mitre/ckl2poam

Standalone tool for converting DISA Checklists to eMASS POA&M Excel spreadsheets.

ckl2POAM

Standalone tool for converting DISA Checklists to eMASS POA&M Excel spreadsheets.

How to install:

1. Clone the repository: git clone https://github.com/mitre/ckl2POAM
2. Install dependencies: npm install
3. Build the app: npm run build

How to update:

Option 1 (Using git)

1. Ensure you are in the folder containing ckl2POAM
2. Stash any existing input/outputs git stash --include-untracked
3. Update the repository: git fetch
4. Pull the latest changes git pull
5. Restore your files git stash pop
6. Install dependencies: npm install
7. Build the app: npm run build

Option 2 (Using Download as Zip on Windows)

1. Delete your existing ckl2POAM folder
2. Download the most recent version: https://github.com/mitre/ckl2POAM/archive/refs/heads/main.zip
3. Lower your PowerShell Execution Policy with Set-Executionpolicy Unrestricted (Press Win+X and choose Open PowerShell as Administrator)
4. Open setup.ps1
   • If you encounter an error running this script try running Unblock-File -Path C:\path\to\setup.ps1 in PowerShell
5. Follow the on-screen steps to install NodeJS and build the app
6. Restore PowerShell Execution policy with Set-Executionpolicy Default

Option 3 (Using Download as Zip on MacOS/Linux)

1. Delete your existing ckl2POAM folder
2. Download the most recent version: https://github.com/mitre/ckl2POAM/archive/refs/heads/main.zip
3. Enter the ckl2POAM folder using the terminal
4. Install dependencies: npm install
5. Build the app: npm run build

How to use:

1. Put your .ckl checklist files into input/
2. Run the script: npm run start
3. Converted spreadsheets will show up in output/

Contributing, Issues and Support

Contributing

Please feel free to look through our issues, make a fork and submit PRs and improvements. We love hearing from our end-users and the community and will be happy to engage with you on suggestions, updates, fixes or new capabilities.

Issues and Support

Please feel free to contact us by opening an issue on the issue board, or, at [email protected] should you have any suggestions, questions or issues. If you have more general questions about the use of our software or other concerns, please contact us at [email protected].

NOTICE

© 2019-2021 The MITRE Corporation.

Approved for Public Release; Distribution Unlimited. Case Number 18-3678.

NOTICE

MITRE hereby grants express written permission to use, reproduce, distribute, modify, and otherwise leverage this software to the extent permitted by the licensed terms provided in the LICENSE.md file included with this project.

NOTICE

This software was produced for the U. S. Government under Contract Number HHSM-500-2012-00008I, and is subject to Federal Acquisition Regulation Clause 52.227-14, Rights in Data-General.

No other use other than that granted to the U. S. Government, or to those acting on behalf of the U. S. Government under that Clause is authorized without the express written permission of The MITRE Corporation.

For further information, please contact The MITRE Corporation, Contracts Management Office, 7515 Colshire Drive, McLean, VA 22102-7539, [phone].

ckl2poam's Issues

prepopulate columns P,Q,R,S,U

To support initial values aligning with system of record defaults and accelerate security SME review of same, please use column N (Raw Severity) to prepopulate columns P (Severity), Q (Relevance of Threat), R (Likelihood), S (Impact), and U (Residual Risk Level) based on the rubric:
N = P, Q, R, S, U
I = High, Moderate, Moderate, High, Moderate
II = Moderate, Moderate, Moderate, Moderate, Moderate
III = Low, Moderate, Low, Low, Low

Add needed Notices to the README and License.md file

Update data/logic for SV to CCI to AP mapping

For populating column D (Security Control Number) from CKL using ckl2POAM, please:

1. use the recently identified authoritative lookup for CCI to Control mapping (CCItoControl, sent separately)
2. ensure that the CCI pulled from the CKL discussion of each SV is the first CCI listed (seems to be using tail, not head)

check for spurious values in hidden column A

Column A (specifically A8 and all rows below) should be blank after data is inputted

remove certain special characters

Please remove special characters ' " \ < > and replace with spaces

Can we deprecate this repo?

https://github.com/mitre/saf#ckl-to-poam

Use unique Control numbers

Use proper NIST mappings to CCI for the Control Number

fill column K: Source Identifying

prepopulate column K: Source Identifying based on STIG title, version, release info fields from CKL, as displayed in STIG viewer, prepended with "Identified by"

Example: Identified by Canonical Ubuntu 16.04 Security Technical Implementation Guide :: Version 2, Release: 2 Benchmark Date: 22 Jan 2021

update Security Check translation

Please update ckl2POAM to address bug in eMASS where POAM imports successfully but does not link CKL to POAM in Assets > Findings > Benchmarks whenever column F Security Check contains more than the syntax or 15 character limit of SV-#####r#_rule For example,
FAIL: SV-90187r2_rule, V-75507
PASS: SV-90187r2_rule