameworks

Another reference point is the Cloud Control Matrix.  They did a excellent job of mapping many of the regulatories into a common set.
Coming out the Cloud Security Alliance it looks like it is gear towards Cloud environments.  Wondering if it could be leveraged in any environments. 

Link: https://cloudsecurityalliance.org/research/ccm/

-ln

On Feb 14, 2012, at 4:09 PM, Adam Montville wrote:

> All,
> 
> I had a brief discussion with several members of this list with respect to compliance frameworks, which met some resistance.  Still, I think presenting the idea to a larger audience to solicit feedback is a good idea.
> 
> From an automation perspective, it seems that some method of being able to map benchmark-level tests to some higher level policy representation may be warranted.  At the end of the day, we perform assessments to ensure that we are in a secure state – to be compliant with a particular set of policies.
> 
> Is there any interest in being able to represent a compliance framework with either a new specification or potentially revitalizing and extending an existing specification (CCI: http://iase.disa.mil/stigs/cci.html), or to simply rely upon any existing commercial efforts, such as UCF (https://www.unifiedcompliance.com)?
> 
> Or, is this type of representation simply not needed – there's enough there, the present demand doesn't justify the work, or something else?
> 
> Thoughts?
> 
> Regards,
> 
> Adam W. Montville | Security and Compliance Architect
> 
> Direct: 503 276-7661
> Mobile: 360 471-7815
> 
> TRIPWIRE | Take CONTROL
> http://www.tripwire.com
> 
> _______________________________________________
> scap_interest mailing list
> scap_interest@ietf.org
> https://www.ietf.org/mailman/listinfo/scap_interest