GaryGapinski
commented
2 years ago Please separate 800-53 content from 800-53A content. The recent attempt to render them in the same document managed to damage the 800-53 content in favor of 800-53A in a manner which was entirely upside-down: 800-53A pseudo-ODPs are derivative from those of 800-53, not the other way around. Keeping the content separate would also have the salutary result of keeping the 800-53A leading zero affectation in a sanitary cordon.
Such a separation is healthy — NIST issues the 800-53 SPs independent of one another — and relationships can be accommodated by inter-document linkages from 800-53A content to 800-53 content: not the other way around.
Separately, mapping presumptive 800-53A assessment objectives to 800-53 control statement imperatives (and thus derivative system security plan control implementation statement declarations) is a worthy topic for discussion. 800-53A assessment method to and from assessment objective mapping is also of worthy of discussion.
wendellpiez
david-waltermire
aj-stein-nist
User Story:
As an OSCAL tools developer and/or security practitioner, I want an explicit linking between objectives and control statements in the SP800-53 OSCAL catalog.
Goals:
There is an implicit linking through a common ID naming scheme, but this could be made more explicit with a linking relationship that does not require human understanding or machine-level parsing and transformation of IDs themselves.
The rationale and goals stem from the conversation around improvements we can make in usnistgov/oscal-content#98.
Dependencies:
N/A
Acceptance Criteria
{The items above are general acceptance criteria for all User Stories. Please describe anything else that must be completed for this issue to be considered resolved.}