courses/beginner/11

[giscus[bot]]

courses/beginner/11

From STIG to Profile Recall from our initial example of an InSpec control that a real control will be tied back to a requirement from an upstream piece of security guidance docu...

https://mitre-saf-training.netlify.app/courses/beginner/11.html

[jrodriguez617]

21. This document/page would benefit from a diagram showing the relationship between security guidance documentation (e.g., STIG, CIS Benchmark), profiles, and controls.

[jrodriguez617]

22. Clearly distinguish between stub profiles and fully implemented controls. The section describes the process of generating stub profiles from STIG XCCDF XML files but does not sufficiently clarify the difference between a stub and a fully implemented control. Explicitly state that stub profiles provide metadata and structure but require manual addition of test logic (describe blocks) to become actionable. Consider providing a checklist or workflow for converting a stub into a complete, testable control or a link to a similar resource.

[jrodriguez617]

23. I would have preferred this section explaining the linkage of SRG to profiles to appear earlier rather than at the end. Please consider revising its placement.