Subject: [sacm] Proposed SACM Charter Comments feedback

From: [email-masked]
Date: Thu, 02 Aug 2012 09:37:45 -0500 (CDT)

To all:

Here's my two cents worth to the SACM charter.

Ruben David Oliva

---

From: Adam Montville <[email-masked]>
Date: Thu, 2 Aug 2012 14:55:28 +0000

David,

Thanks for the feedback on this.  Aside from the preferential language changes, there are two important additions to the list of goals.  Stated briefly they are: 1) demonstrate support for control frameworks, and 2) demonstrate support for legislation (which I take to include regulation).

I view these as important because we should seek to ensure we are meeting higher-level use cases.  I would suggest that a few informational documents be created along the way to demonstrate such support, or that a generic set of business processes or controls be enumerated, such that the derived needs of those business processes can be enumerated and addressed as appropriate by either sacm, mile, or a combination of some other SDO efforts (wether IETF or otherwise, to be frank).

Regards,

Adam

From: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Date: Thursday, August 2, 2012 7:37 AM
To: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: [sacm] Proposed SACM Charter Comments feedback

To all:

Ruben David Oliva

---

From: <[email-masked]>
Date: Thu, 2 Aug 2012 17:12:03 -0400

Great comments, Ruben!  I agree with the goals of being able to support reporting requirements against frameworks and regulations, but think we should not list specific ones in the charter.  I think the goal should be to enable the automation of tasks like maintaining the security program with the ability to prioritize risk and perform remediation activities.  Reporting is essential for many organizations, but I don't think we should be specific as to which report types or formats will be supported.  

How do people feel about having the focus within the SACM effort where we are providing the capabilities and then having ancillary work that provides the desired mapping to frameworks and regulations by the communities (or vendors) that need to support those regulations and frameworks?

Thanks,
Kathleen
________________________________________
From: [email-masked] [[email-masked]] On Behalf Of [email-masked] [[email-masked]]
Sent: Thursday, August 02, 2012 10:37 AM
To: [email-masked]
Subject: [sacm] Proposed SACM Charter Comments feedback

To all:

Ruben David Oliva

---

From: Adam Montville <[email-masked]>
Date: Thu, 2 Aug 2012 21:36:12 +0000

> How do people feel about having the focus within the SACM effort where we are providing the capabilities and then having ancillary work that provides the desired mapping to frameworks and regulatio…

Again, this is good guidance.  Would this ancillary work be simply "out there" or under the guise of informational documentation in a WG?