adammontville
commented
6 years ago Can someone (@henkbirkholz ?) figure out where this is coming from? I can't find "Attribute Definition" in the current or previous draft.
In terms of the bigger question: Are certain "artifacts" not necessarily conducted by a SACM component? I think the answer is yes. I think activities like defining a policy (i.e. like a CIS Benchmark or a USGCB checklist or a DISA STIG) are largely manual processes. There may be some cases where certain recommendations could be inferred by a SACM component based on different guidance (but at some point the guidance relied upon comes from an organization, which is likely to be a manual process).
What is the action to be taken from this issue?
jarrettlu
sacm
1.) The way it is worded at the moment, the tasks "Attribute Definition" and "Policy Definition" in the definition of SACM tasks could imply that they are conducted manually (especially "Policy Definition") and not necessarily conducted by a SACM component. This seems to be in contrast to the other tasks, which are all conducted by a SACM component.
Is this intentional? Is a SACM task always conducted by a SACM component? Does every SACM task have a corresponding manual counterpart?
2.) The name of the SACM task "Attribute Definition" could be misleading. No attributes are defined, but a subset of defined attributes is aggregated in a list (that is called attribute definition at the moment).