On 7/5/12 4:52 PM, Willy Santos wrote:
CCI-001340 requires maintaining reviewer/releaser identity and credentials
within the established chain of custody for all information reviewed or
released. This mapping is a request for input/discussion.
Signed-off-by: Willy Santos <[email protected]>
---
rhel6/src/input/auxiliary/srg_support.xml | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/rhel6/src/input/auxiliary/srg_support.xml
b/rhel6/src/input/auxiliary/srg_support.xml
index 4fa76d6..021bf4d 100644
--- a/rhel6/src/input/auxiliary/srg_support.xml
+++ b/rhel6/src/input/auxiliary/srg_support.xml
@@ -38,7 +38,7 @@ The requirement is impractical or out of scope.
<description>
It is unclear how to satisfy this requirement.
</description>
-<ref disa="20,31,218,219,224,1097,1158,1239,1291,1294,1295,1310,1311,1328" />
+<ref disa="20,31,218,219,224,1097,1158,1239,1291,1294,1295,1310,1311,1328,1340"
/>
</Group> <!-- end requirement_unclear -->
<Group id="new_rule_needed">
SRG-OS-000210 CCI-001340 The operating system must maintain
reviewer/releaser identity and credentials within the established chain
of custody for all information reviewed or released. When it comes to
data review and data release, there must be a correlation between the
reviewed data and the person who performs the review. If the reviewer is
a human or if the review function is automated but separate from the
release/transfer function, the operating system associates the identity
of the reviewer of the information to be released with the information
and the information label.
impractical_guidance, we are not writing a cross domain guard.
_______________________________________________
scap-security-guide mailing list
[email protected]
https://fedorahosted.org/mailman/listinfo/scap-security-guide
