mcleo-d
commented
1 year ago Good morning, Val.
Francesco – nice meeting you again 😊 Jonathan, a pleasure to reconnect. Vikram and Rachel – hello again. Aric, Paul , David, and James – a pleasure virtually meeting you. James – have we met this past July at I4 Forum?
I am thrilled to learn of, and support this initiative as it aligns well with two of my ‘hats’ I wear at NIST (see signature highlights).
Codifying (digitalizing) the representation of the controls in OSCAL provides tremendous advantage as it:
- supports standardized (cheaper, faster, better) security automation (continuous assessment and monitoring) against any regulatory framework represented in OSCAL (through OSCAL mapping), not only the Common Cloud Controls
- allows GRC tools that “speak” OSCAL to exchange information in real time.
Codifying in OSCAL the test cases that validate the efficacy of the controls, and the threat mitigations is supported today but we are eager to understand if a more robust mechanism is needed.
I will be more than happy to support this effort with knowledge, connect interested parties, involve the community and the team when needed. Our OSCAL community is open to anyone interested to join and we can also invite them to collaborate as long as we can launch a open call for collaboration. We can also establish a financial, international public community of interest as part of our community and the FINOS team can be the driving force. If other non-public frameworks are necessary for this collaboration, please let me know and we can discuss the options.
Thank you. Looking forward to hearing back from you or James.
Dr. Michaela Iorga Senior Security Technical Lead for Cloud Computing
Description
This issue contains an email conversation for transparency between NIST and the
Engage with NIST on ControlsWG who are engaging NIST to extend the OSCAL standard.From @valmihai to NIST We've been working with the folks at FINOS (on CC here), on the Common Cloud Controls initiative.
The Common Cloud Controls programme has been established within FINOS to provide a mechanism for Financial Institutions to avoid concentration risk between Cloud Service Providers (CSP) by defining a common set of controls that can be implemented in a CSP to allow potential migration between clouds. These controls are designed to specifically mitigate threats identified during threat modelling of the specific risks aimed at cloud services. The aim is to define the controls in a codified form leveraging OSCAL along with codified test cases that validate the efficacy of those controls and mitigation the threat.
We would like to partner with NIST and the OSCAL community to understand where best to add the codified implementation, threat and efficacy test cases within OSCAL. We would be particularly interested if prior art exists or there are existing partners who would be willing to work on this.
Please let us know if this is something you'd be open to engaging with the team, and if so, @mcleo-d can help coordinate a call for everyone.