How can agencies use SCAP FDCC content to automate FISMA compliance of technical controls?
SCAP tools, which agencies use to continuously monitor FDCC settings, can output FISMA technical control compliance evidence. The FDCC SCAP content has FISMA compliance mappings embedded in it so that SCAP-compatible tools can automatically generate NIST Special Publication (SP) 800-53 assessment and compliance evidence. Each low level security configuration check is mapped to the appropriate high level NIST SP 800-53 security controls. As draft NIST SP 800-53A progresses towards final publication, there will be a direct linkage, where appropriate, of the assessment procedures found in NIST SP 800-53A to the SCAP automated testing of information system mechanisms and associated security configuration settings. In addition, the FDCC SCAP content also contains mappings to other high level policies (e.g., ISO, DOD 8500, FISCAM) and SCAP tools may also output those compliance mappings. There exists additional SCAP content that can also be used by agencies to automate FISMA technical contro
Related Questions
- How can agencies use Security Content Automation Protocol (SCAP) USGCB content to automate FISMA compliance of technical controls?
- How can agencies use Security Content Automation Protocol (SCAP) FDCC content to automate FISMA compliance of technical controls?
- How can agencies use SCAP FDCC content to automate FISMA compliance of technical controls?
