From e48fbe1f3b33e7e12f00c5affea2e6513fbe0bb0 Mon Sep 17 00:00:00 2001 From: Gabriel Becker Date: Mon, 17 Aug 2026 18:43:21 +0200 Subject: [PATCH 1/7] Copy NIST 800-53 control files from RHEL10 to Fedora Initial copy of NIST 800-53 Revision 5 control files from RHEL10 to Fedora product as a base for Fedora-specific adaptations. This commit is a direct copy without any modifications. --- products/fedora/controls/nist_800_53.yml | 15 + products/fedora/controls/nist_800_53/ac.yml | 1016 +++++++++++++++++++ products/fedora/controls/nist_800_53/at.yml | 102 ++ products/fedora/controls/nist_800_53/au.yml | 562 ++++++++++ products/fedora/controls/nist_800_53/ca.yml | 202 ++++ products/fedora/controls/nist_800_53/cm.yml | 625 ++++++++++++ products/fedora/controls/nist_800_53/cp.yml | 338 ++++++ products/fedora/controls/nist_800_53/ia.yml | 485 +++++++++ products/fedora/controls/nist_800_53/ir.yml | 251 +++++ products/fedora/controls/nist_800_53/ma.yml | 185 ++++ products/fedora/controls/nist_800_53/mp.yml | 178 ++++ products/fedora/controls/nist_800_53/pe.yml | 356 +++++++ products/fedora/controls/nist_800_53/pl.yml | 97 ++ products/fedora/controls/nist_800_53/pm.yml | 157 +++ products/fedora/controls/nist_800_53/ps.yml | 113 +++ products/fedora/controls/nist_800_53/pt.yml | 92 ++ products/fedora/controls/nist_800_53/ra.yml | 154 +++ products/fedora/controls/nist_800_53/sa.yml | 836 +++++++++++++++ products/fedora/controls/nist_800_53/sc.yml | 888 ++++++++++++++++ products/fedora/controls/nist_800_53/si.yml | 677 ++++++++++++ products/fedora/controls/nist_800_53/sr.yml | 160 +++ 21 files changed, 7489 insertions(+) create mode 100644 products/fedora/controls/nist_800_53.yml create mode 100644 products/fedora/controls/nist_800_53/ac.yml create mode 100644 products/fedora/controls/nist_800_53/at.yml create mode 100644 products/fedora/controls/nist_800_53/au.yml create mode 100644 products/fedora/controls/nist_800_53/ca.yml create mode 100644 products/fedora/controls/nist_800_53/cm.yml create mode 100644 products/fedora/controls/nist_800_53/cp.yml create mode 100644 products/fedora/controls/nist_800_53/ia.yml create mode 100644 products/fedora/controls/nist_800_53/ir.yml create mode 100644 products/fedora/controls/nist_800_53/ma.yml create mode 100644 products/fedora/controls/nist_800_53/mp.yml create mode 100644 products/fedora/controls/nist_800_53/pe.yml create mode 100644 products/fedora/controls/nist_800_53/pl.yml create mode 100644 products/fedora/controls/nist_800_53/pm.yml create mode 100644 products/fedora/controls/nist_800_53/ps.yml create mode 100644 products/fedora/controls/nist_800_53/pt.yml create mode 100644 products/fedora/controls/nist_800_53/ra.yml create mode 100644 products/fedora/controls/nist_800_53/sa.yml create mode 100644 products/fedora/controls/nist_800_53/sc.yml create mode 100644 products/fedora/controls/nist_800_53/si.yml create mode 100644 products/fedora/controls/nist_800_53/sr.yml diff --git a/products/fedora/controls/nist_800_53.yml b/products/fedora/controls/nist_800_53.yml new file mode 100644 index 000000000000..78f26dcbc284 --- /dev/null +++ b/products/fedora/controls/nist_800_53.yml @@ -0,0 +1,15 @@ +policy: NIST 800-53 Revision 5 (RHEL10) +title: NIST Special Publication 800-53 Revision 5 for RHEL10 +id: nist_800_53 +version: Revision 5 +source: https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final +product: rhel10 +controls_dir: nist_800_53 +levels: + - id: low + - id: moderate + inherits_from: + - low + - id: high + inherits_from: + - moderate diff --git a/products/fedora/controls/nist_800_53/ac.yml b/products/fedora/controls/nist_800_53/ac.yml new file mode 100644 index 000000000000..43ce0aeb9f73 --- /dev/null +++ b/products/fedora/controls/nist_800_53/ac.yml @@ -0,0 +1,1016 @@ +# NIST 800-53 AC Family: Access Control +controls: + - id: ac-1 + title: Policy and Procedures + levels: + - low + rules: [] + status: pending + - id: ac-2 + title: Account Management + levels: + - low + rules: [] + status: pending + controls: + - id: ac-2.1 + title: Automated System Account Management + levels: + - moderate + rules: [] + status: pending + - id: ac-2.2 + title: Automated Temporary and Emergency Account Management + levels: + - moderate + rules: [] + status: pending + - id: ac-2.3 + title: Disable Accounts + levels: + - moderate + rules: [] + status: pending + - id: ac-2.4 + title: Automated Audit Actions + levels: + - moderate + rules: [] + status: pending + - id: ac-2.5 + title: Inactivity Logout + levels: + - moderate + rules: + - accounts_tmout + - no_invalid_shell_accounts_unlocked + - no_password_auth_for_systemaccounts + - no_shelllogin_for_systemaccounts + - inactivity_timeout_value=15_minutes + - var_accounts_tmout=15_min + status: automated + - id: ac-2.6 + title: Dynamic Privilege Management + rules: [] + status: pending + levels: + - low + - id: ac-2.7 + title: Privileged User Accounts + rules: [] + status: pending + levels: + - low + - id: ac-2.8 + title: Dynamic Account Management + rules: [] + status: pending + levels: + - low + - id: ac-2.9 + title: Restrictions on Use of Shared and Group Accounts + rules: [] + status: pending + levels: + - low + - id: ac-2.10 + title: Shared and Group Account Credential Change + rules: [] + status: pending + levels: + - low + - id: ac-2.11 + title: Usage Conditions + levels: + - high + rules: [] + status: pending + - id: ac-2.12 + title: Account Monitoring for Atypical Usage + levels: + - high + rules: [] + status: pending + - id: ac-2.13 + title: Disable Accounts for High-risk Individuals + levels: + - moderate + rules: [] + status: pending + - id: ac-3 + title: Access Enforcement + levels: + - low + rules: + - accounts_umask_etc_bashrc + - accounts_umask_etc_login_defs + - accounts_umask_etc_profile + - accounts_umask_root + - audit_rules_immutable + - dir_perms_world_writable_sticky_bits + - directory_groupowner_sshd_config_d + - directory_owner_sshd_config_d + - directory_permissions_sshd_config_d + - ensure_pam_wheel_group_empty + - file_at_allow_exists + - file_at_deny_not_exist + - file_cron_allow_exists + - file_cron_deny_not_exist + - file_groupowner_at_allow + - file_groupowner_backup_etc_group + - file_groupowner_backup_etc_gshadow + - file_groupowner_backup_etc_passwd + - file_groupowner_backup_etc_shadow + - file_groupowner_cron_allow + - file_groupowner_cron_d + - file_groupowner_cron_daily + - file_groupowner_cron_hourly + - file_groupowner_cron_monthly + - file_groupowner_cron_weekly + - file_groupowner_cron_yearly + - file_groupowner_crontab + - file_groupowner_etc_group + - file_groupowner_etc_gshadow + - file_groupowner_etc_issue + - file_groupowner_etc_issue_net + - file_groupowner_etc_motd + - file_groupowner_etc_passwd + - file_groupowner_etc_security_opasswd + - file_groupowner_etc_security_opasswd_old + - file_groupowner_etc_shadow + - file_groupowner_etc_shells + - file_groupowner_sshd_config + - file_groupowner_sshd_drop_in_config + - file_groupownership_sshd_private_key + - file_groupownership_sshd_pub_key + - file_owner_at_allow + - file_owner_backup_etc_group + - file_owner_backup_etc_gshadow + - file_owner_backup_etc_passwd + - file_owner_backup_etc_shadow + - file_owner_cron_allow + - file_owner_cron_d + - file_owner_cron_daily + - file_owner_cron_hourly + - file_owner_cron_monthly + - file_owner_cron_weekly + - file_owner_cron_yearly + - file_owner_crontab + - file_owner_etc_group + - file_owner_etc_gshadow + - file_owner_etc_issue + - file_owner_etc_issue_net + - file_owner_etc_motd + - file_owner_etc_passwd + - file_owner_etc_security_opasswd + - file_owner_etc_security_opasswd_old + - file_owner_etc_shadow + - file_owner_etc_shells + - file_owner_sshd_config + - file_owner_sshd_drop_in_config + - file_ownership_sshd_private_key + - file_ownership_sshd_pub_key + - file_permissions_at_allow + - file_permissions_backup_etc_group + - file_permissions_backup_etc_gshadow + - file_permissions_backup_etc_passwd + - file_permissions_backup_etc_shadow + - file_permissions_cron_allow + - file_permissions_cron_d + - file_permissions_cron_daily + - file_permissions_cron_hourly + - file_permissions_cron_monthly + - file_permissions_cron_weekly + - file_permissions_cron_yearly + - file_permissions_crontab + - file_permissions_etc_group + - file_permissions_etc_gshadow + - file_permissions_etc_issue + - file_permissions_etc_issue_net + - file_permissions_etc_motd + - file_permissions_etc_passwd + - file_permissions_etc_security_opasswd + - file_permissions_etc_security_opasswd_old + - file_permissions_etc_shadow + - file_permissions_etc_shells + - file_permissions_sshd_config + - file_permissions_sshd_drop_in_config + - file_permissions_sshd_private_key + - file_permissions_sshd_pub_key + - file_permissions_unauthorized_world_writable + - grub2_enable_selinux + - grub2_password + - mount_option_dev_shm_nodev + - mount_option_dev_shm_noexec + - mount_option_dev_shm_nosuid + - mount_option_home_nodev + - mount_option_home_nosuid + - mount_option_tmp_noexec + - mount_option_tmp_nosuid + - mount_option_var_log_audit_nodev + - mount_option_var_log_audit_noexec + - mount_option_var_log_audit_nosuid + - mount_option_var_log_nodev + - mount_option_var_log_noexec + - mount_option_var_log_nosuid + - mount_option_var_nodev + - mount_option_var_nosuid + - mount_option_var_tmp_nodev + - mount_option_var_tmp_noexec + - mount_option_var_tmp_nosuid + - package_libselinux_installed + - package_mcstrans_removed + - package_setroubleshoot_removed + - rsyslog_filecreatemode + - rsyslog_files_groupownership + - rsyslog_files_ownership + - rsyslog_files_permissions + - selinux_not_disabled + - selinux_policytype + - sshd_limit_user_access + - sysctl_fs_protected_hardlinks + - sysctl_fs_protected_symlinks + - use_pam_wheel_group_for_su + - var_accounts_user_umask=027 + - var_pam_wheel_group_for_su=cis + - var_selinux_policy_name=targeted + status: automated + controls: + - id: ac-3.1 + title: Restricted Access to Privileged Functions + rules: [] + status: pending + levels: + - low + - id: ac-3.2 + title: Dual Authorization + rules: [] + status: pending + levels: + - low + - id: ac-3.3 + title: Mandatory Access Control + rules: [] + status: pending + levels: + - low + - id: ac-3.4 + title: Discretionary Access Control + rules: [] + status: pending + levels: + - low + - id: ac-3.5 + title: Security-relevant Information + rules: [] + status: pending + levels: + - low + - id: ac-3.6 + title: Protection of User and System Information + rules: [] + status: pending + levels: + - low + - id: ac-3.7 + title: Role-based Access Control + rules: [] + status: pending + levels: + - low + - id: ac-3.8 + title: Revocation of Access Authorizations + rules: [] + status: pending + levels: + - low + - id: ac-3.9 + title: Controlled Release + rules: [] + status: pending + levels: + - low + - id: ac-3.10 + title: Audited Override of Access Control Mechanisms + rules: [] + status: pending + levels: + - low + - id: ac-3.11 + title: Restrict Access to Specific Information Types + rules: [] + status: pending + levels: + - low + - id: ac-3.12 + title: Assert and Enforce Application Access + rules: [] + status: pending + levels: + - low + - id: ac-3.13 + title: Attribute-based Access Control + rules: [] + status: pending + levels: + - low + - id: ac-3.14 + title: Individual Access + rules: [] + status: pending + levels: + - low + - id: ac-3.15 + title: Discretionary and Mandatory Access Control + rules: [] + status: pending + levels: + - low + - id: ac-4 + title: Information Flow Enforcement + levels: + - moderate + rules: [] + status: pending + controls: + - id: ac-4.1 + title: Object Security and Privacy Attributes + rules: [] + status: pending + levels: + - moderate + - id: ac-4.2 + title: Processing Domains + rules: [] + status: pending + levels: + - moderate + - id: ac-4.3 + title: Dynamic Information Flow Control + rules: [] + status: pending + levels: + - moderate + - id: ac-4.4 + title: Flow Control of Encrypted Information + levels: + - high + rules: [] + status: pending + - id: ac-4.5 + title: Embedded Data Types + rules: [] + status: pending + levels: + - moderate + - id: ac-4.6 + title: Metadata + rules: [] + status: pending + levels: + - moderate + - id: ac-4.7 + title: One-way Flow Mechanisms + rules: [] + status: pending + levels: + - moderate + - id: ac-4.8 + title: Security and Privacy Policy Filters + rules: [] + status: pending + levels: + - moderate + - id: ac-4.9 + title: Human Reviews + rules: [] + status: pending + levels: + - moderate + - id: ac-4.10 + title: Enable and Disable Security or Privacy Policy Filters + rules: [] + status: pending + levels: + - moderate + - id: ac-4.11 + title: Configuration of Security or Privacy Policy Filters + rules: [] + status: pending + levels: + - moderate + - id: ac-4.12 + title: Data Type Identifiers + rules: [] + status: pending + levels: + - moderate + - id: ac-4.13 + title: Decomposition into Policy-relevant Subcomponents + rules: [] + status: pending + levels: + - moderate + - id: ac-4.14 + title: Security or Privacy Policy Filter Constraints + rules: [] + status: pending + levels: + - moderate + - id: ac-4.15 + title: Detection of Unsanctioned Information + rules: [] + status: pending + levels: + - moderate + - id: ac-4.16 + title: Information Transfers on Interconnected Systems + rules: [] + status: pending + levels: + - moderate + - id: ac-4.17 + title: Domain Authentication + rules: [] + status: pending + levels: + - moderate + - id: ac-4.18 + title: Security Attribute Binding + rules: [] + status: pending + levels: + - moderate + - id: ac-4.19 + title: Validation of Metadata + rules: [] + status: pending + levels: + - moderate + - id: ac-4.20 + title: Approved Solutions + rules: [] + status: pending + levels: + - moderate + - id: ac-4.21 + title: Physical or Logical Separation of Information Flows + rules: [] + status: pending + levels: + - moderate + - id: ac-4.22 + title: Access Only + rules: [] + status: pending + levels: + - moderate + - id: ac-4.23 + title: Modify Non-releasable Information + rules: [] + status: pending + levels: + - moderate + - id: ac-4.24 + title: Internal Normalized Format + rules: [] + status: pending + levels: + - moderate + - id: ac-4.25 + title: Data Sanitization + rules: [] + status: pending + levels: + - moderate + - id: ac-4.26 + title: Audit Filtering Actions + rules: [] + status: pending + levels: + - moderate + - id: ac-4.27 + title: Redundant/Independent Filtering Mechanisms + rules: [] + status: pending + levels: + - moderate + - id: ac-4.28 + title: Linear Filter Pipelines + rules: [] + status: pending + levels: + - moderate + - id: ac-4.29 + title: Filter Orchestration Engines + rules: [] + status: pending + levels: + - moderate + - id: ac-4.30 + title: Filter Mechanisms Using Multiple Processes + rules: [] + status: pending + levels: + - moderate + - id: ac-4.31 + title: Failed Content Transfer Prevention + rules: [] + status: pending + levels: + - moderate + - id: ac-4.32 + title: Process Requirements for Information Transfer + rules: [] + status: pending + levels: + - moderate + - id: ac-5 + title: Separation of Duties + levels: + - moderate + rules: [] + status: pending + - id: ac-6 + title: Least Privilege + levels: + - moderate + rules: + - sshd_disable_root_login + - sudo_add_use_pty + - sudo_remove_no_authenticate + - sudo_remove_nopasswd + status: automated + controls: + - id: ac-6.1 + title: Authorize Access to Security Functions + levels: + - moderate + rules: [] + status: pending + - id: ac-6.2 + title: Non-privileged Access for Nonsecurity Functions + levels: + - moderate + rules: + - package_sudo_installed + status: automated + - id: ac-6.3 + title: Network Access to Privileged Commands + levels: + - high + rules: [] + status: pending + - id: ac-6.4 + title: Separate Processing Domains + rules: [] + status: pending + levels: + - moderate + - id: ac-6.5 + title: Privileged Accounts + levels: + - moderate + rules: [] + status: pending + - id: ac-6.6 + title: Privileged Access by Non-organizational Users + rules: [] + status: pending + levels: + - moderate + - id: ac-6.7 + title: Review of User Privileges + levels: + - moderate + rules: [] + status: pending + - id: ac-6.8 + title: Privilege Levels for Code Execution + rules: [] + status: pending + levels: + - moderate + - id: ac-6.9 + title: Log Use of Privileged Functions + levels: + - moderate + rules: [] + status: pending + - id: ac-6.10 + title: Prohibit Non-privileged Users from Executing Privileged + Functions + levels: + - moderate + rules: [] + status: pending + - id: ac-7 + title: Unsuccessful Logon Attempts + levels: + - low + rules: + - account_password_pam_faillock_password_auth + - account_password_pam_faillock_system_auth + - accounts_passwords_pam_faillock_deny + - accounts_passwords_pam_faillock_even_deny_root_or_root_unlock_time + - accounts_passwords_pam_faillock_unlock_time_with_zero + - var_accounts_passwords_pam_faillock_deny=5 + - var_accounts_passwords_pam_faillock_dir=run + - var_accounts_passwords_pam_faillock_root_unlock_time=60 + - var_accounts_passwords_pam_faillock_unlock_time=900 + status: automated + controls: + - id: ac-7.1 + title: Automatic Account Lock + rules: [] + status: pending + levels: + - low + - id: ac-7.2 + title: Purge or Wipe Mobile Device + rules: [] + status: pending + levels: + - low + - id: ac-7.3 + title: Biometric Attempt Limiting + rules: [] + status: pending + levels: + - low + - id: ac-7.4 + title: Use of Alternate Authentication Factor + rules: [] + status: pending + levels: + - low + - id: ac-8 + title: System Use Notification + levels: + - low + rules: + - dconf_gnome_banner_enabled + - dconf_gnome_login_banner_text + status: automated + - id: ac-9 + title: Previous Logon Notification + rules: [] + status: pending + controls: + - id: ac-9.1 + title: Unsuccessful Logons + rules: [] + status: pending + - id: ac-9.2 + title: Successful and Unsuccessful Logons + rules: [] + status: pending + - id: ac-9.3 + title: Notification of Account Changes + rules: [] + status: pending + - id: ac-9.4 + title: Additional Logon Information + rules: [] + status: pending + - id: ac-10 + title: Concurrent Session Control + levels: + - high + rules: [] + status: pending + - id: ac-11 + title: Device Lock + levels: + - moderate + rules: + - dconf_gnome_screensaver_idle_delay + - dconf_gnome_screensaver_lock_delay + - dconf_gnome_screensaver_user_locks + - dconf_gnome_session_idle_user_locks + - var_screensaver_lock_delay=5_seconds + status: automated + controls: + - id: ac-11.1 + title: Pattern-hiding Displays + levels: + - moderate + rules: [] + status: pending + - id: ac-12 + title: Session Termination + levels: + - moderate + rules: [] + status: pending + controls: + - id: ac-12.1 + title: User-initiated Logouts + rules: [] + status: pending + levels: + - moderate + - id: ac-12.2 + title: Termination Message + rules: [] + status: pending + levels: + - moderate + - id: ac-12.3 + title: Timeout Warning Message + rules: [] + status: pending + levels: + - moderate + - id: ac-13 + title: Supervision and Review — Access Control + rules: [] + status: pending + - id: ac-14 + title: Permitted Actions Without Identification or Authentication + levels: + - low + rules: [] + status: pending + controls: + - id: ac-14.1 + title: Necessary Uses + rules: [] + status: pending + levels: + - low + - id: ac-15 + title: Automated Marking + rules: [] + status: pending + - id: ac-16 + title: Security and Privacy Attributes + rules: [] + status: pending + controls: + - id: ac-16.1 + title: Dynamic Attribute Association + rules: [] + status: pending + - id: ac-16.2 + title: Attribute Value Changes by Authorized Individuals + rules: [] + status: pending + - id: ac-16.3 + title: Maintenance of Attribute Associations by System + rules: [] + status: pending + - id: ac-16.4 + title: Association of Attributes by Authorized Individuals + rules: [] + status: pending + - id: ac-16.5 + title: Attribute Displays on Objects to Be Output + rules: [] + status: pending + - id: ac-16.6 + title: Maintenance of Attribute Association + rules: [] + status: pending + - id: ac-16.7 + title: Consistent Attribute Interpretation + rules: [] + status: pending + - id: ac-16.8 + title: Association Techniques and Technologies + rules: [] + status: pending + - id: ac-16.9 + title: Attribute Reassignment — Regrading Mechanisms + rules: [] + status: pending + - id: ac-16.10 + title: Attribute Configuration by Authorized Individuals + rules: [] + status: pending + - id: ac-17 + title: Remote Access + levels: + - low + rules: + - configure_custom_crypto_policy_cis + status: automated + controls: + - id: ac-17.1 + title: Monitoring and Control + levels: + - moderate + rules: [] + status: pending + - id: ac-17.2 + title: Protection of Confidentiality and Integrity Using Encryption + levels: + - moderate + rules: [] + status: pending + - id: ac-17.3 + title: Managed Access Control Points + levels: + - moderate + rules: [] + status: pending + - id: ac-17.4 + title: Privileged Commands and Access + levels: + - moderate + rules: [] + status: pending + - id: ac-17.5 + title: Monitoring for Unauthorized Connections + rules: [] + status: pending + levels: + - low + - id: ac-17.6 + title: Protection of Mechanism Information + rules: [] + status: pending + levels: + - low + - id: ac-17.7 + title: Additional Protection for Security Function Access + rules: [] + status: pending + levels: + - low + - id: ac-17.8 + title: Disable Nonsecure Network Protocols + rules: [] + status: pending + levels: + - low + - id: ac-17.9 + title: Disconnect or Disable Access + rules: [] + status: pending + levels: + - low + - id: ac-17.10 + title: Authenticate Remote Commands + rules: [] + status: pending + levels: + - low + - id: ac-18 + title: Wireless Access + levels: + - low + rules: + - wireless_disable_interfaces + status: automated + controls: + - id: ac-18.1 + title: Authentication and Encryption + levels: + - moderate + rules: [] + status: pending + - id: ac-18.2 + title: Monitoring Unauthorized Connections + rules: [] + status: pending + levels: + - low + - id: ac-18.3 + title: Disable Wireless Networking + levels: + - moderate + rules: [] + status: pending + - id: ac-18.4 + title: Restrict Configurations by Users + levels: + - high + rules: [] + status: pending + - id: ac-18.5 + title: Antennas and Transmission Power Levels + levels: + - high + rules: [] + status: pending + - id: ac-19 + title: Access Control for Mobile Devices + levels: + - low + rules: [] + status: pending + controls: + - id: ac-19.1 + title: Use of Writable and Portable Storage Devices + rules: [] + status: pending + levels: + - low + - id: ac-19.2 + title: Use of Personally Owned Portable Storage Devices + rules: [] + status: pending + levels: + - low + - id: ac-19.3 + title: Use of Portable Storage Devices with No Identifiable Owner + rules: [] + status: pending + levels: + - low + - id: ac-19.4 + title: Restrictions for Classified Information + rules: [] + status: pending + levels: + - low + - id: ac-19.5 + title: Full Device or Container-based Encryption + levels: + - moderate + rules: [] + status: pending + - id: ac-20 + title: Use of External Systems + levels: + - low + rules: [] + status: pending + controls: + - id: ac-20.1 + title: Limits on Authorized Use + levels: + - moderate + rules: [] + status: pending + - id: ac-20.2 + title: Portable Storage Devices — Restricted Use + levels: + - moderate + rules: [] + status: pending + - id: ac-20.3 + title: Non-organizationally Owned Systems — Restricted Use + rules: [] + status: pending + levels: + - low + - id: ac-20.4 + title: Network Accessible Storage Devices — Prohibited Use + rules: [] + status: pending + levels: + - low + - id: ac-20.5 + title: Portable Storage Devices — Prohibited Use + rules: [] + status: pending + levels: + - low + - id: ac-21 + title: Information Sharing + levels: + - moderate + rules: [] + status: pending + controls: + - id: ac-21.1 + title: Automated Decision Support + rules: [] + status: pending + levels: + - moderate + - id: ac-21.2 + title: Information Search and Retrieval + rules: [] + status: pending + levels: + - moderate + - id: ac-22 + title: Publicly Accessible Content + levels: + - low + rules: [] + status: pending + - id: ac-23 + title: Data Mining Protection + rules: [] + status: pending + - id: ac-24 + title: Access Control Decisions + rules: [] + status: pending + controls: + - id: ac-24.1 + title: Transmit Access Authorization Information + rules: [] + status: pending + - id: ac-24.2 + title: No User or Process Identity + rules: [] + status: pending + - id: ac-25 + title: Reference Monitor + rules: [] + status: pending diff --git a/products/fedora/controls/nist_800_53/at.yml b/products/fedora/controls/nist_800_53/at.yml new file mode 100644 index 000000000000..0e944a946054 --- /dev/null +++ b/products/fedora/controls/nist_800_53/at.yml @@ -0,0 +1,102 @@ +# NIST 800-53 AT Family: Awareness and Training +controls: + - id: at-1 + title: Policy and Procedures + levels: + - low + rules: [] + status: pending + - id: at-2 + title: Literacy Training and Awareness + levels: + - low + rules: [] + status: pending + controls: + - id: at-2.1 + title: Practical Exercises + rules: [] + status: pending + levels: + - low + - id: at-2.2 + title: Insider Threat + levels: + - low + rules: [] + status: pending + - id: at-2.3 + title: Social Engineering and Mining + levels: + - moderate + rules: [] + status: pending + - id: at-2.4 + title: Suspicious Communications and Anomalous System Behavior + rules: [] + status: pending + levels: + - low + - id: at-2.5 + title: Advanced Persistent Threat + rules: [] + status: pending + levels: + - low + - id: at-2.6 + title: Cyber Threat Environment + rules: [] + status: pending + levels: + - low + - id: at-3 + title: Role-based Training + levels: + - low + rules: [] + status: pending + controls: + - id: at-3.1 + title: Environmental Controls + rules: [] + status: pending + levels: + - low + - id: at-3.2 + title: Physical Security Controls + rules: [] + status: pending + levels: + - low + - id: at-3.3 + title: Practical Exercises + rules: [] + status: pending + levels: + - low + - id: at-3.4 + title: Suspicious Communications and Anomalous System Behavior + rules: [] + status: pending + levels: + - low + - id: at-3.5 + title: Processing Personally Identifiable Information + rules: [] + status: pending + levels: + - low + - id: at-4 + title: Training Records + levels: + - low + rules: [] + status: pending + - id: at-5 + title: Contacts with Security Groups and Associations + rules: [] + status: pending + - id: at-6 + title: Training Feedback + rules: [] + status: pending diff --git a/products/fedora/controls/nist_800_53/au.yml b/products/fedora/controls/nist_800_53/au.yml new file mode 100644 index 000000000000..0118e345f5c0 --- /dev/null +++ b/products/fedora/controls/nist_800_53/au.yml @@ -0,0 +1,562 @@ +# NIST 800-53 AU Family: Audit and Accountability +controls: + - id: au-1 + title: Policy and Procedures + levels: + - low + rules: [] + status: pending + - id: au-2 + title: Event Logging + levels: + - low + rules: + - aide_build_database + - aide_periodic_cron_checking + - audit_rules_execution_chacl + - audit_rules_execution_chcon + - audit_rules_execution_setfacl + - audit_rules_privileged_commands_usermod + - auditd_data_disk_error_action + - auditd_data_disk_full_action + - auditd_data_retention_action_mail_acct + - auditd_data_retention_admin_space_left_action + - auditd_data_retention_space_left_action + - grub2_audit_backlog_limit_argument + - journald_disable_forward_to_syslog + - package_aide_installed + - package_audit-libs_installed + - package_audit_installed + - package_systemd-journal-remote_installed + - service_auditd_enabled + - service_systemd-journal-upload_enabled + - service_systemd-journald_enabled + - socket_systemd-journal-remote_disabled + - ensure_journald_and_rsyslog_not_active_together + - var_audit_backlog_limit=8192 + - var_auditd_action_mail_acct=root + - var_auditd_admin_space_left_action=cis_rhel10 + - var_auditd_space_left_action=cis_rhel10 + status: automated + controls: + - id: au-2.1 + title: Compilation of Audit Records from Multiple Sources + rules: [] + status: pending + levels: + - low + - id: au-2.2 + title: Selection of Audit Events by Component + rules: [] + status: pending + levels: + - low + - id: au-2.3 + title: Reviews and Updates + rules: [] + status: pending + levels: + - low + - id: au-2.4 + title: Privileged Functions + rules: [] + status: pending + levels: + - low + - id: au-3 + title: Content of Audit Records + levels: + - low + rules: + - audit_rules_dac_modification_chmod + - audit_rules_dac_modification_chown + - audit_rules_dac_modification_fchmod + - audit_rules_dac_modification_fchmodat + - audit_rules_dac_modification_fchown + - audit_rules_dac_modification_fchownat + - audit_rules_dac_modification_fremovexattr + - audit_rules_dac_modification_fsetxattr + - audit_rules_dac_modification_lchown + - audit_rules_dac_modification_lremovexattr + - audit_rules_dac_modification_lsetxattr + - audit_rules_dac_modification_removexattr + - audit_rules_dac_modification_setxattr + - audit_rules_kernel_module_loading_delete + - audit_rules_kernel_module_loading_finit + - audit_rules_kernel_module_loading_init + - audit_rules_kernel_module_loading_query + - audit_rules_login_events_faillock + - audit_rules_login_events_lastlog + - audit_rules_mac_modification_etc_selinux + - audit_rules_mac_modification_usr_share + - audit_rules_networkconfig_modification_etc_hosts + - audit_rules_networkconfig_modification_etc_issue + - audit_rules_networkconfig_modification_etc_issue_net + - audit_rules_networkconfig_modification_etc_networkmanager_system_connections + - audit_rules_networkconfig_modification_etc_sysconfig_network + - audit_rules_networkconfig_modification_hostname_file + - audit_rules_networkconfig_modification_networkmanager + - audit_rules_networkconfig_modification_setdomainname + - audit_rules_networkconfig_modification_sethostname + - audit_rules_privileged_commands + - audit_rules_privileged_commands_kmod + - audit_rules_session_events_btmp + - audit_rules_session_events_utmp + - audit_rules_session_events_wtmp + - audit_rules_suid_auid_privilege_function + - audit_rules_sysadmin_actions + - audit_rules_time_adjtimex + - audit_rules_time_clock_settime + - audit_rules_time_settimeofday + - audit_rules_time_watch_localtime + - audit_rules_unsuccessful_file_modification_creat + - audit_rules_unsuccessful_file_modification_ftruncate + - audit_rules_unsuccessful_file_modification_open + - audit_rules_unsuccessful_file_modification_openat + - audit_rules_unsuccessful_file_modification_truncate + - audit_rules_usergroup_modification_group + - audit_rules_usergroup_modification_gshadow + - audit_rules_usergroup_modification_nsswitch_conf + - audit_rules_usergroup_modification_opasswd + - audit_rules_usergroup_modification_pam_conf + - audit_rules_usergroup_modification_pamd + - audit_rules_usergroup_modification_passwd + - audit_rules_usergroup_modification_shadow + - chronyd_specify_remote_server + - directory_permissions_var_log_audit + - file_groupownership_audit_binaries + - file_ownership_var_log_audit_stig + - file_permissions_audit_binaries + - journald_storage + - sshd_set_loglevel_verbose + - sshd_set_max_auth_tries + - sudo_custom_logfile + - sysctl_net_ipv4_conf_all_log_martians + - sysctl_net_ipv4_conf_default_log_martians + - chronyd_run_as_chrony_user + - sshd_max_auth_tries_value=4 + - var_multiple_time_servers=rhel + status: automated + controls: + - id: au-3.1 + title: Additional Audit Information + levels: + - moderate + rules: [] + status: pending + - id: au-3.2 + title: Centralized Management of Planned Audit Record Content + rules: [] + status: pending + levels: + - low + - id: au-3.3 + title: Limit Personally Identifiable Information Elements + rules: [] + status: pending + levels: + - low + - id: au-4 + title: Audit Log Storage Capacity + levels: + - low + rules: + - journald_compress + status: automated + controls: + - id: au-4.1 + title: Transfer to Alternate Storage + rules: [] + status: pending + levels: + - low + - id: au-5 + title: Response to Audit Logging Process Failures + levels: + - low + rules: + - auditd_data_disk_error_action + - auditd_data_disk_full_action + - var_auditd_disk_error_action=cis_rhel10 + - var_auditd_disk_full_action=cis_rhel10 + status: automated + controls: + - id: au-5.1 + title: Storage Capacity Warning + levels: + - high + rules: [] + status: pending + - id: au-5.2 + title: Real-time Alerts + levels: + - high + rules: [] + status: pending + - id: au-5.3 + title: Configurable Traffic Volume Thresholds + rules: [] + status: pending + levels: + - low + - id: au-5.4 + title: Shutdown on Failure + rules: [] + status: pending + levels: + - low + - id: au-5.5 + title: Alternate Audit Logging Capability + rules: [] + status: pending + levels: + - low + - id: au-6 + title: Audit Record Review, Analysis, and Reporting + levels: + - low + rules: [] + status: pending + controls: + - id: au-6.1 + title: Automated Process Integration + levels: + - moderate + rules: [] + status: pending + - id: au-6.2 + title: Automated Security Alerts + rules: [] + status: pending + levels: + - low + - id: au-6.3 + title: Correlate Audit Record Repositories + levels: + - moderate + rules: [] + status: pending + - id: au-6.4 + title: Central Review and Analysis + rules: [] + status: pending + levels: + - low + - id: au-6.5 + title: Integrated Analysis of Audit Records + levels: + - high + rules: [] + status: pending + - id: au-6.6 + title: Correlation with Physical Monitoring + levels: + - high + rules: [] + status: pending + - id: au-6.7 + title: Permitted Actions + rules: [] + status: pending + levels: + - low + - id: au-6.8 + title: Full Text Analysis of Privileged Commands + rules: [] + status: pending + levels: + - low + - id: au-6.9 + title: Correlation with Information from Nontechnical Sources + rules: [] + status: pending + levels: + - low + - id: au-6.10 + title: Audit Level Adjustment + rules: [] + status: pending + levels: + - low + - id: au-7 + title: Audit Record Reduction and Report Generation + levels: + - moderate + rules: [] + status: pending + controls: + - id: au-7.1 + title: Automatic Processing + levels: + - moderate + rules: [] + status: pending + - id: au-7.2 + title: Automatic Sort and Search + rules: [] + status: pending + levels: + - moderate + - id: au-8 + title: Time Stamps + levels: + - low + rules: + - auditd_data_retention_max_log_file + - auditd_data_retention_max_log_file_action + - var_auditd_max_log_file=8 + - var_auditd_max_log_file_action=keep_logs + status: automated + controls: + - id: au-8.1 + title: Synchronization with Authoritative Time Source + rules: [] + status: pending + levels: + - low + - id: au-8.2 + title: Secondary Authoritative Time Source + rules: [] + status: pending + levels: + - low + - id: au-9 + title: Protection of Audit Information + levels: + - low + rules: + - audit_rules_immutable + - file_groupownership_audit_configuration + - file_ownership_audit_binaries + - file_ownership_audit_configuration + status: automated + controls: + - id: au-9.1 + title: Hardware Write-once Media + rules: [] + status: pending + levels: + - low + - id: au-9.2 + title: Store on Separate Physical Systems or Components + levels: + - high + rules: [] + status: pending + - id: au-9.3 + title: Cryptographic Protection + levels: + - high + rules: + - aide_check_audit_tools + status: automated + - id: au-9.4 + title: Access by Subset of Privileged Users + levels: + - moderate + rules: + - file_group_ownership_var_log_audit + - file_permissions_var_log_audit + status: automated + - id: au-9.5 + title: Dual Authorization + rules: [] + status: pending + levels: + - low + - id: au-9.6 + title: Read-only Access + rules: [] + status: pending + levels: + - low + - id: au-9.7 + title: Store on Component with Different Operating System + rules: [] + status: pending + levels: + - low + - id: au-10 + title: Non-repudiation + levels: + - high + rules: [] + status: pending + controls: + - id: au-10.1 + title: Association of Identities + rules: [] + status: pending + levels: + - high + - id: au-10.2 + title: Validate Binding of Information Producer Identity + rules: [] + status: pending + levels: + - high + - id: au-10.3 + title: Chain of Custody + rules: [] + status: pending + levels: + - high + - id: au-10.4 + title: Validate Binding of Information Reviewer Identity + rules: [] + status: pending + levels: + - high + - id: au-10.5 + title: Digital Signatures + rules: [] + status: pending + levels: + - high + - id: au-11 + title: Audit Record Retention + levels: + - low + rules: [] + status: pending + controls: + - id: au-11.1 + title: Long-term Retrieval Capability + rules: [] + status: pending + levels: + - low + - id: au-12 + title: Audit Record Generation + levels: + - low + rules: + - audit_rules_dac_modification_chmod + - audit_rules_dac_modification_chown + - audit_rules_dac_modification_fchmod + - audit_rules_dac_modification_fchmodat + - audit_rules_dac_modification_fchmodat2 + - audit_rules_dac_modification_fchown + - audit_rules_dac_modification_fchownat + - audit_rules_dac_modification_fremovexattr + - audit_rules_dac_modification_fsetxattr + - audit_rules_dac_modification_lchown + - audit_rules_dac_modification_lremovexattr + - audit_rules_dac_modification_lsetxattr + - audit_rules_dac_modification_removexattr + - audit_rules_dac_modification_setxattr + - audit_rules_continue_loading + - audit_rules_execution_chcon + - audit_rules_file_deletion_events_rename + - audit_rules_file_deletion_events_renameat + - audit_rules_file_deletion_events_renameat2 + - audit_rules_file_deletion_events_unlink + - audit_rules_file_deletion_events_unlinkat + - audit_rules_kernel_module_loading_delete + - audit_rules_kernel_module_loading_finit + - audit_rules_kernel_module_loading_init + - audit_rules_kernel_module_loading_query + - audit_rules_login_events_faillock + - audit_rules_login_events_lastlog + - audit_rules_media_export + - audit_rules_privileged_commands_kmod + - audit_rules_privileged_commands_usermod + - audit_rules_sysadmin_actions + - audit_rules_unsuccessful_file_modification_creat + - audit_rules_unsuccessful_file_modification_ftruncate + - audit_rules_unsuccessful_file_modification_open + - audit_rules_unsuccessful_file_modification_openat + - audit_rules_unsuccessful_file_modification_truncate + - audit_rules_usergroup_modification_group + - audit_rules_usergroup_modification_gshadow + - audit_rules_usergroup_modification_nsswitch_conf + - audit_rules_usergroup_modification_opasswd + - audit_rules_usergroup_modification_pam_conf + - audit_rules_usergroup_modification_pamd + - audit_rules_usergroup_modification_passwd + - audit_rules_usergroup_modification_shadow + - audit_sudo_log_events + - file_permissions_audit_configuration + - grub2_audit_argument + - service_auditd_enabled + status: automated + controls: + - id: au-12.1 + title: System-wide and Time-correlated Audit Trail + levels: + - high + rules: [] + status: pending + - id: au-12.2 + title: Standardized Formats + rules: [] + status: pending + levels: + - low + - id: au-12.3 + title: Changes by Authorized Individuals + levels: + - high + rules: [] + status: pending + - id: au-12.4 + title: Query Parameter Audits of Personally Identifiable Information + rules: [] + status: pending + levels: + - low + - id: au-13 + title: Monitoring for Information Disclosure + rules: [] + status: pending + controls: + - id: au-13.1 + title: Use of Automated Tools + rules: [] + status: pending + - id: au-13.2 + title: Review of Monitored Sites + rules: [] + status: pending + - id: au-13.3 + title: Unauthorized Replication of Information + rules: [] + status: pending + - id: au-14 + title: Session Audit + rules: [] + status: pending + controls: + - id: au-14.1 + title: System Start-up + rules: [] + status: pending + - id: au-14.2 + title: Capture and Record Content + rules: [] + status: pending + - id: au-14.3 + title: Remote Viewing and Listening + rules: [] + status: pending + - id: au-15 + title: Alternate Audit Logging Capability + rules: [] + status: pending + - id: au-16 + title: Cross-organizational Audit Logging + rules: [] + status: pending + controls: + - id: au-16.1 + title: Identity Preservation + rules: [] + status: pending + - id: au-16.2 + title: Sharing of Audit Information + rules: [] + status: pending + - id: au-16.3 + title: Disassociability + rules: [] + status: pending diff --git a/products/fedora/controls/nist_800_53/ca.yml b/products/fedora/controls/nist_800_53/ca.yml new file mode 100644 index 000000000000..e232c74689e3 --- /dev/null +++ b/products/fedora/controls/nist_800_53/ca.yml @@ -0,0 +1,202 @@ +# NIST 800-53 CA Family: Assessment, Authorization, and Monitoring +controls: + - id: ca-1 + title: Policy and Procedures + levels: + - low + rules: [] + status: pending + - id: ca-2 + title: Control Assessments + levels: + - low + rules: [] + status: pending + controls: + - id: ca-2.1 + title: Independent Assessors + levels: + - moderate + rules: [] + status: pending + - id: ca-2.2 + title: Specialized Assessments + levels: + - high + rules: [] + status: pending + - id: ca-2.3 + title: Leveraging Results from External Organizations + rules: [] + status: pending + levels: + - low + - id: ca-3 + title: Information Exchange + levels: + - low + rules: [] + status: pending + controls: + - id: ca-3.1 + title: Unclassified National Security System Connections + rules: [] + status: pending + levels: + - low + - id: ca-3.2 + title: Classified National Security System Connections + rules: [] + status: pending + levels: + - low + - id: ca-3.3 + title: Unclassified Non-national Security System Connections + rules: [] + status: pending + levels: + - low + - id: ca-3.4 + title: Connections to Public Networks + rules: [] + status: pending + levels: + - low + - id: ca-3.5 + title: Restrictions on External System Connections + rules: [] + status: pending + levels: + - low + - id: ca-3.6 + title: Transfer Authorizations + levels: + - high + rules: [] + status: pending + - id: ca-3.7 + title: Transitive Information Exchanges + rules: [] + status: pending + levels: + - low + - id: ca-4 + title: Security Certification + rules: [] + status: pending + - id: ca-5 + title: Plan of Action and Milestones + levels: + - low + rules: [] + status: pending + controls: + - id: ca-5.1 + title: Automation Support for Accuracy and Currency + rules: [] + status: pending + levels: + - low + - id: ca-6 + title: Authorization + levels: + - low + rules: [] + status: pending + controls: + - id: ca-6.1 + title: Joint Authorization — Intra-organization + rules: [] + status: pending + levels: + - low + - id: ca-6.2 + title: Joint Authorization — Inter-organization + rules: [] + status: pending + levels: + - low + - id: ca-7 + title: Continuous Monitoring + levels: + - low + rules: [] + status: pending + controls: + - id: ca-7.1 + title: Independent Assessment + levels: + - moderate + rules: [] + status: pending + - id: ca-7.2 + title: Types of Assessments + rules: [] + status: pending + levels: + - low + - id: ca-7.3 + title: Trend Analyses + rules: [] + status: pending + levels: + - low + - id: ca-7.4 + title: Risk Monitoring + levels: + - low + rules: [] + status: pending + - id: ca-7.5 + title: Consistency Analysis + rules: [] + status: pending + levels: + - low + - id: ca-7.6 + title: Automation Support for Monitoring + rules: [] + status: pending + levels: + - low + - id: ca-8 + title: Penetration Testing + levels: + - high + rules: [] + status: pending + controls: + - id: ca-8.1 + title: Independent Penetration Testing Agent or Team + levels: + - high + rules: [] + status: pending + - id: ca-8.2 + title: Red Team Exercises + rules: [] + status: pending + levels: + - high + - id: ca-8.3 + title: Facility Penetration Testing + rules: [] + status: pending + levels: + - high + - id: ca-9 + title: Internal System Connections + levels: + - low + rules: + - firewalld-backend + - firewalld_loopback_traffic_trusted + - package_firewalld_installed + status: automated + controls: + - id: ca-9.1 + title: Compliance Checks + rules: [] + status: pending + levels: + - low diff --git a/products/fedora/controls/nist_800_53/cm.yml b/products/fedora/controls/nist_800_53/cm.yml new file mode 100644 index 000000000000..8152ccdb04eb --- /dev/null +++ b/products/fedora/controls/nist_800_53/cm.yml @@ -0,0 +1,625 @@ +# NIST 800-53 CM Family: Configuration Management +controls: + - id: cm-1 + title: Policy and Procedures + levels: + - low + rules: + - account_password_pam_faillock_password_auth + - account_password_pam_faillock_system_auth + - account_unique_id + - account_unique_name + - accounts_maximum_age_login_defs + - accounts_no_uid_except_zero + - accounts_password_set_max_life_existing + - accounts_root_gid_zero + - accounts_root_path_dirs_no_write + - accounts_user_dot_group_ownership + - accounts_user_dot_user_ownership + - configure_custom_crypto_policy_cis + - disable_host_auth + - file_permission_user_bash_history + - file_permission_user_init_files + - gid_passwd_group_same + - group_unique_id + - group_unique_name + - groups_no_zero_gid_except_root + - no_forward_files + - no_netrc_files + - no_nologin_in_shells + - no_rhost_files + - package_cron_installed + - root_path_no_dot + - service_crond_enabled + - sshd_disable_empty_passwords + - sshd_disable_gssapi_auth + - sshd_disable_rhosts + - sshd_do_not_permit_user_env + - sshd_enable_pam + - sshd_enable_warning_banner_net + - sshd_set_idle_timeout + - sshd_set_keepalive + - sshd_set_max_sessions + - sshd_set_maxstartups + - sysctl_net_ipv4_conf_all_accept_redirects + - sysctl_net_ipv4_conf_all_accept_source_route + - sysctl_net_ipv4_conf_all_rp_filter + - sysctl_net_ipv4_conf_all_secure_redirects + - sysctl_net_ipv4_conf_all_send_redirects + - sysctl_net_ipv4_conf_default_accept_redirects + - sysctl_net_ipv4_conf_default_accept_source_route + - sysctl_net_ipv4_conf_default_rp_filter + - sysctl_net_ipv4_conf_default_secure_redirects + - sysctl_net_ipv4_conf_default_send_redirects + - sysctl_net_ipv4_icmp_echo_ignore_broadcasts + - sysctl_net_ipv4_icmp_ignore_bogus_error_responses + - sysctl_net_ipv4_ip_forward + - sysctl_net_ipv4_tcp_syncookies + - sysctl_net_ipv6_conf_all_accept_ra + - sysctl_net_ipv6_conf_all_accept_redirects + - sysctl_net_ipv6_conf_all_accept_source_route + - sysctl_net_ipv6_conf_all_forwarding + - sysctl_net_ipv6_conf_default_accept_ra + - sysctl_net_ipv6_conf_default_accept_redirects + - sysctl_net_ipv6_conf_default_accept_source_route + - sshd_idle_timeout_value=5_minutes + - sysctl_net_ipv4_tcp_syncookies_value=enabled + - var_accounts_maximum_age_login_defs=365 + - var_sshd_max_sessions=10 + - var_sshd_set_keepalive=1 + - var_sshd_set_maxstartups=10:30:60 + - var_user_initialization_files_regex=all_dotfiles + status: automated + - id: cm-2 + title: Baseline Configuration + levels: + - low + rules: [] + status: pending + controls: + - id: cm-2.1 + title: Reviews and Updates + rules: [] + status: pending + levels: + - low + - id: cm-2.2 + title: Automation Support for Accuracy and Currency + levels: + - moderate + rules: [] + status: pending + - id: cm-2.3 + title: Retention of Previous Configurations + levels: + - moderate + rules: [] + status: pending + - id: cm-2.4 + title: Unauthorized Software + rules: [] + status: pending + levels: + - low + - id: cm-2.5 + title: Authorized Software + rules: [] + status: pending + levels: + - low + - id: cm-2.6 + title: Development and Test Environments + rules: [] + status: pending + levels: + - low + - id: cm-2.7 + title: Configure Systems and Components for High-risk Areas + levels: + - moderate + rules: [] + status: pending + - id: cm-3 + title: Configuration Change Control + levels: + - moderate + rules: [] + status: pending + controls: + - id: cm-3.1 + title: Automated Documentation, Notification, and Prohibition of + Changes + levels: + - high + rules: [] + status: pending + - id: cm-3.2 + title: Testing, Validation, and Documentation of Changes + levels: + - moderate + rules: [] + status: pending + - id: cm-3.3 + title: Automated Change Implementation + rules: [] + status: pending + levels: + - moderate + - id: cm-3.4 + title: Security and Privacy Representatives + levels: + - moderate + rules: [] + status: pending + - id: cm-3.5 + title: Automated Security Response + rules: [] + status: pending + levels: + - moderate + - id: cm-3.6 + title: Cryptography Management + levels: + - high + rules: [] + status: pending + - id: cm-3.7 + title: Review System Changes + rules: [] + status: pending + levels: + - moderate + - id: cm-3.8 + title: Prevent or Restrict Configuration Changes + rules: [] + status: pending + levels: + - moderate + - id: cm-4 + title: Impact Analyses + levels: + - low + rules: [] + status: pending + controls: + - id: cm-4.1 + title: Separate Test Environments + levels: + - high + rules: [] + status: pending + - id: cm-4.2 + title: Verification of Controls + levels: + - moderate + rules: [] + status: pending + - id: cm-5 + title: Access Restrictions for Change + levels: + - low + rules: [] + status: pending + controls: + - id: cm-5.1 + title: Automated Access Enforcement and Audit Records + levels: + - high + rules: [] + status: pending + - id: cm-5.2 + title: Review System Changes + rules: [] + status: pending + levels: + - low + - id: cm-5.3 + title: Signed Components + rules: [] + status: pending + levels: + - low + - id: cm-5.4 + title: Dual Authorization + rules: [] + status: pending + levels: + - low + - id: cm-5.5 + title: Privilege Limitation for Production and Operation + rules: [] + status: pending + levels: + - low + - id: cm-5.6 + title: Limit Library Privileges + rules: [] + status: pending + levels: + - low + - id: cm-5.7 + title: Automatic Implementation of Security Safeguards + rules: [] + status: pending + levels: + - low + - id: cm-6 + title: Configuration Settings + levels: + - low + rules: + - accounts_password_pam_pwquality_password_auth + - accounts_password_pam_pwquality_system_auth + - accounts_umask_etc_bashrc + - accounts_umask_etc_login_defs + - accounts_umask_etc_profile + - accounts_user_interactive_home_directory_exists + - audit_rules_media_export + - banner_etc_issue_cis + - banner_etc_issue_net_cis + - banner_etc_motd_cis + - coredump_disable_backtraces + - coredump_disable_storage + - dconf_db_up_to_date + - dconf_gnome_disable_user_list + - disable_host_auth + - disable_users_coredumps + - file_groupowner_boot_grub2 + - file_groupownership_sshd_private_key + - file_groupownership_sshd_pub_key + - file_owner_boot_grub2 + - file_ownership_home_directories + - file_ownership_sshd_private_key + - file_ownership_sshd_pub_key + - file_permissions_boot_grub2 + - file_permissions_home_directories + - file_permissions_sshd_private_key + - file_permissions_sshd_pub_key + - no_empty_passwords + - no_empty_passwords_etc_shadow + - no_files_or_dirs_ungroupowned + - no_files_or_dirs_unowned_by_user + - package_pam_pwquality_installed + - package_rsync_removed + - package_samba_removed + - package_squid_removed + - partition_for_tmp + - partition_for_var_log + - service_nfs_disabled + - service_rpcbind_disabled + - sshd_disable_gssapi_auth + - sshd_set_login_grace_time + - sysctl_fs_suid_dumpable + - sysctl_kernel_kptr_restrict + - sysctl_kernel_randomize_va_space + - sysctl_kernel_yama_ptrace_scope + - sysctl_net_ipv4_conf_all_accept_redirects + - sysctl_net_ipv4_conf_all_accept_source_route + - sysctl_net_ipv4_conf_all_forwarding + - sysctl_net_ipv4_conf_all_log_martians + - sysctl_net_ipv4_conf_all_rp_filter + - sysctl_net_ipv4_conf_all_secure_redirects + - sysctl_net_ipv4_conf_all_send_redirects + - sysctl_net_ipv4_conf_default_accept_redirects + - sysctl_net_ipv4_conf_default_accept_source_route + - sysctl_net_ipv4_conf_default_forwarding + - sysctl_net_ipv4_conf_default_log_martians + - sysctl_net_ipv4_conf_default_rp_filter + - sysctl_net_ipv4_conf_default_secure_redirects + - sysctl_net_ipv4_conf_default_send_redirects + - sysctl_net_ipv4_icmp_echo_ignore_broadcasts + - sysctl_net_ipv4_icmp_ignore_bogus_error_responses + - sysctl_net_ipv4_ip_forward + - sysctl_net_ipv6_conf_all_accept_ra + - sysctl_net_ipv6_conf_all_accept_redirects + - sysctl_net_ipv6_conf_all_accept_source_route + - sysctl_net_ipv6_conf_all_forwarding + - sysctl_net_ipv6_conf_default_accept_ra + - sysctl_net_ipv6_conf_default_accept_redirects + - sysctl_net_ipv6_conf_default_accept_source_route + - sysctl_net_ipv6_conf_default_forwarding + - cis_banner_text=cis + - dconf_login_banner_contents=cis_default + - dconf_login_banner_text=cis_banners + - sysctl_net_ipv4_conf_all_accept_redirects_value=disabled + - sysctl_net_ipv4_conf_all_accept_source_route_value=disabled + - sysctl_net_ipv4_conf_all_log_martians_value=enabled + - sysctl_net_ipv4_conf_all_rp_filter_value=enabled + - sysctl_net_ipv4_conf_all_secure_redirects_value=disabled + - sysctl_net_ipv4_conf_default_accept_redirects_value=disabled + - sysctl_net_ipv4_conf_default_accept_source_route_value=disabled + - sysctl_net_ipv4_conf_default_forwarding_value=disabled + - sysctl_net_ipv4_conf_default_log_martians_value=enabled + - sysctl_net_ipv4_conf_default_rp_filter_value=enabled + - sysctl_net_ipv4_conf_default_secure_redirects_value=disabled + - sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value=enabled + - sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value=enabled + - sysctl_net_ipv6_conf_all_accept_ra_value=disabled + - sysctl_net_ipv6_conf_all_accept_redirects_value=disabled + - sysctl_net_ipv6_conf_all_accept_source_route_value=disabled + - sysctl_net_ipv6_conf_all_forwarding_value=disabled + - sysctl_net_ipv6_conf_default_accept_ra_value=disabled + - sysctl_net_ipv6_conf_default_accept_redirects_value=disabled + - sysctl_net_ipv6_conf_default_accept_source_route_value=disabled + - sysctl_net_ipv6_conf_default_forwarding_value=disabled + - var_accounts_user_umask=027 + - var_sshd_set_login_grace_time=60 + status: automated + controls: + - id: cm-6.1 + title: Automated Management, Application, and Verification + levels: + - high + rules: [] + status: pending + - id: cm-6.2 + title: Respond to Unauthorized Changes + levels: + - high + rules: [] + status: pending + - id: cm-6.3 + title: Unauthorized Change Detection + rules: [] + status: pending + levels: + - low + - id: cm-6.4 + title: Conformance Demonstration + rules: [] + status: pending + levels: + - low + - id: cm-7 + title: Least Functionality + levels: + - low + rules: + - dconf_gnome_disable_autorun + - disable_weak_deps + - file_ownership_var_log_audit_stig + - has_nonlocal_mta + - kernel_module_atm_disabled + - kernel_module_can_disabled + - kernel_module_cramfs_disabled + - kernel_module_dccp_disabled + - kernel_module_firewire-core_disabled + - kernel_module_freevxfs_disabled + - kernel_module_hfs_disabled + - kernel_module_hfsplus_disabled + - kernel_module_jffs2_disabled + - kernel_module_overlayfs_disabled + - kernel_module_rds_disabled + - kernel_module_sctp_disabled + - kernel_module_squashfs_disabled + - kernel_module_tipc_disabled + - kernel_module_udf_disabled + - mount_option_dev_shm_nodev + - mount_option_dev_shm_noexec + - mount_option_dev_shm_nosuid + - mount_option_tmp_nodev + - mount_option_tmp_noexec + - mount_option_tmp_nosuid + - package_bind_removed + - package_cyrus-imapd_removed + - package_dovecot_removed + - package_ftp_removed + - package_gdm_removed + - package_httpd_removed + - package_kea_removed + - package_net-snmp_removed + - package_nginx_removed + - package_openldap-clients_removed + - package_postfix_installed + - package_sequoia-sq_installed + - package_telnet-server_removed + - package_telnet_removed + - package_tftp-server_removed + - package_tftp_removed + - package_vsftpd_removed + - partition_for_dev_shm + - partition_for_home + - partition_for_tmp + - partition_for_var + - partition_for_var_log + - partition_for_var_log_audit + - partition_for_var_tmp + - postfix_network_listening_disabled + - service_bluetooth_disabled + - service_cockpit_disabled + - service_cups_disabled + - service_dnsmasq_disabled + - sshd_disable_forwarding + - wireless_disable_interfaces + - xwayland_disabled + - var_postfix_inet_interfaces=loopback-only + status: automated + controls: + - id: cm-7.1 + title: Periodic Review + levels: + - moderate + rules: [] + status: pending + - id: cm-7.2 + title: Prevent Program Execution + levels: + - moderate + rules: [] + status: pending + - id: cm-7.3 + title: Registration Compliance + rules: [] + status: pending + levels: + - low + - id: cm-7.4 + title: Unauthorized Software — Deny-by-exception + rules: [] + status: pending + levels: + - low + - id: cm-7.5 + title: Authorized Software — Allow-by-exception + levels: + - moderate + rules: [] + status: pending + - id: cm-7.6 + title: Confined Environments with Limited Privileges + rules: [] + status: pending + levels: + - low + - id: cm-7.7 + title: Code Execution in Protected Environments + rules: [] + status: pending + levels: + - low + - id: cm-7.8 + title: Binary or Machine Executable Code + rules: [] + status: pending + levels: + - low + - id: cm-7.9 + title: Prohibiting The Use of Unauthorized Hardware + rules: [] + status: pending + levels: + - low + - id: cm-8 + title: System Component Inventory + levels: + - low + rules: [] + status: pending + controls: + - id: cm-8.1 + title: Updates During Installation and Removal + levels: + - moderate + rules: [] + status: pending + - id: cm-8.2 + title: Automated Maintenance + levels: + - high + rules: [] + status: pending + - id: cm-8.3 + title: Automated Unauthorized Component Detection + levels: + - moderate + rules: [] + status: pending + - id: cm-8.4 + title: Accountability Information + levels: + - high + rules: [] + status: pending + - id: cm-8.5 + title: No Duplicate Accounting of Components + rules: [] + status: pending + levels: + - low + - id: cm-8.6 + title: Assessed Configurations and Approved Deviations + rules: [] + status: pending + levels: + - low + - id: cm-8.7 + title: Centralized Repository + rules: [] + status: pending + levels: + - low + - id: cm-8.8 + title: Automated Location Tracking + rules: [] + status: pending + levels: + - low + - id: cm-8.9 + title: Assignment of Components to Systems + rules: [] + status: pending + levels: + - low + - id: cm-9 + title: Configuration Management Plan + levels: + - moderate + rules: [] + status: pending + controls: + - id: cm-9.1 + title: Assignment of Responsibility + rules: [] + status: pending + levels: + - moderate + - id: cm-10 + title: Software Usage Restrictions + levels: + - low + rules: [] + status: pending + controls: + - id: cm-10.1 + title: Open-source Software + rules: [] + status: pending + levels: + - low + - id: cm-11 + title: User-installed Software + levels: + - low + rules: + - package_xorg-x11-server-Xwayland_removed + status: automated + controls: + - id: cm-11.1 + title: Alerts for Unauthorized Installations + rules: [] + status: pending + levels: + - low + - id: cm-11.2 + title: Software Installation with Privileged Status + rules: [] + status: pending + levels: + - low + - id: cm-11.3 + title: Automated Enforcement and Monitoring + rules: [] + status: pending + levels: + - low + - id: cm-12 + title: Information Location + levels: + - moderate + rules: [] + status: pending + controls: + - id: cm-12.1 + title: Automated Tools to Support Information Location + levels: + - moderate + rules: [] + status: pending + - id: cm-13 + title: Data Action Mapping + rules: [] + status: pending + - id: cm-14 + title: Signed Components + rules: [] + status: pending diff --git a/products/fedora/controls/nist_800_53/cp.yml b/products/fedora/controls/nist_800_53/cp.yml new file mode 100644 index 000000000000..198458275a9a --- /dev/null +++ b/products/fedora/controls/nist_800_53/cp.yml @@ -0,0 +1,338 @@ +# NIST 800-53 CP Family: Contingency Planning +controls: + - id: cp-1 + title: Policy and Procedures + levels: + - low + rules: [] + status: pending + - id: cp-2 + title: Contingency Plan + levels: + - low + rules: [] + status: pending + controls: + - id: cp-2.1 + title: Coordinate with Related Plans + levels: + - moderate + rules: [] + status: pending + - id: cp-2.2 + title: Capacity Planning + levels: + - high + rules: [] + status: pending + - id: cp-2.3 + title: Resume Mission and Business Functions + levels: + - moderate + rules: [] + status: pending + - id: cp-2.4 + title: Resume All Mission and Business Functions + rules: [] + status: pending + levels: + - low + - id: cp-2.5 + title: Continue Mission and Business Functions + levels: + - high + rules: [] + status: pending + - id: cp-2.6 + title: Alternate Processing and Storage Sites + rules: [] + status: pending + levels: + - low + - id: cp-2.7 + title: Coordinate with External Service Providers + rules: [] + status: pending + levels: + - low + - id: cp-2.8 + title: Identify Critical Assets + levels: + - moderate + rules: [] + status: pending + - id: cp-3 + title: Contingency Training + levels: + - low + rules: [] + status: pending + controls: + - id: cp-3.1 + title: Simulated Events + levels: + - high + rules: [] + status: pending + - id: cp-3.2 + title: Mechanisms Used in Training Environments + rules: [] + status: pending + levels: + - low + - id: cp-4 + title: Contingency Plan Testing + levels: + - low + rules: [] + status: pending + controls: + - id: cp-4.1 + title: Coordinate with Related Plans + levels: + - moderate + rules: [] + status: pending + - id: cp-4.2 + title: Alternate Processing Site + levels: + - high + rules: [] + status: pending + - id: cp-4.3 + title: Automated Testing + rules: [] + status: pending + levels: + - low + - id: cp-4.4 + title: Full Recovery and Reconstitution + rules: [] + status: pending + levels: + - low + - id: cp-4.5 + title: Self-challenge + rules: [] + status: pending + levels: + - low + - id: cp-5 + title: Contingency Plan Update + rules: [] + status: pending + - id: cp-6 + title: Alternate Storage Site + levels: + - moderate + rules: [] + status: pending + controls: + - id: cp-6.1 + title: Separation from Primary Site + levels: + - moderate + rules: [] + status: pending + - id: cp-6.2 + title: Recovery Time and Recovery Point Objectives + levels: + - high + rules: [] + status: pending + - id: cp-6.3 + title: Accessibility + levels: + - moderate + rules: [] + status: pending + - id: cp-7 + title: Alternate Processing Site + levels: + - moderate + rules: [] + status: pending + controls: + - id: cp-7.1 + title: Separation from Primary Site + levels: + - moderate + rules: [] + status: pending + - id: cp-7.2 + title: Accessibility + levels: + - moderate + rules: [] + status: pending + - id: cp-7.3 + title: Priority of Service + levels: + - moderate + rules: [] + status: pending + - id: cp-7.4 + title: Preparation for Use + levels: + - high + rules: [] + status: pending + - id: cp-7.5 + title: Equivalent Information Security Safeguards + rules: [] + status: pending + levels: + - moderate + - id: cp-7.6 + title: Inability to Return to Primary Site + rules: [] + status: pending + levels: + - moderate + - id: cp-8 + title: Telecommunications Services + levels: + - moderate + rules: [] + status: pending + controls: + - id: cp-8.1 + title: Priority of Service Provisions + levels: + - moderate + rules: [] + status: pending + - id: cp-8.2 + title: Single Points of Failure + levels: + - moderate + rules: [] + status: pending + - id: cp-8.3 + title: Separation of Primary and Alternate Providers + levels: + - high + rules: [] + status: pending + - id: cp-8.4 + title: Provider Contingency Plan + levels: + - high + rules: [] + status: pending + - id: cp-8.5 + title: Alternate Telecommunication Service Testing + rules: [] + status: pending + levels: + - moderate + - id: cp-9 + title: System Backup + levels: + - low + rules: [] + status: pending + controls: + - id: cp-9.1 + title: Testing for Reliability and Integrity + levels: + - moderate + rules: [] + status: pending + - id: cp-9.2 + title: Test Restoration Using Sampling + levels: + - high + rules: [] + status: pending + - id: cp-9.3 + title: Separate Storage for Critical Information + levels: + - high + rules: [] + status: pending + - id: cp-9.4 + title: Protection from Unauthorized Modification + rules: [] + status: pending + levels: + - low + - id: cp-9.5 + title: Transfer to Alternate Storage Site + levels: + - high + rules: [] + status: pending + - id: cp-9.6 + title: Redundant Secondary System + rules: [] + status: pending + levels: + - low + - id: cp-9.7 + title: Dual Authorization for Deletion or Destruction + rules: [] + status: pending + levels: + - low + - id: cp-9.8 + title: Cryptographic Protection + levels: + - moderate + rules: [] + status: pending + - id: cp-10 + title: System Recovery and Reconstitution + levels: + - low + rules: [] + status: pending + controls: + - id: cp-10.1 + title: Contingency Plan Testing + rules: [] + status: pending + levels: + - low + - id: cp-10.2 + title: Transaction Recovery + levels: + - moderate + rules: [] + status: pending + - id: cp-10.3 + title: Compensating Security Controls + rules: [] + status: pending + levels: + - low + - id: cp-10.4 + title: Restore Within Time Period + levels: + - high + rules: [] + status: pending + - id: cp-10.5 + title: Failover Capability + rules: [] + status: pending + levels: + - low + - id: cp-10.6 + title: Component Protection + rules: [] + status: pending + levels: + - low + - id: cp-11 + title: Alternate Communications Protocols + rules: [] + status: pending + - id: cp-12 + title: Safe Mode + rules: [] + status: pending + - id: cp-13 + title: Alternative Security Mechanisms + rules: [] + status: pending diff --git a/products/fedora/controls/nist_800_53/ia.yml b/products/fedora/controls/nist_800_53/ia.yml new file mode 100644 index 000000000000..b299a306c97e --- /dev/null +++ b/products/fedora/controls/nist_800_53/ia.yml @@ -0,0 +1,485 @@ +# NIST 800-53 IA Family: Identification and Authentication +controls: + - id: ia-1 + title: Policy and Procedures + levels: + - low + rules: [] + status: pending + - id: ia-2 + title: Identification and Authentication (Organizational Users) + levels: + - low + rules: + - account_unique_id + status: automated + controls: + - id: ia-2.1 + title: Multi-factor Authentication to Privileged Accounts + levels: + - low + rules: [] + status: pending + - id: ia-2.2 + title: Multi-factor Authentication to Non-privileged Accounts + levels: + - low + rules: [] + status: pending + - id: ia-2.3 + title: Local Access to Privileged Accounts + rules: [] + status: pending + levels: + - low + - id: ia-2.4 + title: Local Access to Non-privileged Accounts + rules: [] + status: pending + levels: + - low + - id: ia-2.5 + title: Individual Authentication with Group Authentication + levels: + - high + rules: [] + status: pending + - id: ia-2.6 + title: Access to Accounts —separate Device + rules: [] + status: pending + levels: + - low + - id: ia-2.7 + title: Network Access to Non-privileged Accounts — Separate Device + rules: [] + status: pending + levels: + - low + - id: ia-2.8 + title: Access to Accounts — Replay Resistant + levels: + - low + rules: [] + status: pending + - id: ia-2.9 + title: Network Access to Non-privileged Accounts — Replay Resistant + rules: [] + status: pending + levels: + - low + - id: ia-2.10 + title: Single Sign-on + rules: [] + status: pending + levels: + - low + - id: ia-2.11 + title: Remote Access — Separate Device + rules: [] + status: pending + levels: + - low + - id: ia-2.12 + title: Acceptance of PIV Credentials + levels: + - low + rules: [] + status: pending + - id: ia-2.13 + title: Out-of-band Authentication + rules: [] + status: pending + levels: + - low + - id: ia-3 + title: Device Identification and Authentication + levels: + - moderate + rules: + - dconf_gnome_disable_automount + - dconf_gnome_disable_automount_open + - kernel_module_usb-storage_disabled + status: automated + controls: + - id: ia-3.1 + title: Cryptographic Bidirectional Authentication + rules: [] + status: pending + levels: + - moderate + - id: ia-3.2 + title: Cryptographic Bidirectional Network Authentication + rules: [] + status: pending + levels: + - moderate + - id: ia-3.3 + title: Dynamic Address Allocation + rules: [] + status: pending + levels: + - moderate + - id: ia-3.4 + title: Device Attestation + rules: [] + status: pending + levels: + - moderate + - id: ia-4 + title: Identifier Management + levels: + - low + rules: + - account_disable_post_pw_expiration + - accounts_set_post_pw_existing + - var_account_disable_post_pw_expiration=45 + status: automated + controls: + - id: ia-4.1 + title: Prohibit Account Identifiers as Public Identifiers + rules: [] + status: pending + levels: + - low + - id: ia-4.2 + title: Supervisor Authorization + rules: [] + status: pending + levels: + - low + - id: ia-4.3 + title: Multiple Forms of Certification + rules: [] + status: pending + levels: + - low + - id: ia-4.4 + title: Identify User Status + levels: + - moderate + rules: [] + status: pending + - id: ia-4.5 + title: Dynamic Management + rules: [] + status: pending + levels: + - low + - id: ia-4.6 + title: Cross-organization Management + rules: [] + status: pending + levels: + - low + - id: ia-4.7 + title: In-person Registration + rules: [] + status: pending + levels: + - low + - id: ia-4.8 + title: Pairwise Pseudonymous Identifiers + rules: [] + status: pending + levels: + - low + - id: ia-4.9 + title: Attribute Maintenance and Protection + rules: [] + status: pending + levels: + - low + - id: ia-5 + title: Authenticator Management + levels: + - low + rules: + - accounts_minimum_age_login_defs + - accounts_password_all_shadowed + - accounts_password_last_change_is_in_past + - accounts_password_pam_dictcheck + - accounts_password_pam_difok + - accounts_password_pam_enforce_root + - accounts_password_pam_maxrepeat + - accounts_password_pam_maxsequence + - accounts_password_pam_minclass + - accounts_password_pam_minlen + - accounts_password_pam_modules_in_authselect_profile + - accounts_password_pam_pwhistory_enforce_for_root + - accounts_password_pam_pwhistory_use_authtok + - accounts_password_pam_unix_authtok + - accounts_password_set_min_life_existing + - accounts_password_set_warn_age_existing + - accounts_password_warn_age_login_defs + - ensure_root_password_configured + - no_empty_passwords_etc_shadow + - set_password_hashing_algorithm_logindefs + - set_password_hashing_algorithm_passwordauth + - set_password_hashing_algorithm_systemauth + - var_accounts_minimum_age_login_defs=1 + - var_accounts_password_warn_age_login_defs=7 + - var_password_hashing_algorithm=cis_rhel10 + - var_password_hashing_algorithm_pam=cis_rhel10 + - var_password_pam_dictcheck=1 + - var_password_pam_difok=2 + - var_password_pam_maxrepeat=3 + - var_password_pam_maxsequence=3 + - var_password_pam_minclass=4 + - var_password_pam_minlen=14 + status: automated + controls: + - id: ia-5.1 + title: Password-based Authentication + levels: + - low + rules: + - accounts_password_pam_pwhistory_remember_password_auth + - accounts_password_pam_pwhistory_remember_system_auth + - accounts_password_pam_unix_enabled + - accounts_password_pam_unix_no_remember + - var_password_pam_remember=24 + - var_password_pam_remember_control_flag=requisite_or_required + status: automated + - id: ia-5.2 + title: Public Key-based Authentication + levels: + - moderate + rules: [] + status: pending + - id: ia-5.3 + title: In-person or Trusted External Party Registration + rules: [] + status: pending + levels: + - low + - id: ia-5.4 + title: Automated Support for Password Strength Determination + rules: [] + status: pending + levels: + - low + - id: ia-5.5 + title: Change Authenticators Prior to Delivery + rules: [] + status: pending + levels: + - low + - id: ia-5.6 + title: Protection of Authenticators + levels: + - moderate + rules: [] + status: pending + - id: ia-5.7 + title: No Embedded Unencrypted Static Authenticators + rules: [] + status: pending + levels: + - low + - id: ia-5.8 + title: Multiple System Accounts + rules: [] + status: pending + levels: + - low + - id: ia-5.9 + title: Federated Credential Management + rules: [] + status: pending + levels: + - low + - id: ia-5.10 + title: Dynamic Credential Binding + rules: [] + status: pending + levels: + - low + - id: ia-5.11 + title: Hardware Token-based Authentication + rules: [] + status: pending + levels: + - low + - id: ia-5.12 + title: Biometric Authentication Performance + rules: [] + status: pending + levels: + - low + - id: ia-5.13 + title: Expiration of Cached Authenticators + rules: [] + status: pending + levels: + - low + - id: ia-5.14 + title: Managing Content of PKI Trust Stores + rules: [] + status: pending + levels: + - low + - id: ia-5.15 + title: GSA-approved Products and Services + rules: [] + status: pending + levels: + - low + - id: ia-5.16 + title: In-person or Trusted External Party Authenticator Issuance + rules: [] + status: pending + levels: + - low + - id: ia-5.17 + title: Presentation Attack Detection for Biometric Authenticators + rules: [] + status: pending + levels: + - low + - id: ia-5.18 + title: Password Managers + rules: [] + status: pending + levels: + - low + - id: ia-6 + title: Authentication Feedback + levels: + - low + rules: [] + status: pending + - id: ia-7 + title: Cryptographic Module Authentication + levels: + - low + rules: [] + status: pending + - id: ia-8 + title: Identification and Authentication (Non-organizational Users) + levels: + - low + rules: [] + status: pending + controls: + - id: ia-8.1 + title: Acceptance of PIV Credentials from Other Agencies + levels: + - low + rules: [] + status: pending + - id: ia-8.2 + title: Acceptance of External Authenticators + levels: + - low + rules: [] + status: pending + - id: ia-8.3 + title: Use of FICAM-approved Products + rules: [] + status: pending + levels: + - low + - id: ia-8.4 + title: Use of Defined Profiles + levels: + - low + rules: [] + status: pending + - id: ia-8.5 + title: Acceptance of PIV-I Credentials + rules: [] + status: pending + levels: + - low + - id: ia-8.6 + title: Disassociability + rules: [] + status: pending + levels: + - low + - id: ia-9 + title: Service Identification and Authentication + rules: [] + status: pending + controls: + - id: ia-9.1 + title: Information Exchange + rules: [] + status: pending + - id: ia-9.2 + title: Transmission of Decisions + rules: [] + status: pending + - id: ia-10 + title: Adaptive Authentication + rules: [] + status: pending + - id: ia-11 + title: Re-authentication + levels: + - low + rules: + - sudo_require_reauthentication + - var_sudo_timestamp_timeout=15_minutes + status: automated + - id: ia-12 + title: Identity Proofing + levels: + - moderate + rules: [] + status: pending + controls: + - id: ia-12.1 + title: Supervisor Authorization + rules: [] + status: pending + levels: + - moderate + - id: ia-12.2 + title: Identity Evidence + levels: + - moderate + rules: [] + status: pending + - id: ia-12.3 + title: Identity Evidence Validation and Verification + levels: + - moderate + rules: [] + status: pending + - id: ia-12.4 + title: In-person Validation and Verification + levels: + - high + rules: [] + status: pending + - id: ia-12.5 + title: Address Confirmation + levels: + - moderate + rules: [] + status: pending + - id: ia-12.6 + title: Accept Externally-proofed Identities + rules: [] + status: pending + levels: + - moderate + - id: ia-13 + title: Identity Providers and Authorization Servers + rules: [] + status: pending + controls: + - id: ia-13.1 + title: Protection of Cryptographic Keys + rules: [] + status: pending + - id: ia-13.2 + title: Verification of Identity Assertions and Access Tokens + rules: [] + status: pending + - id: ia-13.3 + title: Token Management + rules: [] + status: pending diff --git a/products/fedora/controls/nist_800_53/ir.yml b/products/fedora/controls/nist_800_53/ir.yml new file mode 100644 index 000000000000..92745c0b7e98 --- /dev/null +++ b/products/fedora/controls/nist_800_53/ir.yml @@ -0,0 +1,251 @@ +# NIST 800-53 IR Family: Incident Response +controls: + - id: ir-1 + title: Policy and Procedures + levels: + - low + rules: [] + status: pending + - id: ir-2 + title: Incident Response Training + levels: + - low + rules: [] + status: pending + controls: + - id: ir-2.1 + title: Simulated Events + levels: + - high + rules: [] + status: pending + - id: ir-2.2 + title: Automated Training Environments + levels: + - high + rules: [] + status: pending + - id: ir-2.3 + title: Breach + rules: [] + status: pending + levels: + - low + - id: ir-3 + title: Incident Response Testing + levels: + - moderate + rules: [] + status: pending + controls: + - id: ir-3.1 + title: Automated Testing + rules: [] + status: pending + levels: + - moderate + - id: ir-3.2 + title: Coordination with Related Plans + levels: + - moderate + rules: [] + status: pending + - id: ir-3.3 + title: Continuous Improvement + rules: [] + status: pending + levels: + - moderate + - id: ir-4 + title: Incident Handling + levels: + - low + rules: [] + status: pending + controls: + - id: ir-4.1 + title: Automated Incident Handling Processes + levels: + - moderate + rules: [] + status: pending + - id: ir-4.2 + title: Dynamic Reconfiguration + rules: [] + status: pending + levels: + - low + - id: ir-4.3 + title: Continuity of Operations + rules: [] + status: pending + levels: + - low + - id: ir-4.4 + title: Information Correlation + levels: + - high + rules: [] + status: pending + - id: ir-4.5 + title: Automatic Disabling of System + rules: [] + status: pending + levels: + - low + - id: ir-4.6 + title: Insider Threats + rules: [] + status: pending + levels: + - low + - id: ir-4.7 + title: Insider Threats — Intra-organization Coordination + rules: [] + status: pending + levels: + - low + - id: ir-4.8 + title: Correlation with External Organizations + rules: [] + status: pending + levels: + - low + - id: ir-4.9 + title: Dynamic Response Capability + rules: [] + status: pending + levels: + - low + - id: ir-4.10 + title: Supply Chain Coordination + rules: [] + status: pending + levels: + - low + - id: ir-4.11 + title: Integrated Incident Response Team + levels: + - high + rules: [] + status: pending + - id: ir-4.12 + title: Malicious Code and Forensic Analysis + rules: [] + status: pending + levels: + - low + - id: ir-4.13 + title: Behavior Analysis + rules: [] + status: pending + levels: + - low + - id: ir-4.14 + title: Security Operations Center + rules: [] + status: pending + levels: + - low + - id: ir-4.15 + title: Public Relations and Reputation Repair + rules: [] + status: pending + levels: + - low + - id: ir-5 + title: Incident Monitoring + levels: + - low + rules: [] + status: pending + controls: + - id: ir-5.1 + title: Automated Tracking, Data Collection, and Analysis + levels: + - high + rules: [] + status: pending + - id: ir-6 + title: Incident Reporting + levels: + - low + rules: [] + status: pending + controls: + - id: ir-6.1 + title: Automated Reporting + levels: + - moderate + rules: [] + status: pending + - id: ir-6.2 + title: Vulnerabilities Related to Incidents + rules: [] + status: pending + levels: + - low + - id: ir-6.3 + title: Supply Chain Coordination + levels: + - moderate + rules: [] + status: pending + - id: ir-7 + title: Incident Response Assistance + levels: + - low + rules: [] + status: pending + controls: + - id: ir-7.1 + title: Automation Support for Availability of Information and + Support + levels: + - moderate + rules: [] + status: pending + - id: ir-7.2 + title: Coordination with External Providers + rules: [] + status: pending + levels: + - low + - id: ir-8 + title: Incident Response Plan + levels: + - low + rules: [] + status: pending + controls: + - id: ir-8.1 + title: Breaches + rules: [] + status: pending + levels: + - low + - id: ir-9 + title: Information Spillage Response + rules: [] + status: pending + controls: + - id: ir-9.1 + title: Responsible Personnel + rules: [] + status: pending + - id: ir-9.2 + title: Training + rules: [] + status: pending + - id: ir-9.3 + title: Post-spill Operations + rules: [] + status: pending + - id: ir-9.4 + title: Exposure to Unauthorized Personnel + rules: [] + status: pending + - id: ir-10 + title: Integrated Information Security Analysis Team + rules: [] + status: pending diff --git a/products/fedora/controls/nist_800_53/ma.yml b/products/fedora/controls/nist_800_53/ma.yml new file mode 100644 index 000000000000..65a285e2c049 --- /dev/null +++ b/products/fedora/controls/nist_800_53/ma.yml @@ -0,0 +1,185 @@ +# NIST 800-53 MA Family: Maintenance +controls: + - id: ma-1 + title: Policy and Procedures + levels: + - low + rules: [] + status: pending + - id: ma-2 + title: Controlled Maintenance + levels: + - low + rules: [] + status: pending + controls: + - id: ma-2.1 + title: Record Content + rules: [] + status: pending + levels: + - low + - id: ma-2.2 + title: Automated Maintenance Activities + levels: + - high + rules: [] + status: pending + - id: ma-3 + title: Maintenance Tools + levels: + - moderate + rules: [] + status: pending + controls: + - id: ma-3.1 + title: Inspect Tools + levels: + - moderate + rules: [] + status: pending + - id: ma-3.2 + title: Inspect Media + levels: + - moderate + rules: [] + status: pending + - id: ma-3.3 + title: Prevent Unauthorized Removal + levels: + - moderate + rules: [] + status: pending + - id: ma-3.4 + title: Restricted Tool Use + rules: [] + status: pending + levels: + - moderate + - id: ma-3.5 + title: Execution with Privilege + rules: [] + status: pending + levels: + - moderate + - id: ma-3.6 + title: Software Updates and Patches + rules: [] + status: pending + levels: + - moderate + - id: ma-4 + title: Nonlocal Maintenance + levels: + - low + rules: [] + status: pending + controls: + - id: ma-4.1 + title: Logging and Review + rules: [] + status: pending + levels: + - low + - id: ma-4.2 + title: Document Nonlocal Maintenance + rules: [] + status: pending + levels: + - low + - id: ma-4.3 + title: Comparable Security and Sanitization + levels: + - high + rules: [] + status: pending + - id: ma-4.4 + title: Authentication and Separation of Maintenance Sessions + rules: [] + status: pending + levels: + - low + - id: ma-4.5 + title: Approvals and Notifications + rules: [] + status: pending + levels: + - low + - id: ma-4.6 + title: Cryptographic Protection + rules: [] + status: pending + levels: + - low + - id: ma-4.7 + title: Disconnect Verification + rules: [] + status: pending + levels: + - low + - id: ma-5 + title: Maintenance Personnel + levels: + - low + rules: [] + status: pending + controls: + - id: ma-5.1 + title: Individuals Without Appropriate Access + levels: + - high + rules: [] + status: pending + - id: ma-5.2 + title: Security Clearances for Classified Systems + rules: [] + status: pending + levels: + - low + - id: ma-5.3 + title: Citizenship Requirements for Classified Systems + rules: [] + status: pending + levels: + - low + - id: ma-5.4 + title: Foreign Nationals + rules: [] + status: pending + levels: + - low + - id: ma-5.5 + title: Non-system Maintenance + rules: [] + status: pending + levels: + - low + - id: ma-6 + title: Timely Maintenance + levels: + - moderate + rules: [] + status: pending + controls: + - id: ma-6.1 + title: Preventive Maintenance + rules: [] + status: pending + levels: + - moderate + - id: ma-6.2 + title: Predictive Maintenance + rules: [] + status: pending + levels: + - moderate + - id: ma-6.3 + title: Automated Support for Predictive Maintenance + rules: [] + status: pending + levels: + - moderate + - id: ma-7 + title: Field Maintenance + rules: [] + status: pending diff --git a/products/fedora/controls/nist_800_53/mp.yml b/products/fedora/controls/nist_800_53/mp.yml new file mode 100644 index 000000000000..304945bc8f80 --- /dev/null +++ b/products/fedora/controls/nist_800_53/mp.yml @@ -0,0 +1,178 @@ +# NIST 800-53 MP Family: Media Protection +controls: + - id: mp-1 + title: Policy and Procedures + levels: + - low + rules: [] + status: pending + - id: mp-2 + title: Media Access + levels: + - low + rules: [] + status: pending + controls: + - id: mp-2.1 + title: Automated Restricted Access + rules: [] + status: pending + levels: + - low + - id: mp-2.2 + title: Cryptographic Protection + rules: [] + status: pending + levels: + - low + - id: mp-3 + title: Media Marking + levels: + - moderate + rules: [] + status: pending + - id: mp-4 + title: Media Storage + levels: + - moderate + rules: [] + status: pending + controls: + - id: mp-4.1 + title: Cryptographic Protection + rules: [] + status: pending + levels: + - moderate + - id: mp-4.2 + title: Automated Restricted Access + rules: [] + status: pending + levels: + - moderate + - id: mp-5 + title: Media Transport + levels: + - moderate + rules: [] + status: pending + controls: + - id: mp-5.1 + title: Protection Outside of Controlled Areas + rules: [] + status: pending + levels: + - moderate + - id: mp-5.2 + title: Documentation of Activities + rules: [] + status: pending + levels: + - moderate + - id: mp-5.3 + title: Custodians + rules: [] + status: pending + levels: + - moderate + - id: mp-5.4 + title: Cryptographic Protection + rules: [] + status: pending + levels: + - moderate + - id: mp-6 + title: Media Sanitization + levels: + - low + rules: [] + status: pending + controls: + - id: mp-6.1 + title: Review, Approve, Track, Document, and Verify + levels: + - high + rules: [] + status: pending + - id: mp-6.2 + title: Equipment Testing + levels: + - high + rules: [] + status: pending + - id: mp-6.3 + title: Nondestructive Techniques + levels: + - high + rules: [] + status: pending + - id: mp-6.4 + title: Controlled Unclassified Information + rules: [] + status: pending + levels: + - low + - id: mp-6.5 + title: Classified Information + rules: [] + status: pending + levels: + - low + - id: mp-6.6 + title: Media Destruction + rules: [] + status: pending + levels: + - low + - id: mp-6.7 + title: Dual Authorization + rules: [] + status: pending + levels: + - low + - id: mp-6.8 + title: Remote Purging or Wiping of Information + rules: [] + status: pending + levels: + - low + - id: mp-7 + title: Media Use + levels: + - low + rules: [] + status: pending + controls: + - id: mp-7.1 + title: Prohibit Use Without Owner + rules: [] + status: pending + levels: + - low + - id: mp-7.2 + title: Prohibit Use of Sanitization-resistant Media + rules: [] + status: pending + levels: + - low + - id: mp-8 + title: Media Downgrading + rules: [] + status: pending + controls: + - id: mp-8.1 + title: Documentation of Process + rules: [] + status: pending + - id: mp-8.2 + title: Equipment Testing + rules: [] + status: pending + - id: mp-8.3 + title: Controlled Unclassified Information + rules: [] + status: pending + - id: mp-8.4 + title: Classified Information + rules: [] + status: pending diff --git a/products/fedora/controls/nist_800_53/pe.yml b/products/fedora/controls/nist_800_53/pe.yml new file mode 100644 index 000000000000..246768b66725 --- /dev/null +++ b/products/fedora/controls/nist_800_53/pe.yml @@ -0,0 +1,356 @@ +# NIST 800-53 PE Family: Physical and Environmental Protection +controls: + - id: pe-1 + title: Policy and Procedures + levels: + - low + rules: [] + status: pending + - id: pe-2 + title: Physical Access Authorizations + levels: + - low + rules: [] + status: pending + controls: + - id: pe-2.1 + title: Access by Position or Role + rules: [] + status: pending + levels: + - low + - id: pe-2.2 + title: Two Forms of Identification + rules: [] + status: pending + levels: + - low + - id: pe-2.3 + title: Restrict Unescorted Access + rules: [] + status: pending + levels: + - low + - id: pe-3 + title: Physical Access Control + levels: + - low + rules: [] + status: pending + controls: + - id: pe-3.1 + title: System Access + levels: + - high + rules: [] + status: pending + - id: pe-3.2 + title: Facility and Systems + rules: [] + status: pending + levels: + - low + - id: pe-3.3 + title: Continuous Guards + rules: [] + status: pending + levels: + - low + - id: pe-3.4 + title: Lockable Casings + rules: [] + status: pending + levels: + - low + - id: pe-3.5 + title: Tamper Protection + rules: [] + status: pending + levels: + - low + - id: pe-3.6 + title: Facility Penetration Testing + rules: [] + status: pending + levels: + - low + - id: pe-3.7 + title: Physical Barriers + rules: [] + status: pending + levels: + - low + - id: pe-3.8 + title: Access Control Vestibules + rules: [] + status: pending + levels: + - low + - id: pe-4 + title: Access Control for Transmission + levels: + - moderate + rules: [] + status: pending + - id: pe-5 + title: Access Control for Output Devices + levels: + - moderate + rules: [] + status: pending + controls: + - id: pe-5.1 + title: Access to Output by Authorized Individuals + rules: [] + status: pending + levels: + - moderate + - id: pe-5.2 + title: Link to Individual Identity + rules: [] + status: pending + levels: + - moderate + - id: pe-5.3 + title: Marking Output Devices + rules: [] + status: pending + levels: + - moderate + - id: pe-6 + title: Monitoring Physical Access + levels: + - low + rules: [] + status: pending + controls: + - id: pe-6.1 + title: Intrusion Alarms and Surveillance Equipment + levels: + - moderate + rules: [] + status: pending + - id: pe-6.2 + title: Automated Intrusion Recognition and Responses + rules: [] + status: pending + levels: + - low + - id: pe-6.3 + title: Video Surveillance + rules: [] + status: pending + levels: + - low + - id: pe-6.4 + title: Monitoring Physical Access to Systems + levels: + - high + rules: [] + status: pending + - id: pe-7 + title: Visitor Control + rules: [] + status: pending + - id: pe-8 + title: Visitor Access Records + levels: + - low + rules: [] + status: pending + controls: + - id: pe-8.1 + title: Automated Records Maintenance and Review + levels: + - high + rules: [] + status: pending + - id: pe-8.2 + title: Physical Access Records + rules: [] + status: pending + levels: + - low + - id: pe-8.3 + title: Limit Personally Identifiable Information Elements + rules: [] + status: pending + levels: + - low + - id: pe-9 + title: Power Equipment and Cabling + levels: + - moderate + rules: [] + status: pending + controls: + - id: pe-9.1 + title: Redundant Cabling + rules: [] + status: pending + levels: + - moderate + - id: pe-9.2 + title: Automatic Voltage Controls + rules: [] + status: pending + levels: + - moderate + - id: pe-10 + title: Emergency Shutoff + levels: + - moderate + rules: [] + status: pending + controls: + - id: pe-10.1 + title: Accidental and Unauthorized Activation + rules: [] + status: pending + levels: + - moderate + - id: pe-11 + title: Emergency Power + levels: + - moderate + rules: [] + status: pending + controls: + - id: pe-11.1 + title: Alternate Power Supply — Minimal Operational Capability + levels: + - high + rules: [] + status: pending + - id: pe-11.2 + title: Alternate Power Supply — Self-contained + rules: [] + status: pending + levels: + - moderate + - id: pe-12 + title: Emergency Lighting + levels: + - low + rules: [] + status: pending + controls: + - id: pe-12.1 + title: Essential Mission and Business Functions + rules: [] + status: pending + levels: + - low + - id: pe-13 + title: Fire Protection + levels: + - low + rules: [] + status: pending + controls: + - id: pe-13.1 + title: Detection Systems — Automatic Activation and Notification + levels: + - moderate + rules: [] + status: pending + - id: pe-13.2 + title: Suppression Systems — Automatic Activation and Notification + levels: + - high + rules: [] + status: pending + - id: pe-13.3 + title: Automatic Fire Suppression + rules: [] + status: pending + levels: + - low + - id: pe-13.4 + title: Inspections + rules: [] + status: pending + levels: + - low + - id: pe-14 + title: Environmental Controls + levels: + - low + rules: [] + status: pending + controls: + - id: pe-14.1 + title: Automatic Controls + rules: [] + status: pending + levels: + - low + - id: pe-14.2 + title: Monitoring with Alarms and Notifications + rules: [] + status: pending + levels: + - low + - id: pe-15 + title: Water Damage Protection + levels: + - low + rules: [] + status: pending + controls: + - id: pe-15.1 + title: Automation Support + levels: + - high + rules: [] + status: pending + - id: pe-16 + title: Delivery and Removal + levels: + - low + rules: [] + status: pending + - id: pe-17 + title: Alternate Work Site + levels: + - moderate + rules: [] + status: pending + - id: pe-18 + title: Location of System Components + levels: + - high + rules: [] + status: pending + controls: + - id: pe-18.1 + title: Facility Site + rules: [] + status: pending + levels: + - high + - id: pe-19 + title: Information Leakage + rules: [] + status: pending + controls: + - id: pe-19.1 + title: National Emissions Policies and Procedures + rules: [] + status: pending + - id: pe-20 + title: Asset Monitoring and Tracking + rules: [] + status: pending + - id: pe-21 + title: Electromagnetic Pulse Protection + rules: [] + status: pending + - id: pe-22 + title: Component Marking + rules: [] + status: pending + - id: pe-23 + title: Facility Location + rules: [] + status: pending diff --git a/products/fedora/controls/nist_800_53/pl.yml b/products/fedora/controls/nist_800_53/pl.yml new file mode 100644 index 000000000000..d7a821c063ca --- /dev/null +++ b/products/fedora/controls/nist_800_53/pl.yml @@ -0,0 +1,97 @@ +# NIST 800-53 PL Family: Planning +controls: + - id: pl-1 + title: Policy and Procedures + levels: + - low + rules: [] + status: pending + - id: pl-2 + title: System Security and Privacy Plans + levels: + - low + rules: [] + status: pending + controls: + - id: pl-2.1 + title: Concept of Operations + rules: [] + status: pending + levels: + - low + - id: pl-2.2 + title: Functional Architecture + rules: [] + status: pending + levels: + - low + - id: pl-2.3 + title: Plan and Coordinate with Other Organizational Entities + rules: [] + status: pending + levels: + - low + - id: pl-3 + title: System Security Plan Update + rules: [] + status: pending + - id: pl-4 + title: Rules of Behavior + levels: + - low + rules: [] + status: pending + controls: + - id: pl-4.1 + title: Social Media and External Site/Application Usage Restrictions + levels: + - low + rules: [] + status: pending + - id: pl-5 + title: Privacy Impact Assessment + rules: [] + status: pending + - id: pl-6 + title: Security-related Activity Planning + rules: [] + status: pending + - id: pl-7 + title: Concept of Operations + rules: [] + status: pending + - id: pl-8 + title: Security and Privacy Architectures + levels: + - moderate + rules: [] + status: pending + controls: + - id: pl-8.1 + title: Defense in Depth + rules: [] + status: pending + levels: + - moderate + - id: pl-8.2 + title: Supplier Diversity + rules: [] + status: pending + levels: + - moderate + - id: pl-9 + title: Central Management + rules: [] + status: pending + - id: pl-10 + title: Baseline Selection + levels: + - low + rules: [] + status: pending + - id: pl-11 + title: Baseline Tailoring + levels: + - low + rules: [] + status: pending diff --git a/products/fedora/controls/nist_800_53/pm.yml b/products/fedora/controls/nist_800_53/pm.yml new file mode 100644 index 000000000000..5d8e46ab202d --- /dev/null +++ b/products/fedora/controls/nist_800_53/pm.yml @@ -0,0 +1,157 @@ +# NIST 800-53 PM Family: Program Management +controls: + - id: pm-1 + title: Information Security Program Plan + rules: [] + status: pending + - id: pm-2 + title: Information Security Program Leadership Role + rules: [] + status: pending + - id: pm-3 + title: Information Security and Privacy Resources + rules: [] + status: pending + - id: pm-4 + title: Plan of Action and Milestones Process + rules: [] + status: pending + - id: pm-5 + title: System Inventory + rules: [] + status: pending + controls: + - id: pm-5.1 + title: Inventory of Personally Identifiable Information + rules: [] + status: pending + - id: pm-6 + title: Measures of Performance + rules: [] + status: pending + - id: pm-7 + title: Enterprise Architecture + rules: [] + status: pending + controls: + - id: pm-7.1 + title: Offloading + rules: [] + status: pending + - id: pm-8 + title: Critical Infrastructure Plan + rules: [] + status: pending + - id: pm-9 + title: Risk Management Strategy + rules: [] + status: pending + - id: pm-10 + title: Authorization Process + rules: [] + status: pending + - id: pm-11 + title: Mission and Business Process Definition + rules: [] + status: pending + - id: pm-12 + title: Insider Threat Program + rules: [] + status: pending + - id: pm-13 + title: Security and Privacy Workforce + rules: [] + status: pending + - id: pm-14 + title: Testing, Training, and Monitoring + rules: [] + status: pending + - id: pm-15 + title: Security and Privacy Groups and Associations + rules: [] + status: pending + - id: pm-16 + title: Threat Awareness Program + rules: [] + status: pending + controls: + - id: pm-16.1 + title: Automated Means for Sharing Threat Intelligence + rules: [] + status: pending + - id: pm-17 + title: Protecting Controlled Unclassified Information on External Systems + rules: [] + status: pending + - id: pm-18 + title: Privacy Program Plan + rules: [] + status: pending + - id: pm-19 + title: Privacy Program Leadership Role + rules: [] + status: pending + - id: pm-20 + title: Dissemination of Privacy Program Information + rules: [] + status: pending + controls: + - id: pm-20.1 + title: Privacy Policies on Websites, Applications, and Digital + Services + rules: [] + status: pending + - id: pm-21 + title: Accounting of Disclosures + rules: [] + status: pending + - id: pm-22 + title: Personally Identifiable Information Quality Management + rules: [] + status: pending + - id: pm-23 + title: Data Governance Body + rules: [] + status: pending + - id: pm-24 + title: Data Integrity Board + rules: [] + status: pending + - id: pm-25 + title: Minimization of Personally Identifiable Information Used in + Testing, Training, and Research + rules: [] + status: pending + - id: pm-26 + title: Complaint Management + rules: [] + status: pending + - id: pm-27 + title: Privacy Reporting + rules: [] + status: pending + - id: pm-28 + title: Risk Framing + rules: [] + status: pending + - id: pm-29 + title: Risk Management Program Leadership Roles + rules: [] + status: pending + - id: pm-30 + title: Supply Chain Risk Management Strategy + rules: [] + status: pending + controls: + - id: pm-30.1 + title: Suppliers of Critical or Mission-essential Items + rules: [] + status: pending + - id: pm-31 + title: Continuous Monitoring Strategy + rules: [] + status: pending + - id: pm-32 + title: Purposing + rules: [] + status: pending diff --git a/products/fedora/controls/nist_800_53/ps.yml b/products/fedora/controls/nist_800_53/ps.yml new file mode 100644 index 000000000000..b1ca9f51be99 --- /dev/null +++ b/products/fedora/controls/nist_800_53/ps.yml @@ -0,0 +1,113 @@ +# NIST 800-53 PS Family: Personnel Security +controls: + - id: ps-1 + title: Policy and Procedures + levels: + - low + rules: [] + status: pending + - id: ps-2 + title: Position Risk Designation + levels: + - low + rules: [] + status: pending + - id: ps-3 + title: Personnel Screening + levels: + - low + rules: [] + status: pending + controls: + - id: ps-3.1 + title: Classified Information + rules: [] + status: pending + levels: + - low + - id: ps-3.2 + title: Formal Indoctrination + rules: [] + status: pending + levels: + - low + - id: ps-3.3 + title: Information Requiring Special Protective Measures + rules: [] + status: pending + levels: + - low + - id: ps-3.4 + title: Citizenship Requirements + rules: [] + status: pending + levels: + - low + - id: ps-4 + title: Personnel Termination + levels: + - low + rules: [] + status: pending + controls: + - id: ps-4.1 + title: Post-employment Requirements + rules: [] + status: pending + levels: + - low + - id: ps-4.2 + title: Automated Actions + levels: + - high + rules: [] + status: pending + - id: ps-5 + title: Personnel Transfer + levels: + - low + rules: [] + status: pending + - id: ps-6 + title: Access Agreements + levels: + - low + rules: [] + status: pending + controls: + - id: ps-6.1 + title: Information Requiring Special Protection + rules: [] + status: pending + levels: + - low + - id: ps-6.2 + title: Classified Information Requiring Special Protection + rules: [] + status: pending + levels: + - low + - id: ps-6.3 + title: Post-employment Requirements + rules: [] + status: pending + levels: + - low + - id: ps-7 + title: External Personnel Security + levels: + - low + rules: [] + status: pending + - id: ps-8 + title: Personnel Sanctions + levels: + - low + rules: [] + status: pending + - id: ps-9 + title: Position Descriptions + levels: + - low + rules: [] + status: pending diff --git a/products/fedora/controls/nist_800_53/pt.yml b/products/fedora/controls/nist_800_53/pt.yml new file mode 100644 index 000000000000..2de1adf29542 --- /dev/null +++ b/products/fedora/controls/nist_800_53/pt.yml @@ -0,0 +1,92 @@ +# NIST 800-53 PT Family: PII Processing and Transparency +controls: + - id: pt-1 + title: Policy and Procedures + rules: [] + status: pending + - id: pt-2 + title: Authority to Process Personally Identifiable Information + rules: [] + status: pending + controls: + - id: pt-2.1 + title: Data Tagging + rules: [] + status: pending + - id: pt-2.2 + title: Automation + rules: [] + status: pending + - id: pt-3 + title: Personally Identifiable Information Processing Purposes + rules: [] + status: pending + controls: + - id: pt-3.1 + title: Data Tagging + rules: [] + status: pending + - id: pt-3.2 + title: Automation + rules: [] + status: pending + - id: pt-4 + title: Consent + rules: [] + status: pending + controls: + - id: pt-4.1 + title: Tailored Consent + rules: [] + status: pending + - id: pt-4.2 + title: Just-in-time Consent + rules: [] + status: pending + - id: pt-4.3 + title: Revocation + rules: [] + status: pending + - id: pt-5 + title: Privacy Notice + rules: [] + status: pending + controls: + - id: pt-5.1 + title: Just-in-time Notice + rules: [] + status: pending + - id: pt-5.2 + title: Privacy Act Statements + rules: [] + status: pending + - id: pt-6 + title: System of Records Notice + rules: [] + status: pending + controls: + - id: pt-6.1 + title: Routine Uses + rules: [] + status: pending + - id: pt-6.2 + title: Exemption Rules + rules: [] + status: pending + - id: pt-7 + title: Specific Categories of Personally Identifiable Information + rules: [] + status: pending + controls: + - id: pt-7.1 + title: Social Security Numbers + rules: [] + status: pending + - id: pt-7.2 + title: First Amendment Information + rules: [] + status: pending + - id: pt-8 + title: Computer Matching Requirements + rules: [] + status: pending diff --git a/products/fedora/controls/nist_800_53/ra.yml b/products/fedora/controls/nist_800_53/ra.yml new file mode 100644 index 000000000000..6ac70b1218f3 --- /dev/null +++ b/products/fedora/controls/nist_800_53/ra.yml @@ -0,0 +1,154 @@ +# NIST 800-53 RA Family: Risk Assessment +controls: + - id: ra-1 + title: Policy and Procedures + levels: + - low + rules: [] + status: pending + - id: ra-2 + title: Security Categorization + levels: + - low + rules: [] + status: pending + controls: + - id: ra-2.1 + title: Impact-level Prioritization + rules: [] + status: pending + levels: + - low + - id: ra-3 + title: Risk Assessment + levels: + - low + rules: [] + status: pending + controls: + - id: ra-3.1 + title: Supply Chain Risk Assessment + levels: + - low + rules: [] + status: pending + - id: ra-3.2 + title: Use of All-source Intelligence + rules: [] + status: pending + levels: + - low + - id: ra-3.3 + title: Dynamic Threat Awareness + rules: [] + status: pending + levels: + - low + - id: ra-3.4 + title: Predictive Cyber Analytics + rules: [] + status: pending + levels: + - low + - id: ra-4 + title: Risk Assessment Update + rules: [] + status: pending + - id: ra-5 + title: Vulnerability Monitoring and Scanning + levels: + - low + rules: [] + status: pending + controls: + - id: ra-5.1 + title: Update Tool Capability + rules: [] + status: pending + levels: + - low + - id: ra-5.2 + title: Update Vulnerabilities to Be Scanned + levels: + - low + rules: [] + status: pending + - id: ra-5.3 + title: Breadth and Depth of Coverage + rules: [] + status: pending + levels: + - low + - id: ra-5.4 + title: Discoverable Information + levels: + - high + rules: [] + status: pending + - id: ra-5.5 + title: Privileged Access + levels: + - moderate + rules: [] + status: pending + - id: ra-5.6 + title: Automated Trend Analyses + rules: [] + status: pending + levels: + - low + - id: ra-5.7 + title: Automated Detection and Notification of Unauthorized + Components + rules: [] + status: pending + levels: + - low + - id: ra-5.8 + title: Review Historic Audit Logs + rules: [] + status: pending + levels: + - low + - id: ra-5.9 + title: Penetration Testing and Analyses + rules: [] + status: pending + levels: + - low + - id: ra-5.10 + title: Correlate Scanning Information + rules: [] + status: pending + levels: + - low + - id: ra-5.11 + title: Public Disclosure Program + levels: + - low + rules: [] + status: pending + - id: ra-6 + title: Technical Surveillance Countermeasures Survey + rules: [] + status: pending + - id: ra-7 + title: Risk Response + levels: + - low + rules: [] + status: pending + - id: ra-8 + title: Privacy Impact Assessments + rules: [] + status: pending + - id: ra-9 + title: Criticality Analysis + levels: + - moderate + rules: [] + status: pending + - id: ra-10 + title: Threat Hunting + rules: [] + status: pending diff --git a/products/fedora/controls/nist_800_53/sa.yml b/products/fedora/controls/nist_800_53/sa.yml new file mode 100644 index 000000000000..be14bdb93a4b --- /dev/null +++ b/products/fedora/controls/nist_800_53/sa.yml @@ -0,0 +1,836 @@ +# NIST 800-53 SA Family: System and Services Acquisition +controls: + - id: sa-1 + title: Policy and Procedures + levels: + - low + rules: [] + status: pending + - id: sa-2 + title: Allocation of Resources + levels: + - low + rules: [] + status: pending + - id: sa-3 + title: System Development Life Cycle + levels: + - low + rules: [] + status: pending + controls: + - id: sa-3.1 + title: Manage Preproduction Environment + rules: [] + status: pending + levels: + - low + - id: sa-3.2 + title: Use of Live or Operational Data + rules: [] + status: pending + levels: + - low + - id: sa-3.3 + title: Technology Refresh + rules: [] + status: pending + levels: + - low + - id: sa-4 + title: Acquisition Process + levels: + - low + rules: [] + status: pending + controls: + - id: sa-4.1 + title: Functional Properties of Controls + levels: + - moderate + rules: [] + status: pending + - id: sa-4.2 + title: Design and Implementation Information for Controls + levels: + - moderate + rules: [] + status: pending + - id: sa-4.3 + title: Development Methods, Techniques, and Practices + rules: [] + status: pending + levels: + - low + - id: sa-4.4 + title: Assignment of Components to Systems + rules: [] + status: pending + levels: + - low + - id: sa-4.5 + title: System, Component, and Service Configurations + levels: + - high + rules: [] + status: pending + - id: sa-4.6 + title: Use of Information Assurance Products + rules: [] + status: pending + levels: + - low + - id: sa-4.7 + title: 'NIAP-approved Protection Profiles ' + rules: [] + status: pending + levels: + - low + - id: sa-4.8 + title: Continuous Monitoring Plan for Controls + rules: [] + status: pending + levels: + - low + - id: sa-4.9 + title: Functions, Ports, Protocols, and Services in Use + levels: + - moderate + rules: [] + status: pending + - id: sa-4.10 + title: Use of Approved PIV Products + levels: + - low + rules: [] + status: pending + - id: sa-4.11 + title: System of Records + rules: [] + status: pending + levels: + - low + - id: sa-4.12 + title: Data Ownership + rules: [] + status: pending + levels: + - low + - id: sa-5 + title: System Documentation + levels: + - low + rules: [] + status: pending + controls: + - id: sa-5.1 + title: Functional Properties of Security Controls + rules: [] + status: pending + levels: + - low + - id: sa-5.2 + title: Security-relevant External System Interfaces + rules: [] + status: pending + levels: + - low + - id: sa-5.3 + title: High-level Design + rules: [] + status: pending + levels: + - low + - id: sa-5.4 + title: Low-level Design + rules: [] + status: pending + levels: + - low + - id: sa-5.5 + title: Source Code + rules: [] + status: pending + levels: + - low + - id: sa-6 + title: Software Usage Restrictions + rules: [] + status: pending + - id: sa-7 + title: User-installed Software + rules: [] + status: pending + - id: sa-8 + title: Security and Privacy Engineering Principles + levels: + - low + rules: [] + status: pending + controls: + - id: sa-8.1 + title: Clear Abstractions + rules: [] + status: pending + levels: + - low + - id: sa-8.2 + title: Least Common Mechanism + rules: [] + status: pending + levels: + - low + - id: sa-8.3 + title: Modularity and Layering + rules: [] + status: pending + levels: + - low + - id: sa-8.4 + title: Partially Ordered Dependencies + rules: [] + status: pending + levels: + - low + - id: sa-8.5 + title: Efficiently Mediated Access + rules: [] + status: pending + levels: + - low + - id: sa-8.6 + title: Minimized Sharing + rules: [] + status: pending + levels: + - low + - id: sa-8.7 + title: Reduced Complexity + rules: [] + status: pending + levels: + - low + - id: sa-8.8 + title: Secure Evolvability + rules: [] + status: pending + levels: + - low + - id: sa-8.9 + title: Trusted Components + rules: [] + status: pending + levels: + - low + - id: sa-8.10 + title: Hierarchical Trust + rules: [] + status: pending + levels: + - low + - id: sa-8.11 + title: Inverse Modification Threshold + rules: [] + status: pending + levels: + - low + - id: sa-8.12 + title: Hierarchical Protection + rules: [] + status: pending + levels: + - low + - id: sa-8.13 + title: Minimized Security Elements + rules: [] + status: pending + levels: + - low + - id: sa-8.14 + title: Least Privilege + rules: [] + status: pending + levels: + - low + - id: sa-8.15 + title: Predicate Permission + rules: [] + status: pending + levels: + - low + - id: sa-8.16 + title: Self-reliant Trustworthiness + rules: [] + status: pending + levels: + - low + - id: sa-8.17 + title: Secure Distributed Composition + rules: [] + status: pending + levels: + - low + - id: sa-8.18 + title: Trusted Communications Channels + rules: [] + status: pending + levels: + - low + - id: sa-8.19 + title: Continuous Protection + rules: [] + status: pending + levels: + - low + - id: sa-8.20 + title: Secure Metadata Management + rules: [] + status: pending + levels: + - low + - id: sa-8.21 + title: Self-analysis + rules: [] + status: pending + levels: + - low + - id: sa-8.22 + title: Accountability and Traceability + rules: [] + status: pending + levels: + - low + - id: sa-8.23 + title: Secure Defaults + rules: [] + status: pending + levels: + - low + - id: sa-8.24 + title: Secure Failure and Recovery + rules: [] + status: pending + levels: + - low + - id: sa-8.25 + title: Economic Security + rules: [] + status: pending + levels: + - low + - id: sa-8.26 + title: Performance Security + rules: [] + status: pending + levels: + - low + - id: sa-8.27 + title: Human Factored Security + rules: [] + status: pending + levels: + - low + - id: sa-8.28 + title: Acceptable Security + rules: [] + status: pending + levels: + - low + - id: sa-8.29 + title: Repeatable and Documented Procedures + rules: [] + status: pending + levels: + - low + - id: sa-8.30 + title: Procedural Rigor + rules: [] + status: pending + levels: + - low + - id: sa-8.31 + title: Secure System Modification + rules: [] + status: pending + levels: + - low + - id: sa-8.32 + title: Sufficient Documentation + rules: [] + status: pending + levels: + - low + - id: sa-8.33 + title: Minimization + rules: [] + status: pending + levels: + - low + - id: sa-9 + title: External System Services + levels: + - low + rules: [] + status: pending + controls: + - id: sa-9.1 + title: Risk Assessments and Organizational Approvals + rules: [] + status: pending + levels: + - low + - id: sa-9.2 + title: Identification of Functions, Ports, Protocols, and Services + levels: + - moderate + rules: [] + status: pending + - id: sa-9.3 + title: Establish and Maintain Trust Relationship with Providers + rules: [] + status: pending + levels: + - low + - id: sa-9.4 + title: Consistent Interests of Consumers and Providers + rules: [] + status: pending + levels: + - low + - id: sa-9.5 + title: Processing, Storage, and Service Location + rules: [] + status: pending + levels: + - low + - id: sa-9.6 + title: Organization-controlled Cryptographic Keys + rules: [] + status: pending + levels: + - low + - id: sa-9.7 + title: Organization-controlled Integrity Checking + rules: [] + status: pending + levels: + - low + - id: sa-9.8 + title: Processing and Storage Location — U.S. Jurisdiction + rules: [] + status: pending + levels: + - low + - id: sa-10 + title: Developer Configuration Management + levels: + - moderate + rules: [] + status: pending + controls: + - id: sa-10.1 + title: Software and Firmware Integrity Verification + rules: [] + status: pending + levels: + - moderate + - id: sa-10.2 + title: Alternative Configuration Management Processes + rules: [] + status: pending + levels: + - moderate + - id: sa-10.3 + title: Hardware Integrity Verification + rules: [] + status: pending + levels: + - moderate + - id: sa-10.4 + title: Trusted Generation + rules: [] + status: pending + levels: + - moderate + - id: sa-10.5 + title: Mapping Integrity for Version Control + rules: [] + status: pending + levels: + - moderate + - id: sa-10.6 + title: Trusted Distribution + rules: [] + status: pending + levels: + - moderate + - id: sa-10.7 + title: Security and Privacy Representatives + rules: [] + status: pending + levels: + - moderate + - id: sa-11 + title: Developer Testing and Evaluation + levels: + - moderate + rules: [] + status: pending + controls: + - id: sa-11.1 + title: Static Code Analysis + rules: [] + status: pending + levels: + - moderate + - id: sa-11.2 + title: Threat Modeling and Vulnerability Analyses + rules: [] + status: pending + levels: + - moderate + - id: sa-11.3 + title: Independent Verification of Assessment Plans and Evidence + rules: [] + status: pending + levels: + - moderate + - id: sa-11.4 + title: Manual Code Reviews + rules: [] + status: pending + levels: + - moderate + - id: sa-11.5 + title: Penetration Testing + rules: [] + status: pending + levels: + - moderate + - id: sa-11.6 + title: Attack Surface Reviews + rules: [] + status: pending + levels: + - moderate + - id: sa-11.7 + title: Verify Scope of Testing and Evaluation + rules: [] + status: pending + levels: + - moderate + - id: sa-11.8 + title: Dynamic Code Analysis + rules: [] + status: pending + levels: + - moderate + - id: sa-11.9 + title: Interactive Application Security Testing + rules: [] + status: pending + levels: + - moderate + - id: sa-12 + title: Supply Chain Protection + rules: [] + status: pending + controls: + - id: sa-12.1 + title: Acquisition Strategies / Tools / Methods + rules: [] + status: pending + - id: sa-12.2 + title: Supplier Reviews + rules: [] + status: pending + - id: sa-12.3 + title: Trusted Shipping and Warehousing + rules: [] + status: pending + - id: sa-12.4 + title: Diversity of Suppliers + rules: [] + status: pending + - id: sa-12.5 + title: Limitation of Harm + rules: [] + status: pending + - id: sa-12.6 + title: Minimizing Procurement Time + rules: [] + status: pending + - id: sa-12.7 + title: Assessments Prior to Selection / Acceptance / Update + rules: [] + status: pending + - id: sa-12.8 + title: Use of All-source Intelligence + rules: [] + status: pending + - id: sa-12.9 + title: Operations Security + rules: [] + status: pending + - id: sa-12.10 + title: Validate as Genuine and Not Altered + rules: [] + status: pending + - id: sa-12.11 + title: Penetration Testing / Analysis of Elements, Processes, and + Actors + rules: [] + status: pending + - id: sa-12.12 + title: Inter-organizational Agreements + rules: [] + status: pending + - id: sa-12.13 + title: Critical Information System Components + rules: [] + status: pending + - id: sa-12.14 + title: Identity and Traceability + rules: [] + status: pending + - id: sa-12.15 + title: Processes to Address Weaknesses or Deficiencies + rules: [] + status: pending + - id: sa-13 + title: Trustworthiness + rules: [] + status: pending + - id: sa-14 + title: Criticality Analysis + rules: [] + status: pending + controls: + - id: sa-14.1 + title: Critical Components with No Viable Alternative Sourcing + rules: [] + status: pending + - id: sa-15 + title: Development Process, Standards, and Tools + levels: + - moderate + rules: [] + status: pending + controls: + - id: sa-15.1 + title: Quality Metrics + rules: [] + status: pending + levels: + - moderate + - id: sa-15.2 + title: Security and Privacy Tracking Tools + rules: [] + status: pending + levels: + - moderate + - id: sa-15.3 + title: Criticality Analysis + levels: + - moderate + rules: [] + status: pending + - id: sa-15.4 + title: Threat Modeling and Vulnerability Analysis + rules: [] + status: pending + levels: + - moderate + - id: sa-15.5 + title: Attack Surface Reduction + rules: [] + status: pending + levels: + - moderate + - id: sa-15.6 + title: Continuous Improvement + rules: [] + status: pending + levels: + - moderate + - id: sa-15.7 + title: Automated Vulnerability Analysis + rules: [] + status: pending + levels: + - moderate + - id: sa-15.8 + title: Reuse of Threat and Vulnerability Information + rules: [] + status: pending + levels: + - moderate + - id: sa-15.9 + title: Use of Live Data + rules: [] + status: pending + levels: + - moderate + - id: sa-15.10 + title: Incident Response Plan + rules: [] + status: pending + levels: + - moderate + - id: sa-15.11 + title: Archive System or Component + rules: [] + status: pending + levels: + - moderate + - id: sa-15.12 + title: Minimize Personally Identifiable Information + rules: [] + status: pending + levels: + - moderate + - id: sa-15.13 + title: Logging Syntax + rules: [] + status: pending + levels: + - moderate + - id: sa-16 + title: Developer-provided Training + levels: + - high + rules: [] + status: pending + - id: sa-17 + title: Developer Security and Privacy Architecture and Design + levels: + - high + rules: [] + status: pending + controls: + - id: sa-17.1 + title: Formal Policy Model + rules: [] + status: pending + levels: + - high + - id: sa-17.2 + title: Security-relevant Components + rules: [] + status: pending + levels: + - high + - id: sa-17.3 + title: Formal Correspondence + rules: [] + status: pending + levels: + - high + - id: sa-17.4 + title: Informal Correspondence + rules: [] + status: pending + levels: + - high + - id: sa-17.5 + title: Conceptually Simple Design + rules: [] + status: pending + levels: + - high + - id: sa-17.6 + title: Structure for Testing + rules: [] + status: pending + levels: + - high + - id: sa-17.7 + title: Structure for Least Privilege + rules: [] + status: pending + levels: + - high + - id: sa-17.8 + title: Orchestration + rules: [] + status: pending + levels: + - high + - id: sa-17.9 + title: Design Diversity + rules: [] + status: pending + levels: + - high + - id: sa-18 + title: Tamper Resistance and Detection + rules: [] + status: pending + controls: + - id: sa-18.1 + title: Multiple Phases of System Development Life Cycle + rules: [] + status: pending + - id: sa-18.2 + title: Inspection of Systems or Components + rules: [] + status: pending + - id: sa-19 + title: Component Authenticity + rules: [] + status: pending + controls: + - id: sa-19.1 + title: Anti-counterfeit Training + rules: [] + status: pending + - id: sa-19.2 + title: Configuration Control for Component Service and Repair + rules: [] + status: pending + - id: sa-19.3 + title: Component Disposal + rules: [] + status: pending + - id: sa-19.4 + title: Anti-counterfeit Scanning + rules: [] + status: pending + - id: sa-20 + title: Customized Development of Critical Components + rules: [] + status: pending + - id: sa-21 + title: Developer Screening + levels: + - high + rules: [] + status: pending + controls: + - id: sa-21.1 + title: Validation of Screening + rules: [] + status: pending + levels: + - high + - id: sa-22 + title: Unsupported System Components + levels: + - low + rules: [] + status: pending + controls: + - id: sa-22.1 + title: Alternative Sources for Continued Support + rules: [] + status: pending + levels: + - low + - id: sa-23 + title: Specialization + rules: [] + status: pending + - id: sa-24 + title: Design For Cyber Resiliency + rules: [] + status: pending diff --git a/products/fedora/controls/nist_800_53/sc.yml b/products/fedora/controls/nist_800_53/sc.yml new file mode 100644 index 000000000000..c45c13aec906 --- /dev/null +++ b/products/fedora/controls/nist_800_53/sc.yml @@ -0,0 +1,888 @@ +# NIST 800-53 SC Family: System and Communications Protection +controls: + - id: sc-1 + title: Policy and Procedures + levels: + - low + rules: [] + status: pending + - id: sc-2 + title: Separation of System and User Functionality + levels: + - moderate + rules: + - sysctl_kernel_dmesg_restrict + status: automated + controls: + - id: sc-2.1 + title: Interfaces for Non-privileged Users + rules: [] + status: pending + levels: + - moderate + - id: sc-2.2 + title: Disassociability + rules: [] + status: pending + levels: + - moderate + - id: sc-3 + title: Security Function Isolation + levels: + - high + rules: + - selinux_not_disabled + - selinux_state + - var_selinux_state=enforcing + status: automated + controls: + - id: sc-3.1 + title: Hardware Separation + rules: [] + status: pending + levels: + - high + - id: sc-3.2 + title: Access and Flow Control Functions + rules: [] + status: pending + levels: + - high + - id: sc-3.3 + title: Minimize Nonsecurity Functionality + rules: [] + status: pending + levels: + - high + - id: sc-3.4 + title: Module Coupling and Cohesiveness + rules: [] + status: pending + levels: + - high + - id: sc-3.5 + title: Layered Structures + rules: [] + status: pending + levels: + - high + - id: sc-4 + title: Information in Shared System Resources + levels: + - moderate + rules: + - dir_perms_world_writable_sticky_bits + - file_permissions_unauthorized_world_writable + status: automated + controls: + - id: sc-4.1 + title: Security Levels + rules: [] + status: pending + levels: + - moderate + - id: sc-4.2 + title: Multilevel or Periods Processing + rules: [] + status: pending + levels: + - moderate + - id: sc-5 + title: Denial-of-service Protection + levels: + - low + rules: + - sysctl_net_ipv4_tcp_syncookies + status: automated + controls: + - id: sc-5.1 + title: Restrict Ability to Attack Other Systems + rules: [] + status: pending + levels: + - low + - id: sc-5.2 + title: Capacity, Bandwidth, and Redundancy + rules: [] + status: pending + levels: + - low + - id: sc-5.3 + title: Detection and Monitoring + rules: [] + status: pending + levels: + - low + - id: sc-6 + title: Resource Availability + rules: [] + status: pending + - id: sc-7 + title: Boundary Protection + levels: + - low + rules: + - service_firewalld_enabled + status: automated + controls: + - id: sc-7.1 + title: Physically Separated Subnetworks + rules: [] + status: pending + levels: + - low + - id: sc-7.2 + title: Public Access + rules: [] + status: pending + levels: + - low + - id: sc-7.3 + title: Access Points + levels: + - moderate + rules: [] + status: pending + - id: sc-7.4 + title: External Telecommunications Services + levels: + - moderate + rules: [] + status: pending + - id: sc-7.5 + title: Deny by Default — Allow by Exception + levels: + - moderate + rules: [] + status: pending + - id: sc-7.6 + title: Response to Recognized Failures + rules: [] + status: pending + levels: + - low + - id: sc-7.7 + title: Split Tunneling for Remote Devices + levels: + - moderate + rules: [] + status: pending + - id: sc-7.8 + title: Route Traffic to Authenticated Proxy Servers + levels: + - moderate + rules: [] + status: pending + - id: sc-7.9 + title: Restrict Threatening Outgoing Communications Traffic + rules: [] + status: pending + levels: + - low + - id: sc-7.10 + title: Prevent Exfiltration + rules: [] + status: pending + levels: + - low + - id: sc-7.11 + title: Restrict Incoming Communications Traffic + rules: [] + status: pending + levels: + - low + - id: sc-7.12 + title: Host-based Protection + rules: [] + status: pending + levels: + - low + - id: sc-7.13 + title: Isolation of Security Tools, Mechanisms, and Support + Components + rules: [] + status: pending + levels: + - low + - id: sc-7.14 + title: Protect Against Unauthorized Physical Connections + rules: [] + status: pending + levels: + - low + - id: sc-7.15 + title: Networked Privileged Accesses + rules: [] + status: pending + levels: + - low + - id: sc-7.16 + title: Prevent Discovery of System Components + rules: [] + status: pending + levels: + - low + - id: sc-7.17 + title: Automated Enforcement of Protocol Formats + rules: [] + status: pending + levels: + - low + - id: sc-7.18 + title: Fail Secure + levels: + - high + rules: [] + status: pending + - id: sc-7.19 + title: Block Communication from Non-organizationally Configured + Hosts + rules: [] + status: pending + levels: + - low + - id: sc-7.20 + title: Dynamic Isolation and Segregation + rules: [] + status: pending + levels: + - low + - id: sc-7.21 + title: Isolation of System Components + levels: + - high + rules: [] + status: pending + - id: sc-7.22 + title: Separate Subnets for Connecting to Different Security Domains + rules: [] + status: pending + levels: + - low + - id: sc-7.23 + title: Disable Sender Feedback on Protocol Validation Failure + rules: [] + status: pending + levels: + - low + - id: sc-7.24 + title: Personally Identifiable Information + rules: [] + status: pending + levels: + - low + - id: sc-7.25 + title: Unclassified National Security System Connections + rules: [] + status: pending + levels: + - low + - id: sc-7.26 + title: Classified National Security System Connections + rules: [] + status: pending + levels: + - low + - id: sc-7.27 + title: Unclassified Non-national Security System Connections + rules: [] + status: pending + levels: + - low + - id: sc-7.28 + title: Connections to Public Networks + rules: [] + status: pending + levels: + - low + - id: sc-7.29 + title: Separate Subnets to Isolate Functions + rules: [] + status: pending + levels: + - low + - id: sc-8 + title: Transmission Confidentiality and Integrity + levels: + - moderate + rules: + - configure_custom_crypto_policy_cis + status: automated + controls: + - id: sc-8.1 + title: Cryptographic Protection + levels: + - moderate + rules: [] + status: pending + - id: sc-8.2 + title: Pre- and Post-transmission Handling + rules: [] + status: pending + levels: + - moderate + - id: sc-8.3 + title: Cryptographic Protection for Message Externals + rules: [] + status: pending + levels: + - moderate + - id: sc-8.4 + title: Conceal or Randomize Communications + rules: [] + status: pending + levels: + - moderate + - id: sc-8.5 + title: Protected Distribution System + rules: [] + status: pending + levels: + - moderate + - id: sc-9 + title: Transmission Confidentiality + rules: [] + status: pending + - id: sc-10 + title: Network Disconnect + levels: + - moderate + rules: [] + status: pending + - id: sc-11 + title: Trusted Path + rules: [] + status: pending + controls: + - id: sc-11.1 + title: Irrefutable Communications Path + rules: [] + status: pending + - id: sc-12 + title: Cryptographic Key Establishment and Management + levels: + - low + rules: [] + status: pending + controls: + - id: sc-12.1 + title: Availability + levels: + - high + rules: [] + status: pending + - id: sc-12.2 + title: Symmetric Keys + rules: [] + status: pending + levels: + - low + - id: sc-12.3 + title: Asymmetric Keys + rules: [] + status: pending + levels: + - low + - id: sc-12.4 + title: PKI Certificates + rules: [] + status: pending + levels: + - low + - id: sc-12.5 + title: PKI Certificates / Hardware Tokens + rules: [] + status: pending + levels: + - low + - id: sc-12.6 + title: Physical Control of Keys + rules: [] + status: pending + levels: + - low + - id: sc-13 + title: Cryptographic Protection + levels: + - low + rules: [] + status: pending + controls: + - id: sc-13.1 + title: FIPS-validated Cryptography + rules: [] + status: pending + levels: + - low + - id: sc-13.2 + title: NSA-approved Cryptography + rules: [] + status: pending + levels: + - low + - id: sc-13.3 + title: Individuals Without Formal Access Approvals + rules: [] + status: pending + levels: + - low + - id: sc-13.4 + title: Digital Signatures + rules: [] + status: pending + levels: + - low + - id: sc-14 + title: Public Access Protections + rules: [] + status: pending + - id: sc-15 + title: Collaborative Computing Devices and Applications + levels: + - low + rules: [] + status: pending + controls: + - id: sc-15.1 + title: Physical or Logical Disconnect + rules: [] + status: pending + levels: + - low + - id: sc-15.2 + title: Blocking Inbound and Outbound Communications Traffic + rules: [] + status: pending + levels: + - low + - id: sc-15.3 + title: Disabling and Removal in Secure Work Areas + rules: [] + status: pending + levels: + - low + - id: sc-15.4 + title: Explicitly Indicate Current Participants + rules: [] + status: pending + levels: + - low + - id: sc-16 + title: Transmission of Security and Privacy Attributes + rules: [] + status: pending + controls: + - id: sc-16.1 + title: Integrity Verification + rules: [] + status: pending + - id: sc-16.2 + title: Anti-spoofing Mechanisms + rules: [] + status: pending + - id: sc-16.3 + title: Cryptographic Binding + rules: [] + status: pending + - id: sc-17 + title: Public Key Infrastructure Certificates + levels: + - moderate + rules: [] + status: pending + - id: sc-18 + title: Mobile Code + levels: + - moderate + rules: [] + status: pending + controls: + - id: sc-18.1 + title: Identify Unacceptable Code and Take Corrective Actions + rules: [] + status: pending + levels: + - moderate + - id: sc-18.2 + title: Acquisition, Development, and Use + rules: [] + status: pending + levels: + - moderate + - id: sc-18.3 + title: Prevent Downloading and Execution + rules: [] + status: pending + levels: + - moderate + - id: sc-18.4 + title: Prevent Automatic Execution + rules: [] + status: pending + levels: + - moderate + - id: sc-18.5 + title: Allow Execution Only in Confined Environments + rules: [] + status: pending + levels: + - moderate + - id: sc-19 + title: Voice Over Internet Protocol + rules: [] + status: pending + - id: sc-20 + title: Secure Name/Address Resolution Service (Authoritative Source) + levels: + - low + rules: [] + status: pending + controls: + - id: sc-20.1 + title: Child Subspaces + rules: [] + status: pending + levels: + - low + - id: sc-20.2 + title: Data Origin and Integrity + rules: [] + status: pending + levels: + - low + - id: sc-21 + title: Secure Name/Address Resolution Service (Recursive or Caching + Resolver) + levels: + - low + rules: [] + status: pending + controls: + - id: sc-21.1 + title: Data Origin and Integrity + rules: [] + status: pending + levels: + - low + - id: sc-22 + title: Architecture and Provisioning for Name/Address Resolution Service + levels: + - low + rules: [] + status: pending + - id: sc-23 + title: Session Authenticity + levels: + - moderate + rules: [] + status: pending + controls: + - id: sc-23.1 + title: Invalidate Session Identifiers at Logout + rules: [] + status: pending + levels: + - moderate + - id: sc-23.2 + title: User-initiated Logouts and Message Displays + rules: [] + status: pending + levels: + - moderate + - id: sc-23.3 + title: Unique System-generated Session Identifiers + rules: [] + status: pending + levels: + - moderate + - id: sc-23.4 + title: Unique Session Identifiers with Randomization + rules: [] + status: pending + levels: + - moderate + - id: sc-23.5 + title: Allowed Certificate Authorities + rules: [] + status: pending + levels: + - moderate + - id: sc-24 + title: Fail in Known State + levels: + - high + rules: + - service_systemd-journald_enabled + status: automated + - id: sc-25 + title: Thin Nodes + rules: [] + status: pending + - id: sc-26 + title: Decoys + rules: [] + status: pending + controls: + - id: sc-26.1 + title: Detection of Malicious Code + rules: [] + status: pending + - id: sc-27 + title: Platform-independent Applications + rules: [] + status: pending + - id: sc-28 + title: Protection of Information at Rest + levels: + - moderate + rules: [] + status: pending + controls: + - id: sc-28.1 + title: Cryptographic Protection + levels: + - moderate + rules: [] + status: pending + - id: sc-28.2 + title: Offline Storage + rules: [] + status: pending + levels: + - moderate + - id: sc-28.3 + title: Cryptographic Keys + rules: [] + status: pending + levels: + - moderate + - id: sc-29 + title: Heterogeneity + rules: [] + status: pending + controls: + - id: sc-29.1 + title: Virtualization Techniques + rules: [] + status: pending + - id: sc-30 + title: Concealment and Misdirection + rules: [] + status: pending + controls: + - id: sc-30.1 + title: Virtualization Techniques + rules: [] + status: pending + - id: sc-30.2 + title: Randomness + rules: [] + status: pending + - id: sc-30.3 + title: Change Processing and Storage Locations + rules: [] + status: pending + - id: sc-30.4 + title: Misleading Information + rules: [] + status: pending + - id: sc-30.5 + title: Concealment of System Components + rules: [] + status: pending + - id: sc-31 + title: Covert Channel Analysis + rules: [] + status: pending + controls: + - id: sc-31.1 + title: Test Covert Channels for Exploitability + rules: [] + status: pending + - id: sc-31.2 + title: Maximum Bandwidth + rules: [] + status: pending + - id: sc-31.3 + title: Measure Bandwidth in Operational Environments + rules: [] + status: pending + - id: sc-32 + title: System Partitioning + rules: [] + status: pending + controls: + - id: sc-32.1 + title: Separate Physical Domains for Privileged Functions + rules: [] + status: pending + - id: sc-33 + title: Transmission Preparation Integrity + rules: [] + status: pending + - id: sc-34 + title: Non-modifiable Executable Programs + rules: [] + status: pending + controls: + - id: sc-34.1 + title: No Writable Storage + rules: [] + status: pending + - id: sc-34.2 + title: Integrity Protection on Read-only Media + rules: [] + status: pending + - id: sc-34.3 + title: Hardware-based Protection + rules: [] + status: pending + - id: sc-35 + title: External Malicious Code Identification + rules: [] + status: pending + - id: sc-36 + title: Distributed Processing and Storage + rules: [] + status: pending + controls: + - id: sc-36.1 + title: Polling Techniques + rules: [] + status: pending + - id: sc-36.2 + title: Synchronization + rules: [] + status: pending + - id: sc-37 + title: Out-of-band Channels + rules: [] + status: pending + controls: + - id: sc-37.1 + title: Ensure Delivery and Transmission + rules: [] + status: pending + - id: sc-38 + title: Operations Security + rules: [] + status: pending + - id: sc-39 + title: Process Isolation + levels: + - low + rules: [] + status: pending + controls: + - id: sc-39.1 + title: Hardware Separation + rules: [] + status: pending + levels: + - low + - id: sc-39.2 + title: Separate Execution Domain Per Thread + rules: [] + status: pending + levels: + - low + - id: sc-40 + title: Wireless Link Protection + rules: [] + status: pending + controls: + - id: sc-40.1 + title: Electromagnetic Interference + rules: [] + status: pending + - id: sc-40.2 + title: Reduce Detection Potential + rules: [] + status: pending + - id: sc-40.3 + title: Imitative or Manipulative Communications Deception + rules: [] + status: pending + - id: sc-40.4 + title: Signal Parameter Identification + rules: [] + status: pending + - id: sc-41 + title: Port and I/O Device Access + rules: [] + status: pending + - id: sc-42 + title: Sensor Capability and Data + rules: [] + status: pending + controls: + - id: sc-42.1 + title: Reporting to Authorized Individuals or Roles + rules: [] + status: pending + - id: sc-42.2 + title: Authorized Use + rules: [] + status: pending + - id: sc-42.3 + title: Prohibit Use of Devices + rules: [] + status: pending + - id: sc-42.4 + title: Notice of Collection + rules: [] + status: pending + - id: sc-42.5 + title: Collection Minimization + rules: [] + status: pending + - id: sc-43 + title: Usage Restrictions + rules: [] + status: pending + - id: sc-44 + title: Detonation Chambers + rules: [] + status: pending + - id: sc-45 + title: System Time Synchronization + rules: [] + status: pending + controls: + - id: sc-45.1 + title: Synchronization with Authoritative Time Source + rules: [] + status: pending + - id: sc-45.2 + title: Secondary Authoritative Time Source + rules: [] + status: pending + - id: sc-46 + title: Cross Domain Policy Enforcement + rules: [] + status: pending + - id: sc-47 + title: Alternate Communications Paths + rules: [] + status: pending + - id: sc-48 + title: Sensor Relocation + rules: [] + status: pending + controls: + - id: sc-48.1 + title: Dynamic Relocation of Sensors or Monitoring Capabilities + rules: [] + status: pending + - id: sc-49 + title: Hardware-enforced Separation and Policy Enforcement + rules: [] + status: pending + - id: sc-50 + title: Software-enforced Separation and Policy Enforcement + rules: [] + status: pending + - id: sc-51 + title: Hardware-based Protection + rules: [] + status: pending diff --git a/products/fedora/controls/nist_800_53/si.yml b/products/fedora/controls/nist_800_53/si.yml new file mode 100644 index 000000000000..821c786686ba --- /dev/null +++ b/products/fedora/controls/nist_800_53/si.yml @@ -0,0 +1,677 @@ +# NIST 800-53 SI Family: System and Information Integrity +controls: + - id: si-1 + title: Policy and Procedures + levels: + - low + rules: [] + status: pending + - id: si-2 + title: Flaw Remediation + levels: + - low + rules: + - ensure_gpgcheck_globally_activated + - ensure_redhat_gpgkey_installed + status: automated + controls: + - id: si-2.1 + title: Central Management + rules: [] + status: pending + levels: + - low + - id: si-2.2 + title: Automated Flaw Remediation Status + levels: + - moderate + rules: [] + status: pending + - id: si-2.3 + title: Time to Remediate Flaws and Benchmarks for Corrective Actions + rules: [] + status: pending + levels: + - low + - id: si-2.4 + title: Automated Patch Management Tools + rules: [] + status: pending + levels: + - low + - id: si-2.5 + title: Automatic Software and Firmware Updates + rules: [] + status: pending + levels: + - low + - id: si-2.6 + title: Removal of Previous Versions of Software and Firmware + rules: [] + status: pending + levels: + - low + - id: si-2.7 + title: Root Cause Analysis + rules: [] + status: pending + levels: + - low + - id: si-3 + title: Malicious Code Protection + levels: + - low + rules: + - kernel_module_usb-storage_disabled + - service_autofs_disabled + status: automated + controls: + - id: si-3.1 + title: Central Management + rules: [] + status: pending + levels: + - low + - id: si-3.2 + title: Automatic Updates + rules: [] + status: pending + levels: + - low + - id: si-3.3 + title: Non-privileged Users + rules: [] + status: pending + levels: + - low + - id: si-3.4 + title: Updates Only by Privileged Users + rules: [] + status: pending + levels: + - low + - id: si-3.5 + title: Portable Storage Devices + rules: [] + status: pending + levels: + - low + - id: si-3.6 + title: Testing and Verification + rules: [] + status: pending + levels: + - low + - id: si-3.7 + title: Nonsignature-based Detection + rules: [] + status: pending + levels: + - low + - id: si-3.8 + title: Detect Unauthorized Commands + rules: [] + status: pending + levels: + - low + - id: si-3.9 + title: Authenticate Remote Commands + rules: [] + status: pending + levels: + - low + - id: si-3.10 + title: Malicious Code Analysis + rules: [] + status: pending + levels: + - low + - id: si-4 + title: System Monitoring + levels: + - low + rules: + - kernel_module_dccp_disabled + - kernel_module_rds_disabled + - kernel_module_sctp_disabled + - kernel_module_tipc_disabled + - service_avahi-daemon_disabled + status: automated + controls: + - id: si-4.1 + title: System-wide Intrusion Detection System + rules: [] + status: pending + levels: + - low + - id: si-4.2 + title: Automated Tools and Mechanisms for Real-time Analysis + levels: + - moderate + rules: [] + status: pending + - id: si-4.3 + title: Automated Tool and Mechanism Integration + rules: [] + status: pending + levels: + - low + - id: si-4.4 + title: Inbound and Outbound Communications Traffic + levels: + - moderate + rules: [] + status: pending + - id: si-4.5 + title: System-generated Alerts + levels: + - moderate + rules: [] + status: pending + - id: si-4.6 + title: Restrict Non-privileged Users + rules: [] + status: pending + levels: + - low + - id: si-4.7 + title: Automated Response to Suspicious Events + rules: [] + status: pending + levels: + - low + - id: si-4.8 + title: Protection of Monitoring Information + rules: [] + status: pending + levels: + - low + - id: si-4.9 + title: Testing of Monitoring Tools and Mechanisms + rules: [] + status: pending + levels: + - low + - id: si-4.10 + title: Visibility of Encrypted Communications + levels: + - high + rules: [] + status: pending + - id: si-4.11 + title: Analyze Communications Traffic Anomalies + rules: [] + status: pending + levels: + - low + - id: si-4.12 + title: Automated Organization-generated Alerts + levels: + - high + rules: [] + status: pending + - id: si-4.13 + title: Analyze Traffic and Event Patterns + rules: [] + status: pending + levels: + - low + - id: si-4.14 + title: Wireless Intrusion Detection + levels: + - high + rules: [] + status: pending + - id: si-4.15 + title: Wireless to Wireline Communications + rules: [] + status: pending + levels: + - low + - id: si-4.16 + title: Correlate Monitoring Information + rules: [] + status: pending + levels: + - low + - id: si-4.17 + title: Integrated Situational Awareness + rules: [] + status: pending + levels: + - low + - id: si-4.18 + title: Analyze Traffic and Covert Exfiltration + rules: [] + status: pending + levels: + - low + - id: si-4.19 + title: Risk for Individuals + rules: [] + status: pending + levels: + - low + - id: si-4.20 + title: Privileged Users + levels: + - high + rules: [] + status: pending + - id: si-4.21 + title: Probationary Periods + rules: [] + status: pending + levels: + - low + - id: si-4.22 + title: Unauthorized Network Services + levels: + - high + rules: [] + status: pending + - id: si-4.23 + title: Host-based Devices + rules: [] + status: pending + levels: + - low + - id: si-4.24 + title: Indicators of Compromise + rules: [] + status: pending + levels: + - low + - id: si-4.25 + title: Optimize Network Traffic Analysis + rules: [] + status: pending + levels: + - low + - id: si-5 + title: Security Alerts, Advisories, and Directives + levels: + - low + rules: [] + status: pending + controls: + - id: si-5.1 + title: Automated Alerts and Advisories + levels: + - high + rules: [] + status: pending + - id: si-6 + title: Security and Privacy Function Verification + levels: + - high + rules: [] + status: pending + controls: + - id: si-6.1 + title: Notification of Failed Security Tests + rules: [] + status: pending + levels: + - high + - id: si-6.2 + title: Automation Support for Distributed Testing + rules: [] + status: pending + levels: + - high + - id: si-6.3 + title: Report Verification Results + rules: [] + status: pending + levels: + - high + - id: si-7 + title: Software, Firmware, and Information Integrity + levels: + - moderate + rules: [] + status: pending + controls: + - id: si-7.1 + title: Integrity Checks + levels: + - moderate + rules: [] + status: pending + - id: si-7.2 + title: Automated Notifications of Integrity Violations + levels: + - high + rules: [] + status: pending + - id: si-7.3 + title: Centrally Managed Integrity Tools + rules: [] + status: pending + levels: + - moderate + - id: si-7.4 + title: Tamper-evident Packaging + rules: [] + status: pending + levels: + - moderate + - id: si-7.5 + title: Automated Response to Integrity Violations + levels: + - high + rules: [] + status: pending + - id: si-7.6 + title: Cryptographic Protection + rules: [] + status: pending + levels: + - moderate + - id: si-7.7 + title: Integration of Detection and Response + levels: + - moderate + rules: [] + status: pending + - id: si-7.8 + title: Auditing Capability for Significant Events + rules: [] + status: pending + levels: + - moderate + - id: si-7.9 + title: Verify Boot Process + rules: [] + status: pending + levels: + - moderate + - id: si-7.10 + title: Protection of Boot Firmware + rules: [] + status: pending + levels: + - moderate + - id: si-7.11 + title: Confined Environments with Limited Privileges + rules: [] + status: pending + levels: + - moderate + - id: si-7.12 + title: Integrity Verification + rules: [] + status: pending + levels: + - moderate + - id: si-7.13 + title: Code Execution in Protected Environments + rules: [] + status: pending + levels: + - moderate + - id: si-7.14 + title: Binary or Machine Executable Code + rules: [] + status: pending + levels: + - moderate + - id: si-7.15 + title: Code Authentication + levels: + - high + rules: [] + status: pending + - id: si-7.16 + title: Time Limit on Process Execution Without Supervision + rules: [] + status: pending + levels: + - moderate + - id: si-7.17 + title: Runtime Application Self-protection + rules: [] + status: pending + levels: + - moderate + - id: si-8 + title: Spam Protection + levels: + - moderate + rules: [] + status: pending + controls: + - id: si-8.1 + title: Central Management + rules: [] + status: pending + levels: + - moderate + - id: si-8.2 + title: Automatic Updates + levels: + - moderate + rules: [] + status: pending + - id: si-8.3 + title: Continuous Learning Capability + rules: [] + status: pending + levels: + - moderate + - id: si-9 + title: Information Input Restrictions + rules: [] + status: pending + - id: si-10 + title: Information Input Validation + levels: + - moderate + rules: [] + status: pending + controls: + - id: si-10.1 + title: Manual Override Capability + rules: [] + status: pending + levels: + - moderate + - id: si-10.2 + title: Review and Resolve Errors + rules: [] + status: pending + levels: + - moderate + - id: si-10.3 + title: Predictable Behavior + rules: [] + status: pending + levels: + - moderate + - id: si-10.4 + title: Timing Interactions + rules: [] + status: pending + levels: + - moderate + - id: si-10.5 + title: Restrict Inputs to Trusted Sources and Approved Formats + rules: [] + status: pending + levels: + - moderate + - id: si-10.6 + title: Injection Prevention + rules: [] + status: pending + levels: + - moderate + - id: si-11 + title: Error Handling + levels: + - moderate + rules: [] + status: pending + - id: si-12 + title: Information Management and Retention + levels: + - low + rules: [] + status: pending + controls: + - id: si-12.1 + title: Limit Personally Identifiable Information Elements + rules: [] + status: pending + levels: + - low + - id: si-12.2 + title: Minimize Personally Identifiable Information in Testing, + Training, and Research + rules: [] + status: pending + levels: + - low + - id: si-12.3 + title: Information Disposal + rules: [] + status: pending + levels: + - low + - id: si-13 + title: Predictable Failure Prevention + rules: [] + status: pending + controls: + - id: si-13.1 + title: Transferring Component Responsibilities + rules: [] + status: pending + - id: si-13.2 + title: Time Limit on Process Execution Without Supervision + rules: [] + status: pending + - id: si-13.3 + title: Manual Transfer Between Components + rules: [] + status: pending + - id: si-13.4 + title: Standby Component Installation and Notification + rules: [] + status: pending + - id: si-13.5 + title: Failover Capability + rules: [] + status: pending + - id: si-14 + title: Non-persistence + rules: [] + status: pending + controls: + - id: si-14.1 + title: Refresh from Trusted Sources + rules: [] + status: pending + - id: si-14.2 + title: Non-persistent Information + rules: [] + status: pending + - id: si-14.3 + title: Non-persistent Connectivity + rules: [] + status: pending + - id: si-15 + title: Information Output Filtering + rules: [] + status: pending + - id: si-16 + title: Memory Protection + levels: + - moderate + rules: + - sysctl_kernel_randomize_va_space + status: automated + - id: si-17 + title: Fail-safe Procedures + rules: [] + status: pending + - id: si-18 + title: Personally Identifiable Information Quality Operations + rules: [] + status: pending + controls: + - id: si-18.1 + title: Automation Support + rules: [] + status: pending + - id: si-18.2 + title: Data Tags + rules: [] + status: pending + - id: si-18.3 + title: Collection + rules: [] + status: pending + - id: si-18.4 + title: Individual Requests + rules: [] + status: pending + - id: si-18.5 + title: Notice of Correction or Deletion + rules: [] + status: pending + - id: si-19 + title: De-identification + rules: [] + status: pending + controls: + - id: si-19.1 + title: Collection + rules: [] + status: pending + - id: si-19.2 + title: Archiving + rules: [] + status: pending + - id: si-19.3 + title: Release + rules: [] + status: pending + - id: si-19.4 + title: Removal, Masking, Encryption, Hashing, or Replacement of + Direct Identifiers + rules: [] + status: pending + - id: si-19.5 + title: Statistical Disclosure Control + rules: [] + status: pending + - id: si-19.6 + title: Differential Privacy + rules: [] + status: pending + - id: si-19.7 + title: Validated Algorithms and Software + rules: [] + status: pending + - id: si-19.8 + title: Motivated Intruder + rules: [] + status: pending + - id: si-20 + title: Tainting + rules: [] + status: pending + - id: si-21 + title: Information Refresh + rules: [] + status: pending + - id: si-22 + title: Information Diversity + rules: [] + status: pending + - id: si-23 + title: Information Fragmentation + rules: [] + status: pending diff --git a/products/fedora/controls/nist_800_53/sr.yml b/products/fedora/controls/nist_800_53/sr.yml new file mode 100644 index 000000000000..8c057fc2cdc1 --- /dev/null +++ b/products/fedora/controls/nist_800_53/sr.yml @@ -0,0 +1,160 @@ +# NIST 800-53 SR Family: Supply Chain Risk Management +controls: + - id: sr-1 + title: Policy and Procedures + levels: + - low + rules: [] + status: pending + - id: sr-2 + title: Supply Chain Risk Management Plan + levels: + - low + rules: [] + status: pending + controls: + - id: sr-2.1 + title: Establish SCRM Team + levels: + - low + rules: [] + status: pending + - id: sr-3 + title: Supply Chain Controls and Processes + levels: + - low + rules: [] + status: pending + controls: + - id: sr-3.1 + title: Diverse Supply Base + rules: [] + status: pending + levels: + - low + - id: sr-3.2 + title: Limitation of Harm + rules: [] + status: pending + levels: + - low + - id: sr-3.3 + title: Sub-tier Flow Down + rules: [] + status: pending + levels: + - low + - id: sr-4 + title: Provenance + rules: [] + status: pending + controls: + - id: sr-4.1 + title: Identity + rules: [] + status: pending + - id: sr-4.2 + title: Track and Trace + rules: [] + status: pending + - id: sr-4.3 + title: Validate as Genuine and Not Altered + rules: [] + status: pending + - id: sr-4.4 + title: Supply Chain Integrity — Pedigree + rules: [] + status: pending + - id: sr-5 + title: Acquisition Strategies, Tools, and Methods + levels: + - low + rules: [] + status: pending + controls: + - id: sr-5.1 + title: Adequate Supply + rules: [] + status: pending + levels: + - low + - id: sr-5.2 + title: Assessments Prior to Selection, Acceptance, Modification, or + Update + rules: [] + status: pending + levels: + - low + - id: sr-6 + title: Supplier Assessments and Reviews + levels: + - moderate + rules: [] + status: pending + controls: + - id: sr-6.1 + title: Testing and Analysis + rules: [] + status: pending + levels: + - moderate + - id: sr-7 + title: Supply Chain Operations Security + rules: [] + status: pending + - id: sr-8 + title: Notification Agreements + levels: + - low + rules: [] + status: pending + - id: sr-9 + title: Tamper Resistance and Detection + levels: + - high + rules: [] + status: pending + controls: + - id: sr-9.1 + title: Multiple Stages of System Development Life Cycle + levels: + - high + rules: [] + status: pending + - id: sr-10 + title: Inspection of Systems or Components + levels: + - low + rules: [] + status: pending + - id: sr-11 + title: Component Authenticity + levels: + - low + rules: [] + status: pending + controls: + - id: sr-11.1 + title: Anti-counterfeit Training + levels: + - low + rules: [] + status: pending + - id: sr-11.2 + title: Configuration Control for Component Service and Repair + levels: + - low + rules: [] + status: pending + - id: sr-11.3 + title: Anti-counterfeit Scanning + rules: [] + status: pending + levels: + - low + - id: sr-12 + title: Component Disposal + levels: + - low + rules: [] + status: pending From fb6d97212079050e8a71d8e643fa631dcc0600e0 Mon Sep 17 00:00:00 2001 From: Gabriel Becker Date: Wed, 19 Aug 2026 14:35:16 +0200 Subject: [PATCH 2/7] Adapt NIST 800-53 controls for Fedora product Modify the copied NIST 800-53 control files to use Fedora-specific rules and variable values: Changes in nist_800_53.yml: - Update policy title from "RHEL10" to "Fedora" - Change product field from "rhel10" to "fedora" Changes in si.yml: - Replace ensure_redhat_gpgkey_installed with ensure_fedora_gpgkey_installed Changes in au.yml: - var_auditd_admin_space_left_action: cis_rhel10 -> cis_fedora - var_auditd_space_left_action: cis_rhel10 -> cis_fedora - var_auditd_disk_error_action: cis_rhel10 -> cis_fedora - var_auditd_disk_full_action: cis_rhel10 -> cis_fedora - var_multiple_time_servers: rhel -> fedora Changes in ia.yml: - var_password_hashing_algorithm: cis_rhel10 -> cis_fedora - var_password_hashing_algorithm_pam: cis_rhel10 -> cis_fedora Changes in var_password_hashing_algorithm_pam.var: - Add cis_fedora: yescrypt|sha512 option to support Fedora controls These changes ensure the controls use Fedora-appropriate rules and configuration values for compliance testing. --- .../var_password_hashing_algorithm_pam.var | 1 + products/fedora/controls/nist_800_53.yml | 6 +++--- products/fedora/controls/nist_800_53/au.yml | 10 +++++----- products/fedora/controls/nist_800_53/ia.yml | 4 ++-- products/fedora/controls/nist_800_53/si.yml | 2 +- 5 files changed, 12 insertions(+), 11 deletions(-) diff --git a/linux_os/guide/system/accounts/accounts-pam/var_password_hashing_algorithm_pam.var b/linux_os/guide/system/accounts/accounts-pam/var_password_hashing_algorithm_pam.var index 03034796501e..0ff1eb2914c9 100644 --- a/linux_os/guide/system/accounts/accounts-pam/var_password_hashing_algorithm_pam.var +++ b/linux_os/guide/system/accounts/accounts-pam/var_password_hashing_algorithm_pam.var @@ -18,5 +18,6 @@ options: yescrypt: yescrypt cis_rhel8: yescrypt|sha512 cis_rhel10: yescrypt|sha512 + cis_fedora: yescrypt|sha512 cis_debian13: yescrypt|sha512 diff --git a/products/fedora/controls/nist_800_53.yml b/products/fedora/controls/nist_800_53.yml index 78f26dcbc284..4919fb8650b1 100644 --- a/products/fedora/controls/nist_800_53.yml +++ b/products/fedora/controls/nist_800_53.yml @@ -1,9 +1,9 @@ -policy: NIST 800-53 Revision 5 (RHEL10) -title: NIST Special Publication 800-53 Revision 5 for RHEL10 +policy: NIST 800-53 Revision 5 (Fedora) +title: NIST Special Publication 800-53 Revision 5 for Fedora id: nist_800_53 version: Revision 5 source: https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final -product: rhel10 +product: fedora controls_dir: nist_800_53 levels: - id: low diff --git a/products/fedora/controls/nist_800_53/au.yml b/products/fedora/controls/nist_800_53/au.yml index 0118e345f5c0..344da071d718 100644 --- a/products/fedora/controls/nist_800_53/au.yml +++ b/products/fedora/controls/nist_800_53/au.yml @@ -35,8 +35,8 @@ controls: - ensure_journald_and_rsyslog_not_active_together - var_audit_backlog_limit=8192 - var_auditd_action_mail_acct=root - - var_auditd_admin_space_left_action=cis_rhel10 - - var_auditd_space_left_action=cis_rhel10 + - var_auditd_admin_space_left_action=cis_fedora + - var_auditd_space_left_action=cis_fedora status: automated controls: - id: au-2.1 @@ -135,7 +135,7 @@ controls: - sysctl_net_ipv4_conf_default_log_martians - chronyd_run_as_chrony_user - sshd_max_auth_tries_value=4 - - var_multiple_time_servers=rhel + - var_multiple_time_servers=fedora status: automated controls: - id: au-3.1 @@ -177,8 +177,8 @@ controls: rules: - auditd_data_disk_error_action - auditd_data_disk_full_action - - var_auditd_disk_error_action=cis_rhel10 - - var_auditd_disk_full_action=cis_rhel10 + - var_auditd_disk_error_action=cis_fedora + - var_auditd_disk_full_action=cis_fedora status: automated controls: - id: au-5.1 diff --git a/products/fedora/controls/nist_800_53/ia.yml b/products/fedora/controls/nist_800_53/ia.yml index b299a306c97e..6f4fc601427c 100644 --- a/products/fedora/controls/nist_800_53/ia.yml +++ b/products/fedora/controls/nist_800_53/ia.yml @@ -219,8 +219,8 @@ controls: - set_password_hashing_algorithm_systemauth - var_accounts_minimum_age_login_defs=1 - var_accounts_password_warn_age_login_defs=7 - - var_password_hashing_algorithm=cis_rhel10 - - var_password_hashing_algorithm_pam=cis_rhel10 + - var_password_hashing_algorithm=cis_fedora + - var_password_hashing_algorithm_pam=cis_fedora - var_password_pam_dictcheck=1 - var_password_pam_difok=2 - var_password_pam_maxrepeat=3 diff --git a/products/fedora/controls/nist_800_53/si.yml b/products/fedora/controls/nist_800_53/si.yml index 821c786686ba..a62a9be5d3a0 100644 --- a/products/fedora/controls/nist_800_53/si.yml +++ b/products/fedora/controls/nist_800_53/si.yml @@ -12,7 +12,7 @@ controls: - low rules: - ensure_gpgcheck_globally_activated - - ensure_redhat_gpgkey_installed + - ensure_fedora_gpgkey_installed status: automated controls: - id: si-2.1 From b30731a5b25fe3d236a244ade3c1c9689a4ecca6 Mon Sep 17 00:00:00 2001 From: Gabriel Becker Date: Fri, 21 Aug 2026 13:20:58 +0200 Subject: [PATCH 3/7] Add Fedora to NIST 800-53 gemara artifact generation Add Fedora to the list of default products in the gemara export and test workflow scripts: - export_to_gemara.py: Add fedora to DEFAULT_PRODUCTS list - test_workflow_local.sh: Add fedora to PRODUCTS list This enables automatic generation of gemara artifacts for Fedora NIST 800-53 controls alongside RHEL products. Tested with: python3 utils/nist_sync/export_to_gemara.py --products fedora Result: 1196 controls, 439 rules, 539 mappings successfully generated --- utils/nist_sync/export_to_gemara.py | 2 +- utils/nist_sync/test_workflow_local.sh | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/utils/nist_sync/export_to_gemara.py b/utils/nist_sync/export_to_gemara.py index 0c4140791dd9..1d3aa301e853 100644 --- a/utils/nist_sync/export_to_gemara.py +++ b/utils/nist_sync/export_to_gemara.py @@ -50,7 +50,7 @@ from gemara.schema import validate_catalog, validate_guidance, validate_mapping -DEFAULT_PRODUCTS = ["rhel8", "rhel9", "rhel10"] +DEFAULT_PRODUCTS = ["rhel8", "rhel9", "rhel10", "fedora"] DEFAULT_OUTPUT_DIR = _REPO_ROOT / "build" / "gemara" DEFAULT_OSCAL_CATALOG = _SCRIPT_DIR / "data" / "nist_800_53_rev5_catalog.json" DEFAULT_DATA_DIR = _SCRIPT_DIR / "data" diff --git a/utils/nist_sync/test_workflow_local.sh b/utils/nist_sync/test_workflow_local.sh index 64049a39a02b..2c4c8563a70e 100755 --- a/utils/nist_sync/test_workflow_local.sh +++ b/utils/nist_sync/test_workflow_local.sh @@ -9,7 +9,7 @@ echo "║ Local CIS-NIST Workflow Test ║" echo "╚════════════════════════════════════════════════════════════╝" echo "" -PRODUCTS="rhel8 rhel9 rhel10" +PRODUCTS="rhel8 rhel9 rhel10 fedora" # Recursively count controls (base + nested enhancements) and rule # selections across all family files in a directory. Uses ruamel.yaml From 1aa276408095b704f095227c5a40ad0e1bece994 Mon Sep 17 00:00:00 2001 From: Gabriel Becker Date: Mon, 31 Aug 2026 13:25:44 +0200 Subject: [PATCH 4/7] nist_sync: stop emitting an invalid platform field in generated profiles MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit _write_xccdf_profile() unconditionally wrote 'platform: {product}' into the generated nist_800_53.profile. This happens to be valid for rhel8/rhel9/rhel10 (bare product IDs that match a CPE platform name) but breaks the build for any product where it isn't, e.g. fedora ('Unsupported platform 'fedora' in a profile'). No other product-scoped profile under products/{product}/profiles/ sets a platform field — it's redundant since the profile's location already scopes it to that product. Drop it instead of special-casing per-product validity. --- utils/nist_sync/export_to_gemara.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/utils/nist_sync/export_to_gemara.py b/utils/nist_sync/export_to_gemara.py index 1d3aa301e853..0d34e0a0f395 100644 --- a/utils/nist_sync/export_to_gemara.py +++ b/utils/nist_sync/export_to_gemara.py @@ -64,6 +64,11 @@ def _write_xccdf_profile(product: str, repo_root: Path, verbose: bool) -> None: assessment-plans — so this single profile covers Low, Moderate, and High. The file is intentionally not committed; re-run export_to_gemara.py to regenerate it after adding or removing rules from the control file. + + No 'platform:' field is set: like every other product-scoped profile under + products/{product}/profiles/, the platform is implicit from its location. + Setting it explicitly also breaks for products (e.g. fedora) whose product + ID isn't itself a valid CPE platform name. """ full_name = product_full_name(product) profile_path = repo_root / "products" / product / "profiles" / "nist_800_53.profile" @@ -75,7 +80,6 @@ def _write_xccdf_profile(product: str, repo_root: Path, verbose: bool) -> None: ComplianceAsCode for {full_name}, across all baselines (Low, Moderate, High). Generated by utils/nist_sync/export_to_gemara.py. Do not edit manually. -platform: {product} selections: - nist_800_53:all """ From 4cccb790d1e41b8cede1b67abdd8534e4a95c8b6 Mon Sep 17 00:00:00 2001 From: Gabriel Becker Date: Wed, 26 Aug 2026 00:29:01 +0200 Subject: [PATCH 5/7] Add Vagrant and Ansible setup for Fedora NIST 800-53 testing MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add infrastructure for end-to-end testing of Fedora NIST 800-53 controls using Vagrant and Ansible: New files: - vagrant/Vagrantfile.fedora: official Fedora 44 Cloud libvirt box, downloaded directly from download.fedoraproject.org - vagrant/populate_inventory_fedora.sh: generate the Ansible inventory ([fedora_scanner] group) for the Fedora VM - ansible/setup_fedora.yml: one-time setup playbook — installs complyctl, the OpenSCAP provider, a local OCI registry, oras, and always deploys the locally built data stream (the packaged scap-security-guide RPM predates in-development profiles and would silently shadow it) - ansible/scan_fedora.yml: runs 'complyctl get' + 'complyctl scan' against the XDG-layout workspace expected by current complyctl, across all baselines (Low/Moderate/High) Usage: cd utils/nist_sync/vagrant VAGRANT_VAGRANTFILE=Vagrantfile.fedora vagrant up bash populate_inventory_fedora.sh cd .. ansible-playbook -i ansible/inventory.ini ansible/setup_fedora.yml \ -e complyctl_bin=/path/to/complyctl \ -e provider_bin=~/.complytime/providers/complyctl-provider-openscap ansible-playbook -i ansible/inventory.ini ansible/scan_fedora.yml This enables the same Complytime E2E testing workflow used for RHEL products to be applied to Fedora. Validated end-to-end: full 439-rule nist_800_53 profile evaluates 407 requirements (190 passed, 217 failed) on a stock Fedora 44 Cloud image. --- utils/nist_sync/ansible/scan_fedora.yml | 116 +++++++++++++ utils/nist_sync/ansible/setup_fedora.yml | 159 ++++++++++++++++++ utils/nist_sync/vagrant/Vagrantfile.fedora | 64 +++++++ .../vagrant/populate_inventory_fedora.sh | 52 ++++++ 4 files changed, 391 insertions(+) create mode 100644 utils/nist_sync/ansible/scan_fedora.yml create mode 100644 utils/nist_sync/ansible/setup_fedora.yml create mode 100644 utils/nist_sync/vagrant/Vagrantfile.fedora create mode 100755 utils/nist_sync/vagrant/populate_inventory_fedora.sh diff --git a/utils/nist_sync/ansible/scan_fedora.yml b/utils/nist_sync/ansible/scan_fedora.yml new file mode 100644 index 000000000000..cdf3fc128e16 --- /dev/null +++ b/utils/nist_sync/ansible/scan_fedora.yml @@ -0,0 +1,116 @@ +--- +# Run complyctl NIST scans on the Fedora VM. +# +# Prerequisites: +# - setup_fedora.yml has been run +# - A Gemara bundle has been pushed to the VM's registry +# +# Usage (from utils/nist_sync/): +# # First, push the bundle from the host: +# python3 utils/nist_sync/generate_complyctl_bundle.py --product fedora --push \ +# --registry "http://$(vagrant ssh-config | awk '/HostName/ {print $2}'):5500" +# +# # Then run this playbook: +# ansible-playbook -i ansible/inventory.ini ansible/scan_fedora.yml + +- name: Run complyctl NIST scans on Fedora + hosts: fedora_scanner + become: true + vars: + registry_port: "{{ lookup('env', 'REGISTRY_PORT') | default('5500', true) }}" + policy_id: nist-800-53-rev5-fedora + bundle_ref: "localhost:{{ registry_port }}/nist-800-53-rev5-fedora" + # Baselines to test (Low / Moderate / High) + baselines: + - low + - moderate + - high + + tasks: + - name: Ensure complytime directories exist (XDG layout) + ansible.builtin.file: + path: "{{ item }}" + state: directory + mode: "0700" + loop: + - /root/.cache/complytime + - /root/.local/share/complytime + - /root/.complytime + + - name: Create complytime.yaml + ansible.builtin.copy: + dest: /root/.complytime/complytime.yaml + mode: "0600" + content: | + policies: + - url: http://{{ bundle_ref }} + id: {{ policy_id }} + + targets: + - id: local + policies: + - {{ policy_id }} + variables: + profile: nist_800_53 + datastream: /usr/share/xml/scap/ssg/content/ssg-fedora-ds.xml + + - name: Show complytime config + ansible.builtin.command: cat /root/.complytime/complytime.yaml + register: config_content + changed_when: false + + - name: Display config + ansible.builtin.debug: + msg: "{{ config_content.stdout_lines }}" + + - name: Test registry connectivity + ansible.builtin.command: > + curl -sf http://localhost:{{ registry_port }}/v2/_catalog + register: catalog + changed_when: false + failed_when: false + + - name: Show registry catalog + ansible.builtin.debug: + msg: "{{ catalog.stdout }}" + + - name: Pull policy from registry (complyctl get) + ansible.builtin.command: > + /usr/local/bin/complyctl get --workspace /root/.complytime + register: get_result + changed_when: false + + - name: Show get result + ansible.builtin.debug: + msg: "{{ get_result.stdout_lines }}" + + - name: Run complyctl scan + ansible.builtin.shell: | + set -e + echo "=== Running NIST 800-53 scan on Fedora ===" + /usr/local/bin/complyctl scan \ + --workspace /root/.complytime \ + --policy-id {{ policy_id }} \ + --format oscal > /tmp/nist-fedora-scan.json + echo "Scan complete: /tmp/nist-fedora-scan.json" + echo "" + echo "Results summary (first 20):" + jq -r '.results[] | "\(.rule_id): \(.result)"' /tmp/nist-fedora-scan.json 2>/dev/null | head -20 || echo "No results field" + echo "" + echo "Pass/Fail counts:" + jq '.results | group_by(.result) | map({result: .[0].result, count: length}) | .[]' \ + /tmp/nist-fedora-scan.json 2>/dev/null || echo "Checking OSCAL format..." + # Also show file size and existence + ls -lh /tmp/nist-fedora-scan.json + register: scan_results + changed_when: false + + - name: Display scan results + ansible.builtin.debug: + msg: "{{ scan_results.stdout_lines }}" + + - name: Fetch scan results to host + ansible.builtin.fetch: + src: "/tmp/nist-fedora-scan.json" + dest: "/tmp/fedora-nist-scan-results.json" + flat: true diff --git a/utils/nist_sync/ansible/setup_fedora.yml b/utils/nist_sync/ansible/setup_fedora.yml new file mode 100644 index 000000000000..1c7a9cb38173 --- /dev/null +++ b/utils/nist_sync/ansible/setup_fedora.yml @@ -0,0 +1,159 @@ +--- +# One-time setup of the Fedora scanner VM. +# +# Usage (from utils/nist_sync/): +# ansible-playbook -i ansible/inventory.ini ansible/setup_fedora.yml \ +# -e complyctl_bin=/tmp/complyctl \ +# -e provider_bin=~/.complytime/providers/complyctl-provider-openscap +# +# Optional env overrides (also accepted as -e vars): +# COMPLYCTL_BIN path to complyctl binary on the host (default: /tmp/complyctl) +# PROVIDER_BIN path to complyctl-provider-openscap (default: ~/.complytime/providers/...) +# ORAS_VERSION oras release to install (default: 1.2.3) +# REGISTRY_PORT container registry port inside the VM (default: 5500) + +- name: Set up complyctl NIST scanner on Fedora + hosts: fedora_scanner + become: true + vars: + complyctl_bin: "{{ lookup('env', 'COMPLYCTL_BIN') | default('/tmp/complyctl', true) }}" + provider_bin: "{{ lookup('env', 'PROVIDER_BIN') | default(ansible_env.HOME + '/.complytime/providers/complyctl-provider-openscap', true) }}" + oras_version: "{{ lookup('env', 'ORAS_VERSION') | default('1.2.3', true) }}" + registry_port: "{{ lookup('env', 'REGISTRY_PORT') | default('5500', true) }}" + # Root of the content repo on the host — three levels above the playbook dir. + # playbook_dir = .../utils/nist_sync/ansible + repo_root: "{{ playbook_dir | realpath + '/../../..' }}" + ds_dest: /usr/share/xml/scap/ssg/content/ssg-fedora-ds.xml + + tasks: + # ------------------------------------------------------------------------- + # complyctl binary + # ------------------------------------------------------------------------- + - name: Copy complyctl binary + ansible.builtin.copy: + src: "{{ complyctl_bin }}" + dest: /usr/local/bin/complyctl + mode: "0755" + + - name: Verify complyctl runs + ansible.builtin.command: /usr/local/bin/complyctl version + register: ver + changed_when: false + + - name: Show complyctl version + ansible.builtin.debug: + msg: "{{ ver.stdout }}" + + # ------------------------------------------------------------------------- + # complyctl-provider-openscap + # ------------------------------------------------------------------------- + - name: Create provider directory + ansible.builtin.file: + path: /root/.local/share/complytime/providers + state: directory + mode: "0755" + + - name: Copy complyctl-provider-openscap + ansible.builtin.copy: + src: "{{ provider_bin }}" + dest: /root/.local/share/complytime/providers/complyctl-provider-openscap + mode: "0755" + + # ------------------------------------------------------------------------- + # OCI registry — distribution/distribution binary (no podman required). + # Runs as a systemd service inside the VM listening on all interfaces. + # The host pushes bundles to ansible_host:{{ registry_port }} via oras; + # complyctl on the VM uses http://localhost:{{ registry_port }}. + # ------------------------------------------------------------------------- + - name: Check if registry binary is already installed + ansible.builtin.stat: + path: /usr/local/bin/registry + register: registry_bin_stat + + - name: Download distribution/distribution registry binary + ansible.builtin.shell: | + curl -sL \ + "https://github.com/distribution/distribution/releases/download/v2.8.3/registry_2.8.3_linux_amd64.tar.gz" \ + | tar -xz -C /usr/local/bin registry + chmod +x /usr/local/bin/registry + when: not registry_bin_stat.stat.exists + + - name: Create registry config + ansible.builtin.copy: + dest: /etc/registry-config.yml + mode: "0644" + content: | + version: 0.1 + log: + level: info + storage: + filesystem: + rootdirectory: /var/lib/registry + http: + addr: 0.0.0.0:{{ registry_port }} + headers: + X-Content-Type-Options: [nosniff] + + - name: Create systemd unit for registry + ansible.builtin.copy: + dest: /etc/systemd/system/oci-registry.service + mode: "0644" + content: | + [Unit] + Description=OCI Distribution Registry + After=network.target + + [Service] + Type=simple + ExecStart=/usr/local/bin/registry serve /etc/registry-config.yml + Restart=on-failure + RestartSec=10s + + [Install] + WantedBy=multi-user.target + + - name: Enable and start registry + ansible.builtin.systemd: + name: oci-registry + enabled: true + state: started + daemon_reload: true + + # ------------------------------------------------------------------------- + # oras CLI — for pushing bundles to the registry from the host. + # ------------------------------------------------------------------------- + - name: Check if oras is already installed + ansible.builtin.stat: + path: /usr/local/bin/oras + register: oras_stat + + - name: Download oras + ansible.builtin.shell: | + curl -sL \ + "https://github.com/oras-project/oras/releases/download/v{{ oras_version }}/oras_{{ oras_version }}_linux_amd64.tar.gz" \ + | tar -xz -C /usr/local/bin oras + chmod +x /usr/local/bin/oras + when: not oras_stat.stat.exists + + # ------------------------------------------------------------------------- + # SCAP data stream — always copy the repo-built version. + # The system RPM (scap-security-guide) predates the nist_800_53 profile + # commit and will not contain that profile. The built data stream must + # be deployed even if the RPM is already installed. + # ------------------------------------------------------------------------- + - name: "Copy built data stream from host" + ansible.builtin.copy: + src: "{{ repo_root }}/build/ssg-fedora-ds.xml" + dest: "{{ ds_dest }}" + mode: "0644" + force: true + + - name: Confirm data stream has nist_800_53 profile + ansible.builtin.command: "grep -c nist_800_53 {{ ds_dest }}" + register: profile_check + changed_when: false + failed_when: profile_check.rc != 0 or profile_check.stdout | int == 0 + + - name: Show data stream status + ansible.builtin.debug: + msg: "Data stream: {{ ds_dest }} — nist_800_53 profile present ({{ profile_check.stdout }} occurrences)" diff --git a/utils/nist_sync/vagrant/Vagrantfile.fedora b/utils/nist_sync/vagrant/Vagrantfile.fedora new file mode 100644 index 000000000000..bf217c686cf9 --- /dev/null +++ b/utils/nist_sync/vagrant/Vagrantfile.fedora @@ -0,0 +1,64 @@ +# -*- mode: ruby -*- +# vi: set ft=ruby : +# +# Fedora scanner VM for NIST 800-53 Gemara / complyctl E2E testing. +# +# Usage: +# cd utils/nist_sync/vagrant +# VAGRANT_VAGRANTFILE=Vagrantfile.fedora vagrant up +# VAGRANT_VAGRANTFILE=Vagrantfile.fedora vagrant ssh +# VAGRANT_VAGRANTFILE=Vagrantfile.fedora vagrant halt +# VAGRANT_VAGRANTFILE=Vagrantfile.fedora vagrant destroy +# +# Or create an alias in your shell: +# alias vagrant-fedora='VAGRANT_VAGRANTFILE=Vagrantfile.fedora vagrant' +# vagrant-fedora up +# +# After 'vagrant up', run: +# bash populate_inventory.sh fedora # writes ../ansible/inventory.ini with fedora_scanner +# ansible-playbook -i ../ansible/inventory.ini ../ansible/setup_fedora.yml \ +# -e complyctl_bin=/home/$USER/bin/complyctl \ +# -e provider_bin=~/.complytime/providers/complyctl-provider-openscap +# ansible-playbook -i ../ansible/inventory.ini ../ansible/scan_fedora.yml + +Vagrant.configure("2") do |config| + # Official Fedora 44 Cloud Vagrant libvirt box. + # The generic/ namespace lags behind Fedora releases, so we pull the official + # box directly from download.fedoraproject.org (which redirects to a mirror). + config.vm.box = "f44-cloud-base" + config.vm.box_url = "https://download.fedoraproject.org/pub/fedora/linux/releases/44/Cloud/x86_64/images/Fedora-Cloud-Base-Vagrant-libvirt-44-1.7.x86_64.vagrant.libvirt.box" + config.vm.hostname = "nist-fedora-scanner" + + # Private network — host can reach VM via its DHCP-assigned IP. + # populate_inventory.sh extracts this IP via 'vagrant ssh-config'. + config.vm.network "private_network", type: "dhcp" + + # libvirt only — this is what Automatus already uses elsewhere in this project + config.vm.provider "libvirt" do |v| + v.memory = 2048 + v.cpus = 2 + end + + # Install OS-level dependencies for OpenSCAP scanning + config.vm.provision "shell", name: "base-packages", inline: <<~SHELL + set -euo pipefail + + echo "=== Installing base packages ===" + # Fedora ships with openscap-scanner and scap-security-guide in the repos + dnf install -y openscap-scanner openscap-engine-sce 2>&1 | tail -5 + + # scap-security-guide provides /usr/share/xml/scap/ssg/content/ssg-fedora-ds.xml + dnf install -y scap-security-guide 2>&1 | tail -5 || \ + echo " [WARN] scap-security-guide unavailable; Ansible will copy the built data stream." + + echo "=== Base provisioning complete ===" + SHELL + + # After 'vagrant up', write the Ansible inventory on the host machine. + # Use the Fedora-specific script so the [fedora_scanner] group is generated + # (the generic populate_inventory.sh defaults to the rhel9_scanner group). + config.trigger.after [:up, :reload] do |trigger| + trigger.info = "Updating Ansible inventory (../ansible/inventory.ini)..." + trigger.run = { path: "populate_inventory_fedora.sh" } + end +end diff --git a/utils/nist_sync/vagrant/populate_inventory_fedora.sh b/utils/nist_sync/vagrant/populate_inventory_fedora.sh new file mode 100755 index 000000000000..e847c0c16a1f --- /dev/null +++ b/utils/nist_sync/vagrant/populate_inventory_fedora.sh @@ -0,0 +1,52 @@ +#!/bin/bash +# Populate Ansible inventory with the running Fedora Vagrant VM's SSH details. +# +# Called automatically by the Vagrantfile after 'vagrant up', +# or manually from the vagrant/ directory. +# +# Usage: +# bash populate_inventory_fedora.sh + +set -euo pipefail + +VAGRANT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" +ANSIBLE_DIR="$VAGRANT_DIR/../ansible" +INVENTORY_FILE="$ANSIBLE_DIR/inventory.ini" + +if [[ ! -f "$VAGRANT_DIR/Vagrantfile.fedora" ]]; then + echo "Error: Vagrantfile.fedora not found in $VAGRANT_DIR" + exit 1 +fi + +# Extract SSH connection details from Vagrant +VAGRANT_VAGRANTFILE=Vagrantfile.fedora +export VAGRANT_VAGRANTFILE + +SSH_HOST=$(vagrant ssh-config | grep -w HostName | awk '{print $2}') +SSH_PORT=$(vagrant ssh-config | grep -w Port | awk '{print $2}') +SSH_USER=$(vagrant ssh-config | grep -w User | awk '{print $2}') +SSH_KEY=$(vagrant ssh-config | grep -w IdentityFile | awk '{print $2}') + +if [[ -z "$SSH_HOST" || -z "$SSH_PORT" ]]; then + echo "Error: could not extract SSH details from 'vagrant ssh-config'" + echo " Is the VM running? Try: VAGRANT_VAGRANTFILE=Vagrantfile.fedora vagrant up" + exit 1 +fi + +cat > "$INVENTORY_FILE" << EOF +# Ansible inventory for Fedora NIST scanner VM. +# Auto-generated by populate_inventory_fedora.sh — do not edit manually. + +[fedora_scanner] +nist-fedora-scanner ansible_host=$SSH_HOST ansible_port=$SSH_PORT ansible_user=$SSH_USER ansible_ssh_private_key_file=$SSH_KEY ansible_ssh_common_args='-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null' +EOF + +echo "Wrote $INVENTORY_FILE" +echo "" +echo "Next steps:" +echo " cd $VAGRANT_DIR/.." +echo " ansible-playbook -i ansible/inventory.ini ansible/setup_fedora.yml \\" +echo " -e complyctl_bin=/tmp/complyctl \\" +echo " -e provider_bin=~/.complytime/providers/complyctl-provider-openscap" +echo "" +echo " ansible-playbook -i ansible/inventory.ini ansible/scan_fedora.yml" From a3dbbead9871d8c8c694adaa7f01bd33756c7b29 Mon Sep 17 00:00:00 2001 From: Gabriel Becker Date: Fri, 21 Aug 2026 14:45:39 +0200 Subject: [PATCH 6/7] Add Fedora to default products in update-policies workflow Include Fedora alongside RHEL 8/9/10 in the automatic Gemara artifact generation and complytime-policies synchronization workflow. --- .github/workflows/update-policies.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/update-policies.yml b/.github/workflows/update-policies.yml index 218b8795cea8..9a39f5395e15 100644 --- a/.github/workflows/update-policies.yml +++ b/.github/workflows/update-policies.yml @@ -31,9 +31,9 @@ on: workflow_dispatch: inputs: products: - description: 'Comma-separated list of products to sync (default: rhel8,rhel9,rhel10)' + description: 'Comma-separated list of products to sync (default: rhel8,rhel9,rhel10,fedora)' required: false - default: 'rhel8,rhel9,rhel10' + default: 'rhel8,rhel9,rhel10,fedora' jobs: update-policies: @@ -73,7 +73,7 @@ jobs: [ -n "${{ inputs.products }}" ]; then PRODUCTS="${{ inputs.products }}" else - PRODUCTS="rhel8,rhel9,rhel10" + PRODUCTS="rhel8,rhel9,rhel10,fedora" fi echo "products=${PRODUCTS}" >> "$GITHUB_OUTPUT" From 492664b9fbfc2cd71531331b8441359ade3ff8ec Mon Sep 17 00:00:00 2001 From: Gabriel Becker Date: Wed, 26 Aug 2026 00:17:42 +0200 Subject: [PATCH 7/7] Fix incorrect actions/checkout version comment in update-policies.yml MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The pinned SHA (3d3c42e5...) resolves to actions/checkout v7.0.1, not v4 as the comment claimed. This is the same class of mistake flagged in PR #14685's review (actions/upload-artifact was pinned to a v4 comment but a v7.0.0 SHA) — verify comments against the actual tagged version, not just assume the SHA matches its label. --- .github/workflows/update-policies.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/update-policies.yml b/.github/workflows/update-policies.yml index 9a39f5395e15..08474a8f85ea 100644 --- a/.github/workflows/update-policies.yml +++ b/.github/workflows/update-policies.yml @@ -56,7 +56,7 @@ jobs: python3-setuptools - name: Checkout ComplianceAsCode/content - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: path: content