FDCC – The Next Series of Milestones – March 31, 2008 Compliance Reports Due to OMB & NIST

The next phase of the OMB mandate requires government agencies to submit their FDCC system audit result sets – as exported from their NIST SCAP Validated Tools in SCAP compliant formats – to NIST for statistical analysis and review.  The reporting information should be sent to OMB at fisma@omb.eop.gov with a carbon copy to NIST at fdcc@nist.gov by March 31, 2008.  An agency or department CIO must report compliance for that organization. Compliance is expressed as a roll-up, of the compliant versus non-compliant computers. For non-compliant computers, CIOs must provide a representative sample of SCAP-based (XCCDF version 1.1.4) assessment reports. The FDCC XML reporting format is located at http://nvd.nist.gov/scap/content/fdcc-reporting_20080108.zip.  Submitted by: S. Armstrong

SCAP & FDCC Validation Process – NIST Accredited Lab

On the eve of the Feb 1, 2008 OMB mandate, Secure Elements C5 Platform went through a detailed technical analysis to attest to its ability to process the SCAP data streams and evaluate the Federal Desktop Core Configuration functionality and report production. The certification is timely in order to support the OMB March 31, 2008 deadline for reporting FDCC compliance. The public-private partnerships developed between government and industry, bringing the SCAP Validated Tools and the FDCC initiatives together, is evidence that progress is being made towards accountability in securing our infrastructure.  Industry and government must continue forward with initiatives addressing secure baselines for server technology, network infrastructure equipment and applications. I believe that SCAP based solutions are poised to evolve beyond security configuration compliance  - and will include other areas of systems and operational management – such as compliance with energy efficient settings, and other regulatory initiatives such as HIPAA, SOX, PCI, and others.

 

Submitted by: A Bove