OpenSCAP/scap-security-guide — pull request #21 by shawndwells (2014-08-12 19:29:08+00:00)
Title: CIS profile rewording

The prior wording of the C2S profile contained a statement that the C2S profile,
as it is derived from CIS' publicly available RHEL6 Benchmark [1],
could measure a system against the CIS RHEL6 baseline.

We have been informed that per CIS' terms and conditions, specifically under
RESTRICTIONS, item #8, one may not "represent or claim a particular level of
compliance or consistency with any SB product."

To remain in compliance with CIS' request, this patch updates the C2S profile
description to indicate that while the C2S profile may be sourced from the public,
freely available CIS benchmark, no representation or claim to a particular
level of compliance or consistency is being made.

CIS is eager to collaborate more closely with the community (and Red Hat) on
guidance development, in particular through the SCAP Security Guide. They have
expressed that having automated security guidance and workflows ship with the Operating
System is definitely a positive step, and one they encourage. Unfortunately, we were
unable to reconcile the CIS Terms and Conditions to provide a freely available SCAP
profile against the CIS baseline. When faced with the choice of paying
~$20,000 license fees [2], or rewording references to CIS compliance, the later was chosen.

[1] https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_6_Bench
mark_v1.2.0.pdf
[2] http://benchmarks.cisecurity.org/membership/certified/overview/