How can agencies use Security Content Automation Protocol (SCAP) FDCC content to automate FISMA compliance of technical controls?
SCAP-validated tools, which agencies use to continuously monitor FDCC settings, can output FISMA technical control compliance evidence. The OVAL and XCCDF-based SCAP content has FISMA compliance mappings embedded in it so that SCAP-validated tools can automatically generate NIST Special Publication (SP) 800-53 assessment and compliance evidence. Each low level security configuration check is mapped to the appropriate high level NIST SP 800-53 security controls. The assessment procedures found in NIST SP 800-53A are linked, where appropriate, to the SCAP automated testing of information system mechanisms and associated security configuration settings. In addition, the FDCC SCAP content also contains mappings to other high level policies (e.g., ISO, DOD 8500, FISCAM) and SCAP tools may also output those compliance mappings. There exists additional SCAP content that can also be used by agencies to automate FISMA technical control compliance. This SCAP content is available at http://scap.n
Related Questions
- How can agencies use Security Content Automation Protocol (SCAP) USGCB content to automate FISMA compliance of technical controls?
- How can agencies use Security Content Automation Protocol (SCAP) FDCC content to automate FISMA compliance of technical controls?
- How can agencies use SCAP FDCC content to automate FISMA compliance of technical controls?
