Versions Compared

Version Old Version 4 New Version 5
Changes made by

Jay Hill (Unlicensed)

Jay Hill (Unlicensed)

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Expand
titleHigh-level Approach

Briefly describe the approach you’re taking to solve this problem. Provide enough information for the reader to imagine possible solution directions and get a rough sense of the scope of this proposal.

The approach is to start with “left-hand” side of the automation process where compliance content is captured from a small set of sources. Authority Documents, Citations, and Glossaries are extracted from those documents, transformed into the Common Data Format specification, and loaded into the UC platform. Automation tools and AI will be used to accelerate the end-to-end process within with human assistance to review and approve most steps in the process.

Expand
titleGoals

What does success look like? What metrics can we effect and why it is important to affect those metrics?

Goal

Metric

Why Important?

Automate an end-to-end process to capture all STIG content (approximately 457 documents), perform ETL, and load into the UCF in common data format.

All 457 STIGs, as Authority Documents, are available for customer consumption via API from the UC 4.0 API Gateway

All Citations as part of the 457 STIGs are available for customer consumption via API from the UC 4.0 API Gateway

All Glossaries with term-definition pairs as they related to the 457 STIGs are available for customer consumption via API from the UC 4.0 API Gateway

STIGs sit at the intersection of Sec Ops and GRC. Organizations need to harden their security posture with DoD approved security measures that are in alignment with the software and hardware vendors.

IT departments will utilize a variety of software and hardware in their data centers. UC needs to maximize the breadth of STIG coverage to ensure can match as many IT assets as possible.

Automate an end-to-end process to capture all NIST-800-53 content (approximately 36 files with a mixture of json, yaml, and xml documents), perform ETL, and load into the UCF in common data format.

All NIST-800-53 content, as Authority Documents, are available for customer consumption via API from the UC 4.0 API Gateway

All Citations as part of the NIST-800-53 documents are available for customer consumption via API from the UC 4.0 API Gateway

All Glossaries with term-definition pairs as they related to the NIST-800-53 content are available for customer consumption via API from the UC 4.0 API Gateway

NIST 800-53 helps IT departments implement proper security controls to proactively take care of their organization's infrastructure.

Automate an end-to-end process to capture all FedRAMP content (approximately 32 files with a mixture of json, yaml, and xml documents), perform ETL, and load into the UCF in common data format.

All FedRAMP content, as Authority Documents, are available for customer consumption via API from the UC 4.0 API Gateway

All Citations as part of the NIST-800-53 documents are available for customer consumption via API from the UC 4.0 API Gateway

All Glossaries with term-definition pairs as they related to the NIST-800-53 content are available for customer consumption via API from the UC 4.0 API Gateway

FedRAMP is a government-wide program that promotes the adoption of secure cloud services across the federal government by providing a standardized approach to security and risk assessment for cloud technologies and federal agencies.

UC can assist federal agencies or organizations working with federal agencies to grow and use secure cloud technologies.

eCFR

…

…

Scope and Requirements

Expand
titleSection Explanation. Click to expand.

The intent of this section is for the following:

Scope Definition: defines the scope of the proposed product (or features), including what will and will not be included helping manage expectations and focus development efforts.

Guideline for Development: provides detailed information on the product’s features, functionalities, user flow, and interface to guide the development team in building the product.

Framework: provides high-level evaluation criteria for alternative solutions (build, buy, partner) to evaluate different routes to success.

Expand
titleRequirements

Describe the product requirements that will fulfill the underserved need(s) starting off with the use cases, then specific functionality.

Requirement

Importance

Comments

STIGs

Scrape the STIG document library to download all zip files.

High

The zip files are multi-level nested zip files.

Unzip each STIG file to retrieve the XML files.

High

Store the XML files for later use.

High

The hierarchy of zip files must be maintained to ensure follow-on functions have context.

Identify which documents within the hierarchy are Authority Documents.

The zip files may contain readme’s or other files that do not constitute Authority Documents.

Catalog each source Authority Document.

Gather all information as is required by the Common Data format.

Expand
titleOut of Scope / Future Functionality

List the known features that are out of scope for this project or might be revisited at a later time.

As is case with the assumptions, it is important to list these out so that architects and engineers can plan accordingly for these later updates.

Requirement

Comments

Mapping STIGs, NIST, FedRamp, or eCFR content to the Common Controls.

This project ends at the AD, Citation and Glossary extraction.

Follow-on projects will include the mapping.

...

Expand
titleOpen Questions

List any open questions that come to mind throughout the lifecycle of this initiative.

Question

Answer

Date Answered

For STIGs how do we identify which files are authority documents?

Specifically, what is required to catalog an AD?

Expand
titleAlternative Solutions

Provide a high-level evaluation criterion for alternative solutions (build, buy, partner) to evaluate different routes to success.

...