Subject: Re: [sacm] IM Issue #30: Are reports out of scope for SACM and can they be removed from the Information Model?

From: "Jim Bieda (jbieda)" <[email-masked]>
Date: Wed, 24 Feb 2016 21:17:02 +0000

Dan,

I think reports are out of scope for sacm.  No objections to taking “report” language out.

Thanks,
Jim

From: sacm <[email-masked]<mailto:[email-masked]>> on behalf of "Haynes, Dan" <[email-masked]<mailto:[email-masked]>>
Date: Wednesday, February 24, 2016 at 12:10 PM
To: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: [sacm] IM Issue #30: Are reports out of scope for SACM and can they be removed from the Information Model?

Hi Everyone,

The SACM Information Model currently contains three sections related to reports: “Report”, “Report Generator”, and “Reporting Guidance”. During IETF 94, we discussed whether or not reports were out-of-scope for SACM. This discussion was based on a question that was found in the text of the Information Model which said:

                    “ISSUE (CEK): Should we take modeling of reports out of scope?  It is clear that reports are needed.  But is a *standard* for reports needed, and does it deserve our priority?”

During the discussion, it was noted that reports are likely very organization specific which may make it difficult to standardize around and that standardizing reports is not explicitly called out in the charter.

In general, the group seemed to be leaning towards this and that the report-related sections should be removed.  With that said, I wanted to ping the list to get feedback from the rest of the group.

Does this change seem reasonable?  Are there any objections this change?

Please provide any feedback by Wednesday March 2nd.

Thanks,

Danny

[1] https://github.com/sacmwg/draft-ietf-sacm-information-model/issues/30

---

From: "Romascanu, Dan (Dan)" <[email-masked]>
Date: Thu, 25 Feb 2016 10:48:19 +0000

I agree. I would not say that ‘reports are out of scope for SACM’, actually the charter mentions ‘report results’ as the last step in  endpoint posture assessment.  There is nothing in the deliverables however about reporting mechanisms. We may later discuss extending the charter if the issue surfaces as a requirement.

Regards,

Dan

From: sacm [mailto:[email-masked]] On Behalf Of Jim Bieda (jbieda)
Sent: Wednesday, February 24, 2016 11:17 PM
To: Haynes, Dan; [email-masked]
Subject: Re: [sacm] IM Issue #30: Are reports out of scope for SACM and can they be removed from the Information Model?

Dan,

Thanks,
Jim

Hi Everyone,

Thanks,

Danny

[1] https://github.com/sacmwg/draft-ietf-sacm-information-model/issues/30<https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_sacmwg_draft-2Dietf-2Dsacm-2Dinformation-2Dmodel_issues_30&d=BQMGaQ&c=BFpWQw8bsuKpl1SgiZH64Q&r=I4dzGxR31OcNXCJfQzvlsiLQfucBXRucPvdrphpBsFA&m=KA_lqiWk-b7sw9xqusdu9NYCMpeOgaVwtsSlAi-U_Fw&s=kNP6IecVC7QSmIw-pW2vTnM8RfgyhQw9INLUlEvTcpk&e=>

---

From: "Haynes, Dan" <[email-masked]>
Date: Thu, 25 Feb 2016 14:53:59 +0000

Thanks for the feedback!  That seems like a reasonable approach to me Dan.

Thanks,

Danny

From: Romascanu, Dan (Dan) [mailto:[email-masked]]
Sent: Thursday, February 25, 2016 5:48 AM
To: Jim Bieda (jbieda) <[email-masked]>; Haynes, Dan <[email-masked]>; [email-masked]
Subject: RE: [sacm] IM Issue #30: Are reports out of scope for SACM and can they be removed from the Information Model?

Regards,

Dan

From: sacm [mailto:[email-masked]] On Behalf Of Jim Bieda (jbieda)
Sent: Wednesday, February 24, 2016 11:17 PM
To: Haynes, Dan; [email-masked]<mailto:[email-masked]>
Subject: Re: [sacm] IM Issue #30: Are reports out of scope for SACM and can they be removed from the Information Model?

Dan,

Thanks,
Jim

Hi Everyone,

Thanks,

Danny

---

From: Adam Montville <[email-masked]>
Date: Sun, 28 Feb 2016 10:42:35 -0500

The charter might mention "report results", but that's an action not a
thing.  Generally, it seems that we agree (or there are at least no
objections) to removing the concept of complex reporting and sticking the
the relatively simple "we want to report plain results".

On Thursday, February 25, 2016, Haynes, Dan <[email-masked]> wrote:

> *From:* Romascanu, Dan (Dan) [mailto:[email-masked]
> <javascript:_e(%7B%7D,'cvml',[email-masked]');>]
> *Sent:* Thursday, February 25, 2016 5:48 AM
> *To:* Jim Bieda (jbieda) <[email-masked]
> <javascript:_e(%7B%7D,'cvml',[email-masked]');>>; Haynes, Dan <
> [email-masked] <javascript:_e(%7B%7D,'cvml',[email-masked]');>>;
> [email-masked] <javascript:_e(%7B%7D,'cvml',[email-masked]');>
> *Subject:* RE: [sacm] IM Issue #30: Are reports out of scope for SACM and
> can they be removed from the Information Model?
>
>
>
> I agree. I would not say that ‘reports are out of scope for SACM’,
> actually the charter mentions ‘report results’ as the last step in  endpoint
> posture assessment.  There is nothing in the deliverables however about
> reporting mechanisms. We may later discuss extending the charter if the
> issue surfaces as a requirement.
>
>
>
> Regards,
>
>
>
> Dan
>
>
>
>
>
> *From:* sacm [mailto:[email-masked]
> <javascript:_e(%7B%7D,'cvml',[email-masked]');>] *On Behalf Of *Jim
> Bieda (jbieda)
> *Sent:* Wednesday, February 24, 2016 11:17 PM
> *To:* Haynes, Dan; [email-masked]
> <javascript:_e(%7B%7D,'cvml',[email-masked]');>
> *Subject:* Re: [sacm] IM Issue #30: Are reports out of scope for SACM and
> can they be removed from the Information Model?
>
>
>
> Dan,
>
>
>
> *From: *sacm <[email-masked]
> <javascript:_e(%7B%7D,'cvml',[email-masked]');>> on behalf of
> "Haynes, Dan" <[email-masked]
> <javascript:_e(%7B%7D,'cvml',[email-masked]');>>
> *Date: *Wednesday, February 24, 2016 at 12:10 PM
> *To: *"[email-masked] <javascript:_e(%7B%7D,'cvml',[email-masked]');>" <
> [email-masked] <javascript:_e(%7B%7D,'cvml',[email-masked]');>>
> *Subject: *[sacm] IM Issue #30: Are reports out of scope for SACM and can
> they be removed from the Information Model?
>
>
>
> Hi Everyone,
>
>
> During the discussion, it was noted that reports are likely very
> organization specific which may make it difficult to standardize around and
> that standardizing reports is not explicitly called out in the charter.
>
>
>
> In general, the group seemed to be leaning towards this and that the
> report-related sections should be removed.  With that said, I wanted to
> ping the list to get feedback from the rest of the group.
>
>
>
> <https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_sacmwg_draft-2Dietf-2Dsacm-2Dinformation-2Dmodel_issues_30&d=BQMGaQ&c=BFpWQw8bsuKpl1SgiZH64Q&r=I4dzGxR31OcNXCJfQzvlsiLQfucBXRucPvdrphpBsFA&m=KA_lqiWk-b7sw9xqusdu9NYCMpeOgaVwtsSlAi-U_Fw&s=kNP6IecVC7QSmIw-pW2vTnM8RfgyhQw9INLUlEvTcpk&e=>
>
>
>