RFC Research (DEFINE) Opportunity 1 for March 2023

[aj-stein-nist]

Description:

It is anticipated that NIST will initiate a draft specification to fully define exportable content, and outline an approach for shared control responsibilities. We wish to identify members of the community who would like to participate in producing a draft. We have created initial use cases, performed a gap analysis, and we are in the process of preparing conceptual examples for evaluation.

Skills needed:

• Understanding of the OSCAL system security plan model.
• Knowledge of Customer Responsibility Matrix (CRM) documents, either as an author or consumer.
• Ability to interpret machine-oriented content, such as YAML or JSON.
• Ability to participate in GitHub issue creation, feedback and recommendations.

Estimated time commitment:

8 to 10 hours in April

This opportunity is subject to the outcome of the current effort, and may be delayed if additional detail is required to begin the draft.

Value to OSCAL:

This will help us enhance OSCAL models to communicate shared responsibility for controls without exposing the content of the entire SSP model.

I'm interested, how do I volunteer?

Comment here.

[vmangat]

Happy to help

[Compton-US]

Thanks @vmangat, I will be sure to tag you once the research effort is set up in the new repository. I should also be sharing some information on the next DEFINE meeting on March 16.

[iMichaela]

The next OSCAL DEFINE meeting, on March 16, 2023, @ 11:00 AM ET, will be important for this effort, so interested parties are kindly asked to join the meeting