OSCAL/Lobby

Hello everyone! Based on OSCAL's current direction with rules & tests, could the below example of control <> rule <> test <> component relationships be critiqued at a conceptual level, models aside? CC @Apostolos-Delis

Context
Tech: The organization is on AWS.
Control framework under assessment: "Custom"

Control XYZ: All applicable data is encrypted at-rest within {{system_name}}'s environment

Rule (1): Cloud infrastructure datastores are encrypted at-rest utilizing AES-256 or an equivalent, at minimum

• Test (1): AWS S3 buckets are encrypted at-rest via server-side encryption utilizing AES-256

  • Component Set (a): S3 bucket; count 5; location: account xyz, us-gov-east-1
    • Component Scopes: Custom, NIST 800-53
  • Component Set (b): S3 bucket; count 10; location: account xyz, us-east-1
    • Component Scopes: Custom, SOC 2, ISO 27001
  • Assessment Results: 15/15 S3 buckets in Custom scope are encrypted at rest via 256-bit AES encryption

• Test (2): RDS databases are encrypted at-rest utilizing AES-256

  • [Same flow as above]

Rule (2): End user devices are encrypted at-rest utilizing AES-256 or an equivalent, at minimum

• Test (1): User devices are encrypted at-rest utilizing AES-256 via Microsoft Intune

  • Component Set (c): Windows machine; count 100
    • Component Scopes: Custom, NIST 800-53, SOC 2, ISO 27001, HIPAA
  • Assessment Results: 100/100 Windows devices in Custom scope are encrypted at rest via 256-bit AES encryption

• Test (2): User devices are encrypted at-rest utilizing AES-256 via JumpCloud

  • Component Set (d): Ubuntu machine; count 50
    • Component Scopes: Custom, NIST 800-53, SOC 2, ISO 27001, HIPAA
  • Assessment Results: 50/50 Ubuntu devices in Custom scope are encrypted at rest via 256-bit AES encryption