Scope, influences and mappings

Scope, influences and mappings

The README says that the schema models the structure of the CIS Controls, Version 8.1, at its v8.1.2 revision: the Controls, the Safeguards, and each Safeguard’s asset class, security function and Implementation Groups. It carries none of CIS’s text, because CIS licenses the Controls under CC BY-NC-ND 4.0 and the repository is Apache-2.0.¹

Its influences are the CIS Controls alone: the schema renders one publication, and its release asset and governance files follow lmodel/slsa. It maps to two vocabularies and borrows from neither:

• OSCAL, the Open Security Controls Assessment Language: each class names its lmodel/oscal counterpart in broad_mappings, a Control as oscal:Group and a Safeguard as oscal:Control, because the OSCAL class is the more general one;
• NIST CSF 2.0, the Cybersecurity Framework: CisSecurityFunction names nist_csf_v2:Function in related_mappings, and each value carries the CSF function’s two letters in an annotation. lmodel/nist-csf-v2 gives no single function an IRI, so the values carry no meaning.

The README leaves out CIS’s text, CIS’s own mappings to other frameworks, its companion guides, the subclasses of each asset class, earlier versions of the Controls, and the rules no validator can check.

The changelog says what the rewrite removed:

• CIS’s text in the examples and descriptions;
• the slots that held it;
• the three subsets;
• the mappings file to lmodel/nist-csf-v2, whose rows all named elements that nist-csf-v2 v0.1.0 no longer has;
• the mappings to lmodel/iso27001, which is being rewritten.²

docs/about.md repeats what is left out for readers of the schema’s pages.³

Footnotes

1. README.md, What it models, Influences, Mappings and Not modelled here ↩

2. CHANGELOG.md, the Removed entries ↩

3. docs/about.md, What is left out ↩