Question: Should Gemara standardize applicability value?

[zohayb23]

Would it be valuable for Gemara users if Gemara standardized acceptable sensitivity levels?

Example:

• CCC uses tlp clear, amber, green, and red.
• OSPS Baseline uses maturity levels 1,2, and 3.

[jpower432]

I'm curious — do you mean defining constraints around the applicabilty values in gemara or allowing applicabilty definitions to be a shareable artifact?

I think that could be useful when importing controls, but I think it could be difficult to standardize on applicabilty in different contexts. Looking at the example, I think the Baseline Maturity levels have more to do with project lifecylce and impact than the sensitivity level.

[eddie-knight]

If we have some consistency across catalogs regardless of the authors, we might unlock more cross-ecosystem capabilities for tools or assessment plans that can make different decisions based on the applicability without necessarily knowing the details of the catalog being ingested.

I'm wondering whether we could have recommended values, like the ones from CCC and OSPS, just to encourage standardization. Or we lock in required values like we do with layer 4 Result entries, but the list is just a bit longer to support both the sensitivity & maturity use cases.

[jpower432]

If we have some consistency across catalogs regardless of the authors, we might unlock more cross-ecosystem capabilities for tools or assessment plans that can make different decisions based on the applicability without necessarily knowing the details of the catalog being ingested.

Nice. I agree, this seems like a good use case. I think this could enhance the catalog authoring process when importing from multiple sources. Seems like standards around applicabilty would make the outcome of importing controls more predictable to support these tools.

I'm wondering whether we could have recommended values, like the ones from CCC and OSPS, just to encourage standardization. Or we lock in required values like we do with layer 4 Result entries, but the list is just a bit longer to support both the sensitivity & maturity use cases.

Thanks for this clarification. I originally understood the question as asking if we should create a single standard for the applicabilty. I think adding standards per use case makes sense whether they are shareable recommended values or constraints in the schema.