Original text:
results.  Types, classes or the characteristics of an individual target endpoint are defined via endpoint profiles.  The task by which endpoint attributes are evaluated. The resulting value from having evaluated a set of posture general, it cannot be simply assumed that the source of time a target endpoint uses is synchronized or trustworthy.  3. This memo includes no request to IANA.

Reviewer comments:
added terms from the vulnerability assessment scenario
Hi Danny, I still want to highlight one last time that we will have 3-4 different kinds of capability in the terminology in -10 if we pull this in. I understand this to be a basis of discussion still :) I am not sure if that is the case, though! Let me elaborate. We have in SACM used by the architecture: Capability: : The extent of an SACM component's ability enabled by the functions it is composed of. Capabilities are propagated by a SACM component and can be discovered by or negotiated with other SACM components. For example, the capability of a SACM Provider may be to provide endpoint management data, or only a subset of that data. We have in i2nsf, referenced in the sacm terminology: We have the VA Terms: +Endpoint management capability: +: An enterprise IT capability managing endpoint identity, endpoint information, and associated metadata on an ongoing basis. +Vulnerability management capability: +: An enterprise IT capability managing endpoint vulnerabilities and associated metadata on an ongoing basis by ingesting vulnerability description information and vulnerability detection data, and performing a vulnerability assessment. "Managed" in i2nsf means "has interface on the management-plane". I still do not understand what managing actually means in the context of an VA capability :) What potential functions are propagated as capabilities? What is their input? What is their output? Is it possible that the two VA capabilities are actually tasks? Viele Grüße, Henk TL;DR I will pull these terms in, but we will have to align these terms better. On 07/08/2016 01:56 PM, Danny Haynes wrote:

Revised text:
results.  Types, classes or the characteristics of an individual target endpoint are defined via endpoint profiles. <ins> An enterprise IT capability managing endpoint identity, endpoint information, and associated metadata on an ongoing basis. </ins> The task by which endpoint attributes are evaluated. The resulting value from having evaluated a set of posture general, it cannot be simply assumed that the source of time a target endpoint uses is synchronized or trustworthy. <ins> Information pertaining to the existence of a flaw or flaws in software, hardware, and/or firmware, which could potentially have an adverse impact on enterprise IT functionality and/or security. Vulnerability description information should contain enough information to support vulnerability detection. A type of guidance extracted from vulnerability description information that describes the specific mechanisms of vulnerability detection that is used by an enterprise's vulnerability management capability to determine if a vulnerability is present on an endpoint. An enterprise IT capability managing endpoint vulnerabilities and associated metadata on an ongoing basis by ingesting vulnerability description information and vulnerability detection data, and performing a vulnerability assessment. The process of determining whether a set of endpoints is vulnerable according to the information contained in the vulnerability description information. </ins> 3. This memo includes no request to IANA.