Subject: [sacm] SCAP moving on

From: [email-masked]
Date: Wed, 18 Dec 2013 18:31:06 -0600 (CST)

Hello SACM community.

I have not posted very much the last year and a half or so, but have been paying close attention to all the traffic, because I am still interested.

A few questions come to mind.

1. Is the SACM charter complete yet?
2. Is the SACM working group planning to take on the NIST SCAP product validation program? To this effect, I was pretty glad to see the first SCAP 1.2 product validated posted in the official NIST-SCAP website (http://nvd.nist.gov/scapproducts.cfm).  Congratulations to the Tripwire folks.
3. If NIST is working with IETF and SACM, will any information to this effect be posted at http://nvd.nist.gov/scapproducts.cfm ?

David Oliva

---

From: "Adam W. Montville" <[email-masked]>
Date: Wed, 18 Dec 2013 20:08:01 -0600

Hi David,

Welcome back.  Please find my responses inline.

Regards,

Adam

> 1. Is the SACM charter complete yet?

The charter has been complete since (IIRC) late June and was approved by the IESG in early July.  We held our first meeting as an IETF working group during IETF 87.  That's the long way to say that, yes the charter is complete and can be found here: http://datatracker.ietf.org/wg/sacm/charter/.

> 2. Is the SACM working group planning to take on the NIST SCAP product validation program? To this effect, I was pretty glad to see the first SCAP 1.2 product validated posted in the official NIST-…

While the IETF does have interoperability requirements (i.e. "running code"), it does not itself operate any sort of validation program.  Thus, the SACM working group will not take on the NIST SCAP product validation program, which may well continue to be operated by NIST - you would need to ask them of their plans.

> 3. If NIST is working with IETF and SACM, will any information to this effect be posted at http://nvd.nist.gov/scapproducts.cfm ?

Keep in mind that those participating in the SACM working group do so as individuals irrespective of how they might be sponsored.  That said, where NIST decides to post information about the standards efforts with which it may be involved is not within my purview.  You'll have to get an answer from NIST on this one :-)

> 
> David Oliva
>  
> 
> 
> _______________________________________________
> sacm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sacm