Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

OSCAL's role in mappings between standards #87

Closed
anweiss opened this issue Dec 14, 2017 · 14 comments · Fixed by #1150
Closed

OSCAL's role in mappings between standards #87

anweiss opened this issue Dec 14, 2017 · 14 comments · Fixed by #1150
Assignees
@david-waltermire
Labels
Discussion Needed This issues needs to be reviewed by the OSCAL development team. Scope: Website Issues targeted at the OSCAL project website.
Milestone
v1.1.0

Comments

@anweiss
Copy link
Contributor

anweiss commented Dec 14, 2017 •
edited
Loading

Issue for tracking existing mappings and what OSCAL's role in any of them should be. Some examples below:
@akarmel akarmel mentioned this issue Dec 19, 2017
Closed
@anweiss anweiss mentioned this issue Jan 18, 2018
Closed
@anweiss
Copy link
Contributor Author

anweiss commented Jan 26, 2018

Adding more commentary here, and setting aside for the moment who would ultimately be responsible for mappings, we could start by simply leveraging the existing "profile" model to support mappings. Since the "profile" schema already allows for more than one import element, it's trivial to include additional "catalog"/"framework" imports which can effectively be inferred as mappings (assuming we'd update the call element to include some sort of refId attribute which actually connects the calls together). In this scenario, the calls subsequently represent both the selected controls from a "catalog" and the mappings.

@wendellpiez thoughts?

@wendellpiez
Copy link
Contributor

@anweiss that is quite an interesting idea: effectively (as I understand it) you are suggesting a semantics of a refId attribute (or such) that would provide a profile with mappings among its controls "on arrival" (i.e. expressed somehow in resolution). I can how this could be useful.

We should throw this idea in the mix as we talk about merge/modify semantics. Since, effectively, to "express a mapping" is a kind of modification potentially with a merge or at any rate "decorate" component (maybe the two controls in question are grouped, they are likely linked in some way) ... really the need here is open ended (for being able to express mappings or even relations in general - a mapping being (I'd argue) an interesting sort of "mutual dependency" relation ... and we already know we have cases where even by default, there will be merge behavior specified) ... so I wonder whether "express a mapping" could not be the first of several sorts of "smart annotation" operations on controls (others might include to include forensic tracing of profile resolution, etc.).

@wendellpiez
Copy link
Contributor

wendellpiez commented Jan 26, 2018 •
edited
Loading

FWIW, a document describing or "declaring" mappings among all these catalogs might readily be expressed in OSCAL, but it would likely be a more free-form "documentary" form (I think) than the profile; outwardly, it would look more like a catalog albeit with many more links than a standalone catalog. Sprint 3's rough prototype of an extraction of CSF YAML into XML (see /working/CSF/CSF-framework-enhanced.xml) offers a taste of what this might look like albeit it is entirely data driven (i.e. it has exactly what the source had and no more, only reformatted and linked up) ... it only happens that the YAML in question describes something like a mapping.

@anweiss
Copy link
Contributor Author

anweiss commented Jan 28, 2018

Yea, let's definitely keep this in mind as we address #93

@david-waltermire
Copy link
Contributor

david-waltermire commented Jan 29, 2018 via email

@anweiss
Copy link
Contributor Author

anweiss commented Jan 29, 2018

Agreed

@aaronlippold
Copy link

I am working on the Compliance Mapper project at MITRE as a restful web service that aligns and can return mappings from one standard to another ( such as CIS CSC to 800-53 - for example ) that I chatted with the NIST folks about a few months ago. The need is clear, so my team started working the solution, the question is where should it be hosted and who would maintain it.

david-waltermire added a commit that referenced this issue Apr 3, 2018
@david-waltermire
# This is a combination of 29 commits.
5b13d9d 
# The first commit's message is:

# This is a combination of 54 commits.
# The first commit's message is:

# This is a combination of 4 commits.
# The first commit's message is:

# This is a combination of 2 commits.
# The first commit's message is:

# This is a combination of 2 commits.
# The first commit's message is:

# This is a combination of 6 commits.
# The first commit's message is:

# This is a combination of 3 commits.
# The first commit's message is:

# This is a combination of 111 commits.
# The first commit's message is:

Initial commit of docs branch.

# This is the commit message #2:

Create CONTRIBUTING.md
# This is the commit message #3:

Create ROADMAP.md
# This is the commit message #4:

Update README.md
# This is the commit message #5:

Create README.md
# This is the commit message #6:

Update README.md
# This is the commit message #7:

Update README.md
# This is the commit message #8:

Create OSCAL-PRODUCERS.md
# This is the commit message #9:

Create OSCAL-CONSUMERS.md
# This is the commit message #10:

Update and rename OSCAL-CONSUMERS.md to USERS.md
# This is the commit message #11:

Update and rename OSCAL-PRODUCERS.md to IMPLEMENTERS.md
# This is the commit message #12:

Rename CONTRIBUTING.md to CONTRIBUTORS.md
# This is the commit message #13:

Update README.md
# This is the commit message #14:

Update README.md
# This is the commit message #15:

Update USERS.md
# This is the commit message #16:

Update README.md
# This is the commit message #17:

Update IMPLEMENTERS.md
# This is the commit message #18:

Update README.md
# This is the commit message #19:

Update ROADMAP.md
# This is the commit message #20:

Update USERS.md
# This is the commit message #21:

Update CONTRIBUTORS.md
# This is the commit message #22:

Update README.md
# This is the commit message #23:

Update README.md
# This is the commit message #24:

Update IMPLEMENTERS.md
# This is the commit message #25:

Update IMPLEMENTERS.md
# This is the commit message #26:

Rename CONTRIBUTORS.md to CONTRIBUTING.md
# This is the commit message #27:

Create control.md
# This is the commit message #28:

Update control.md
# This is the commit message #29:

Update control.md
# This is the commit message #30:

Update control.md
# This is the commit message #31:

Update control.md
# This is the commit message #32:

Add files via upload
# This is the commit message #33:

Update control.md
# This is the commit message #34:

Create temp.md
# This is the commit message #35:

Delete NIST-SP-800-53-Rev4-AC1.png
# This is the commit message #36:

Add files via upload
# This is the commit message #37:

Delete temp.md
# This is the commit message #38:

Add files via upload
# This is the commit message #39:

Update control.md
# This is the commit message #40:

Add files via upload
# This is the commit message #41:

Add files via upload
# This is the commit message #42:

Update control.md
# This is the commit message #43:

Update CONTRIBUTING.md
# This is the commit message #44:

Update CONTRIBUTING.md
# This is the commit message #45:

Update USERS.md
# This is the commit message #46:

Update CONTRIBUTING.md
# This is the commit message #47:

Delete CONTRIBUTING.md
# This is the commit message #48:

Delete USERS.md
# This is the commit message #49:

Add files via upload
# This is the commit message #50:

Delete CSA-CCM-IAM02.png
# This is the commit message #51:

Update control.md
# This is the commit message #52:

Update control.md
# This is the commit message #53:

Update control.md
# This is the commit message #54:

Update control.md
# This is the commit message #55:

Update control.md
# This is the commit message #56:

Update control.md
# This is the commit message #57:

Update control.md
# This is the commit message #58:

Update control.md
# This is the commit message #59:

Update control.md
# This is the commit message #60:

Update control.md
# This is the commit message #61:

Delete NIST-SP-800-53-AC1-in-OSCAL-XML.png
# This is the commit message #62:

Update README.md
# This is the commit message #63:

Update control.md
# This is the commit message #64:

Update control.md
# This is the commit message #65:

Add files via upload
# This is the commit message #66:

Delete ISO-27001-Control-A9.png
# This is the commit message #67:

Update control.md
# This is the commit message #68:

Add files via upload
# This is the commit message #69:

Add files via upload
# This is the commit message #70:

Delete ISO-27002-Control-9.1.1-part1.png
# This is the commit message #71:

Delete ISO-27002-Control-9.1.1-part2.png
# This is the commit message #72:

Update control.md
# This is the commit message #73:

Update control.md
# This is the commit message #74:

Update control.md
# This is the commit message #75:

Update control.md
# This is the commit message #76:

Update control.md
# This is the commit message #77:

Update README.md
# This is the commit message #78:

Update IMPLEMENTERS.md
# This is the commit message #79:

Add files via upload
# This is the commit message #80:

Delete oscal-layers.png
# This is the commit message #81:

Add files via upload
# This is the commit message #82:

Delete oscal-layers.png
# This is the commit message #83:

Add files via upload
# This is the commit message #84:

Update IMPLEMENTERS.md
# This is the commit message #85:

Update control.md
# This is the commit message #86:

Update IMPLEMENTERS.md
# This is the commit message #87:

Update control.md
# This is the commit message #88:

Rename IMPLEMENTERS.md to docs/prose/IMPLEMENTERS.md
# This is the commit message #89:

Rename IMPLEMENTERS.md to implementers.md
# This is the commit message #90:

Rearranged and outlined catalog documentation based on the conversation with karen and Wendell.

# This is the commit message #91:

Create catalog-xml.md
# This is the commit message #92:

Rename control.md to catalog.md
# This is the commit message #93:

Update catalog.md
# This is the commit message #94:

Update catalog.md
# This is the commit message #95:

Update catalog.md
# This is the commit message #96:

Update catalog-xml.md
# This is the commit message #97:

Update catalog-xml.md
# This is the commit message #98:

Update catalog-xml.md
# This is the commit message #99:

Update catalog-xml.md
# This is the commit message #100:

Update catalog-xml.md
# This is the commit message #101:

Update catalog-xml.md
# This is the commit message #102:

Update catalog-xml.md
# This is the commit message #103:

Update catalog-xml.md
# This is the commit message #104:

Update catalog-xml.md
# This is the commit message #105:

Update catalog-xml.md
# This is the commit message #106:

Docset migration to Slate

# This is the commit message #107:

Removing unused file.

# This is the commit message #108:

Update README.md

Corrected a typo
# This is the commit message #109:

Add files via upload

Graphical representation of OSCAL schemas aligned with Risk Management Framework steps and tasks.
# This is the commit message #110:

Create CONTRIBUTING.md
# This is the commit message #111:

Create ROADMAP.md
# This is the commit message #2:

Create README.md
# This is the commit message #3:

Update README.md
# This is the commit message #2:

Create OSCAL-PRODUCERS.md
# This is the commit message #3:

Create OSCAL-CONSUMERS.md
# This is the commit message #4:

Update and rename OSCAL-CONSUMERS.md to USERS.md
# This is the commit message #5:

Update and rename OSCAL-PRODUCERS.md to IMPLEMENTERS.md
# This is the commit message #6:

Rename CONTRIBUTING.md to CONTRIBUTORS.md
# This is the commit message #2:

Update USERS.md
# This is the commit message #2:

Update IMPLEMENTERS.md
# This is the commit message #2:

Update ROADMAP.md
# This is the commit message #3:

Update USERS.md
# This is the commit message #4:

Update CONTRIBUTORS.md
# This is the commit message #2:

Update IMPLEMENTERS.md
# This is the commit message #3:

Update IMPLEMENTERS.md
# This is the commit message #4:

Rename CONTRIBUTORS.md to CONTRIBUTING.md
# This is the commit message #5:

Create control.md
# This is the commit message #6:

Update control.md
# This is the commit message #7:

Update control.md
# This is the commit message #8:

Update control.md
# This is the commit message #9:

Update control.md
# This is the commit message #10:

Add files via upload
# This is the commit message #11:

Update control.md
# This is the commit message #12:

Create temp.md
# This is the commit message #13:

Delete NIST-SP-800-53-Rev4-AC1.png
# This is the commit message #14:

Add files via upload
# This is the commit message #15:

Delete temp.md
# This is the commit message #16:

Add files via upload
# This is the commit message #17:

Update control.md
# This is the commit message #18:

Add files via upload
# This is the commit message #19:

Add files via upload
# This is the commit message #20:

Update control.md
# This is the commit message #21:

Update CONTRIBUTING.md
# This is the commit message #22:

Update CONTRIBUTING.md
# This is the commit message #23:

Update USERS.md
# This is the commit message #24:

Update CONTRIBUTING.md
# This is the commit message #25:

Delete CONTRIBUTING.md
# This is the commit message #26:

Delete USERS.md
# This is the commit message #27:

Add files via upload
# This is the commit message #28:

Delete CSA-CCM-IAM02.png
# This is the commit message #29:

Update control.md
# This is the commit message #30:

Update control.md
# This is the commit message #31:

Update control.md
# This is the commit message #32:

Update control.md
# This is the commit message #33:

Update control.md
# This is the commit message #34:

Update control.md
# This is the commit message #35:

Update control.md
# This is the commit message #36:

Update control.md
# This is the commit message #37:

Update control.md
# This is the commit message #38:

Update control.md
# This is the commit message #39:

Delete NIST-SP-800-53-AC1-in-OSCAL-XML.png
# This is the commit message #40:

Update README.md
# This is the commit message #41:

Update control.md
# This is the commit message #42:

Update control.md
# This is the commit message #43:

Add files via upload
# This is the commit message #44:

Delete ISO-27001-Control-A9.png
# This is the commit message #45:

Update control.md
# This is the commit message #46:

Add files via upload
# This is the commit message #47:

Add files via upload
# This is the commit message #48:

Delete ISO-27002-Control-9.1.1-part1.png
# This is the commit message #49:

Delete ISO-27002-Control-9.1.1-part2.png
# This is the commit message #50:

Update control.md
# This is the commit message #51:

Update control.md
# This is the commit message #52:

Update control.md
# This is the commit message #53:

Update control.md
# This is the commit message #54:

Update control.md
# This is the commit message #2:

Update IMPLEMENTERS.md
# This is the commit message #3:

Add files via upload
# This is the commit message #4:

Delete oscal-layers.png
# This is the commit message #5:

Add files via upload
# This is the commit message #6:

Delete oscal-layers.png
# This is the commit message #7:

Add files via upload
# This is the commit message #8:

Update IMPLEMENTERS.md
# This is the commit message #9:

Update control.md
# This is the commit message #10:

Update IMPLEMENTERS.md
# This is the commit message #11:

Update control.md
# This is the commit message #12:

Rename IMPLEMENTERS.md to docs/prose/IMPLEMENTERS.md
# This is the commit message #13:

Rename IMPLEMENTERS.md to implementers.md
# This is the commit message #14:

Rearranged and outlined catalog documentation based on the conversation with karen and Wendell.

# This is the commit message #15:

Create catalog-xml.md
# This is the commit message #16:

Rename control.md to catalog.md
# This is the commit message #17:

Update catalog.md
# This is the commit message #18:

Update catalog.md
# This is the commit message #19:

Update catalog.md
# This is the commit message #20:

Update catalog-xml.md
# This is the commit message #21:

Update catalog-xml.md
# This is the commit message #22:

Update catalog-xml.md
# This is the commit message #23:

Update catalog-xml.md
# This is the commit message #24:

Update catalog-xml.md
# This is the commit message #25:

Update catalog-xml.md
# This is the commit message #26:

Update catalog-xml.md
# This is the commit message #27:

Update catalog-xml.md
# This is the commit message #28:

Update catalog-xml.md
# This is the commit message #29:

Fixed typos, updated repo documentation, and migrated documentation for use in Slate.

Corrected a typo (+4 squashed commit)

Squashed commit:

[6ada57f] Removing unused file.

[503ad71] Docset migration to Slate

[351257e] Update catalog-xml.md

[aae1e8b] Add files via upload

Graphical representation of OSCAL schemas aligned with Risk Management Framework steps and tasks.
@david-waltermire david-waltermire added the Discussion Needed This issues needs to be reviewed by the OSCAL development team. label Apr 6, 2018
@david-waltermire david-waltermire added this to the OSCAL 1.0 M2 milestone Apr 6, 2018
@david-waltermire david-waltermire added the Scope: Website Issues targeted at the OSCAL project website. label May 9, 2019
@flickerfly
Copy link
Contributor

I'm sure some folks have worked around this not yet being implemented. What workarounds and lessons have been learned?

Also, Is there perhaps a better understanding of the problem now that we're a few years down the road that can help provide a clear direction for completion? Maybe it can be broken into some iterations to help bulid momentum and reduce the larger overwhelming nature of it?

@flickerfly
Copy link
Contributor

I am working on the Compliance Mapper project at MITRE as a restful web service that aligns and can return mappings from one standard to another ( such as CIS CSC to 800-53 - for example ) that I chatted with the NIST folks about a few months ago. The need is clear, so my team started working the solution, the question is where should it be hosted and who would maintain it.

I'm curious if anything ever came of this? If so, where did it get hosted?

@iMichaela
Copy link
Contributor

@flickerfly - No, the NIST team did not receive any contributions from MITRE around such mapping model, but @david-waltermire-nist started the mapping module in collaboration with other contributors and we planned to have it released as part of OSCAL 1.1.0 (please see the list of milestones).

@flickerfly
Copy link
Contributor

@iMichaela Excellent!

@flickerfly flickerfly mentioned this issue Nov 23, 2021
Open
@david-waltermire david-waltermire linked a pull request Feb 24, 2022 that will close this issue
Support for control mapping #1150
Merged
8 tasks
@david-waltermire david-waltermire self-assigned this Feb 24, 2022
@david-waltermire david-waltermire mentioned this issue Feb 24, 2022
Open
3 tasks
@david-waltermire
Copy link
Contributor

Need to add a few examples to PR #1150 to help illustrate the new catalog mapping features.

@tajinders
Copy link

@iMichaela As you mentioned that @david-waltermire-nist is working on providing support for the control mapping and it would be available as part of OSCAL 1.1.0. Could you or @david-waltermire-nist please help me understand the timelines for this release and when would support for the control mapping be available and would there be any document similar to the catalog/profile model that we can refer to understand the data format.

Thanks in advance and would greatly appreciate your help in this regard !!

@iMichaela
Copy link
Contributor

@tajinders - please the PR #1150. Please provide feedback. The community's feedback on the mapping and other enhancements scheduled for OSCAL 1.1.0 will drive the release date. We hope to be in approx 2-3 months, but as we make more progress and receive the feedback, we will provide a more accurate timeline.

@david-waltermire david-waltermire mentioned this issue May 17, 2022
Closed
3 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@david-waltermire david-waltermire

Labels
Discussion Needed This issues needs to be reviewed by the OSCAL development team. Scope: Website Issues targeted at the OSCAL project website.
Projects
NIST OSCAL Work Board
Status: Done
Milestone
v1.1.0
Development

Successfully merging a pull request may close this issue.

Support for control mapping david-waltermire/OSCAL
7 participants
@flickerfly @aaronlippold @wendellpiez @anweiss @tajinders @david-waltermire @iMichaela