This project proposes to generate the cprt data in oscal in the form of a set of control catalogs and controls mapping
Ended Project Grant Awarded Last action
- Award ID
- 60NANB23D006
- Recipient
-
Cyberesi Consulting Group Inc. UEI LW7MZY7VFUQ6
- Awarding agency
-
National Institute of Standards and Technology
Department of Commerce
- Obligated
- $402,658
Award facts
- Assistance listing
- 11.609 Measurement and Engineering Research and Standards
- Completion date
- Originally
- Place of performance
- Baltimore, MD 21230, USA
Award details come from USAspending.gov.
Description
- Activities
- The project will automatically build oscal content from cprt reference data and related mapping document. Specifically, proof-of-concept code will programmatically combine cprt mappings with the pre-existing oscal NIST SP 800-53 control (SP 800-53 catalog) to create new oscal content. The resultant content will increase publicly available oscal content. This new oscal content will provide product vendors the ability to import well-formed and valid oscal into their products. This will enable GRC product vendors to import oscal as a starting point for assessment, reporting, and authorization (i.e., system security plan generation).
- Expected outcomes
- Once the project successfully expands available oscal content, follow-on activities will enrich the oscal content with mapping information. Specifically, a future project will create proof-of-concept code to programmatically create oscal content where the relationship between two or more embedded reference datasets are defined by key properties. Key properties might include relationship types using set theory, mapping rational using semantic, syntactic, or functional terms, and fulfillment statements whether one reference element entirely satisfies the other reference element. This will allow users, such as GRC product vendors, to go beyond communicating the relationships of SP 800-53 controls to cprt reference dataset. Product vendors would then be able to express the fulfillment of a given cprt reference dataset based on SP 800-53 assessments.
- Intended beneficiaries
- Governance, risk and compliance (GRC) tool vendors will be able to support automated assessments against other regulatory frameworks than SP 800-53. System owners will be able to generate information regarding the cprt controls satisfaction in machine readable formats (XML, json and yaml), security assessors and auditors will be able to automate 60% or more of the systems assessment while increasing the assessment accuracy. Security framework owners and system implementers will be able to use the mapping model to relay how the controls from one framework relate to controls from other regulatory frameworks, supporting rigorous assessments ?once? And inference of the results ?multiple times?.
- Subrecipient activities
- There are no planned subawards.
Transactions
| Action | Obligated | Date |
|---|---|---|
| Amendment | -$6,718 | |
| Amendment | $6,718 | |
| Amendment | $6,718 | |
| Amendment | $0 | |
| Amendment | $0 | |
| Amendment | $0 | |
| Amendment | $98,985 | |
| Amendment | $98,985 | |
| Amendment | $98,985 | |
| Original award | $98,985 |
Quick answers
Who received award 60NANB23D006?
60NANB23D006 was awarded to Cyberesi Consulting Group Inc. by National Institute of Standards and Technology (Department of Commerce) on March 1, 2023.
How much is award 60NANB23D006 worth?
$402,658 has been obligated on 60NANB23D006.
On GovTribe
See this award's full record
- Every transaction and subaward
- The recipient's other awards and teaming partners
- Similar grant awards
- Ask GovTribe AI about this award