Reliably extract citations from Authority Documents

When AI is not needed, 100% accuracy.

When AI is utilized, greater than 80% accuracy where 20% of Citations need to be reworked (e.g., split, merged, rejected …)

If there is poor accuracy requiring extensive human correction, then there is little value.

Reliably extract glossaries from Authority Documents

When AI is not needed, 100% accuracy.

When AI is utilized, greater than 95% accuracy where only 5% of term-definition pairs need to be reworked. Glossaries are substantially easier to identify and extract than citations.

If there is poor accuracy requiring extensive human correction, then there is little value.

Reliably automate the end-to-end process of capturing, transforming, and loading STIG, NIST 800-53, FedRAMP, eCFR compliance content into the Unified Compliance platform.

100% of identified Authority Documents for all four compliance content contributor sources is loaded into the UCF.

All four Authority Documents sources are related to securing and hardening IT infrastructure for both the private and public sector.

To provide value to customers with Security Operation's requirements, UC needs to maximize the breadth of security coverage to ensure we can provide security guidance for as many IT assets as possible.

Ingested compliance content, including Authority Documents, Citations, and Glossaries, are available for access via the UC 4.0 API Gateway

100% of identified Authority Documents for all four compliance content contributor sources are available for access via the UCF 4.0 API Gateway

We are in the migration phase from CCH to UC 4.0. To ensure we don’t elongate the migration process, all new content must come into UC 4.0 and out the API Gateway.

Tagging and Mapping of content to the Common Controls.

This project ends at the AD, Citation and Glossary extraction, transformation, and load.

Follow-on projects will include the tagging and mapping.

Human-in-the-loop for content capture.

Later projects can include additional human validation. To limit scope of this project, steps such as metadata change detection can be reviewed and validated after the fact looking at logs and other information.

Human-in-the-loop for the AD cataloging.

Same as above

Human-in-the-loop for transformation into the common data format

Same as above

Human-in-the-loop for loading into the UCF

Same as above

Corpora Management and Administration

A non-production version of a corpora exists. Any work on the corpora is out of scope for this product.

Corpora Data Loads

The focus of this PRD is to load compliance content into the UCF 4.0 application for customer consumption over the API Gateway with API Responses in the Common Data Format.

Follow-on projects can tap into the pipeline and use the content for other purposes.

Fit-for-purpose frontend for each step in the content ingestion process.

UX/UI for any other aspect of the process outside of human review and approval of suggested citations and suggested term-definition pairs.

Later product updates could include additional front-end steps for tasks throughout the process.

Dictionary term management.

For glossaries, all that is needed for the terms is the term-definition pair. Once we move into creating and managing dictionaries, we will add more details like part of speech, synonyms …

What do we do with deprecated authority documents?

How do we identify and capture AD versions?

For STIGs, how do we identify which files are authority documents?

For NIST 800-53, how do we identify which files are authority documents?

For FedRAMP, how do we identify which files are authority documents?

For eCFRs, how do we identify which files are authority documents?

Specifically, what is required to catalog an AD?

In this first pass, what should constitute content changes?

We don’t want to get too crazy and make this a massive project.

Need to discuss.