Why are there two UUID's in by-component under control-implementation?

[telosBA]

<control-implementation> <implemented-requirement> <statement> <by-component> currently includes two uuid elements, namely, "component-uuid" and "uuid." Is this redundant? Is there a reason to have both within <by-component>?

[aj-stein-nist]

One (uuid) is the ID of the by-component entry itself and one is a reference to the component (component-uuid)?

Please see the documents on these topics:

• component-uuid
• by-component uuid

Here is an example SSP to help illustrate this example.

[telosBA]

What drives the existence of by-component uuid? Is it the component-uuid in combination with the <statement> uuid the drives the creation of the by-component uuid? (Important for control inheritance within projects, as component-uuid is dynamic.)

[aj-stein-nist]

It is a point of identification for the reference for that individual reference to the component when you have n>1 by-component usages? In a normal SSP, I perceive there could be dozens or more for a given component. By providing UUIDs you can write application code (if you want, it is not exactly required, but helpful) to target individual references every time you point to a component.

Does that help clarify?

[GaryGapinski]

My personal opinion: by-component uuid should be optional.

[telosBA]

It is a point of identification for the reference for that individual reference to the component when you have n>1 by-component usages? In a normal SSP, I perceive there could be dozens or more for a given component. By providing UUIDs you can write application code (if you want, it is not exactly required, but helpful) to target individual references every time you point to a component.

Does that help clarify?

To confirm, where it is stated that it should not change across versions, if the component changes the statement “Implemented or not implemented”, then the UUID does not change, but if we no longer use that component as a reference, then the UUID is retired. i.e. by-component UUID is unique to the project but the component-uuid is unique to the SITE

[david-waltermire]

My personal opinion: by-component uuid should be optional.

The uuid is there to allow the by-component entry to be referenced from the assessment layer. This value is intended to be machine generated. If we make it optional, few implementations will provide it. This will result in an effective denial of service to the assessment layer for most consumers of SSPs. This is why it is required.