Change:
specific provider, and a provider can publish information without having a specific consumer targeted to receive it. <del> Provider Identification: The interfaces and actions in the data model MUST include the ability to identify data from a specific provider.  For example, a SACM consumer should be able to request all data to come from a specific provider (e.g.  Provider A) as there can be a larger set of providers. </del> Data Cardinality: The data model MUST describe their constraints (e.g. cardinality).  As posture information and the tasks for collection, aggregation, or evaluation, could comprise one or more

Discussion:
Change the location of DM-006 to OPS and make some new text for it.
Do you have any text to suggest?
Sorry. I see has text.
I like the change but my only suggestion is to capitalize "Consumer" and "Provider" to make it clearer that these are the SACM components.
Version -09 I am not sure what this statement is actually trying to say. I first read it as referring to a Data Origin source, but then realized that this could refer to a provider in the architecture sense. This should probably be clarified.
Hi Jim, The intent is to have the endpoint acting an instance of a SACM Provider's identity be specified. Would the following be more clear (as a replacement to the 1st sentence): The data model MUST include the ability to provide the identity of the SACM Provider. Thanks, Nancy
That does not seem to say the same thing as the current sentence. I think what you want to say is closer to: The interfaces and actions in the data model MUST include the ability to identify data published by a specific provider. I used published because I don't know if there is a better SACM verb. What I mean by it is "data collected, processed or assessed". That is data that originated with that provider as oppose to data which it received from elsewhere and relayed on.
Hi Jim, I think it is the distinction is that when the data is provided, in that encapsulation there must be a means to specify the provider of that URL is what I was striving for.....I interpret the "identify data published by a specific provider" as potentially being a separate interface as well?
Getting back into the flow of things again. This seems to me to be better stated as an operation requirement than as a data model requirement. The query would say - only get the data from provider X. However it is not clear that I would model this as part of the data when I am doing processing on it. I would not necessary expect to keep this as part of my internal data structures. Data source is already provided as DM-0012 so that would not need to be duplicated here. I would suggest OP-XXXX Provider Restriction: Request operations MUST include the ability to restrict the data to be provided by a specific provider or a provider with specific characteristics. Response operations MUST include the ability to identify the provider that supplied the response.

For example, a SACM consumer should be able to request that all of the data come from a specific provider by identity (e.g. Provider A) or from a provider that is in a specific location (e.g. in the Boston office).
Hi Jim, I have the suggested text now in the merged branch and will fold it into rev -12