Baseline Tailor needs to be more security control baseline centric and less control-centric

[its-a-lisa-at-work]

I have observed that the baseline version 0.13 tool has the ability to select baselines for controls based on low, moderate or high baselines but not not mapped to the confidentiality, integrity and availability. I believe if we make the selection more granular for each, it will give a better experience choosing controls and make it easier for those trying to tailor the controls. It will result in 27 baselines instead of 3 baselines.

[joshualubell]

Thanks for raising this issue.

I think maybe the issue underlying your observation is that, despite having "baseline" in its name, "Baseline Tailor" focuses more on individual controls than on control baselines. According to the RMF (NIST SP 800-37r2), baselines are developed at the organizational level. However, security categorization (determining the impact level based on CIA) is done at the system level. From a documentation standpoint, a tailored baseline doesn't include categorization info for individual systems. Instead, categorization info is included as part of the system security plan (SSP), which in turn is part an authorization package (which an authorization official uses to determine whether the system is allowed to operate or be used). FYI, the proposed OSCAL language) includes a data format for SSPs.

So, although I don't think the current user interface does a good job supporting this, my vision for Baseline Tailor is that people would use it do create tailored baselines (by copy-pasting from the Security Control Editor "XML Representation" field into a file for each control in the baseline and tweaking the file using an XML text editor), using the SP 800-53 baselines as a starting point. I considered system categorization to be out of scope.

Having said that, I think it would be great if the Baseline Tailor user interface were more baseline-centric, such that the user interactions with the UI produced XML representing a baseline (perhaps as an OSCAL "profile"). But this would require a major rewrite of the UI, and also the ability to import/export partially completed baselines.